Privacy Policy

1. Who processes the data

Lotto Simulator processes data necessary for the operation of the app, account, and subscription. The current contact information for the operator and support team is provided via the "Support" link.

2. What data is processed

• Supabase UUID account ID, email, confirmation status, and technical login information.
• User-saved combinations, settings, language, and data explicitly submitted by the user to app functions.
• Profile data — only if you enter it yourself in “Account”: a display name (up to 60 characters), a date of birth and a profile photo. They are stored in your account and are not shown to other users: the name appears in your account screen, the photo in your account screen and in the app header, and the date of birth is used only for an in-app greeting on your birthday. This data is not passed to analytics. You can change or delete the name and the date of birth in “Account”.
• Profile photo — any image you choose yourself: on iPhone and iPad in the system photo picker, on Android in the system file picker, in a browser in the file selection dialog. The app receives only the selected image, not access to your gallery or files. Before saving, the app reduces the image to 512×512 pixels and saves it as a JPEG without the original file’s metadata (camera model, date taken, location). The image is kept in private storage; through the app, only your account can access it. You can replace it by choosing another image or delete it with “Remove photo”; it is deleted together with your account.
• The profile photo needs no device permissions: the app does not request access to the camera, the photo library or files and does not open the camera itself. The image selection dialog is shown by the system or the browser.
• The app version, the platform and limited technical request data, including the IP address when the server is contacted, for operation, security and abuse prevention. Without consent, statistics are limited to an anonymous visit counter: the country of the visit (determined by the server from the request address), the platform, your analytics choice, the network type (for example a home provider, a mobile operator, a data centre or a VPN), a technical assessment of the request as ordinary or automated (from the browser type) and whether you are signed in, without naming the account. Neither the address nor session or account identifiers enter the counter; a truncated hash of the address is used only as a temporary rate-limiting key and is deleted after 7 days. To estimate the number of different guests per day, the server computes a daily key: a hash, made with the server's secret key, of the date, the network (without the last part of the address), the browser type, the operating system, the device, the platform and the language. The key belongs to one day only and does not link visits on different days. For days that begin after this version takes effect, the key is replaced by a random value within an hour after the day ends (Oslo time), and only an anonymous counter row remains. Keys of earlier days are not changed and are kept with their rows until those rows are deleted after 400 days.
• Only with analytics consent and the separate device-recognition consent, and in browsers the app's owner has marked as his own: browser-independent technical characteristics of the device — screen size, number of touch points, platform, time zone, the set of system fonts (a bitmap over a fixed list, without font names), number of processor cores, audio sample rate, graphics processor family and maximum drawing area. They serve a single purpose: recognising the app owner's own devices so that his visits stay out of the statistics and service notifications. The server turns them into a pseudonym with its secret key, compares it with the owner's device list and stores nothing for anyone else. Without these consents the characteristics are neither read nor sent.
• The iPhone, iPad and Android apps do not read these technical characteristics and do not use device recognition. On iPhone and iPad, an installation is identified by a random identifier created by the app and kept in the device keychain; it is used only to protect free trial runs and to deliver push notifications.
• Only with analytics consent: a random browser or app-installation identifier, sessions, opened sections and used features, active time, the traffic source (the domain and path of the page you came from, without address parameters; campaign tags; the name of an ad-click parameter without its value), device type, browser, operating system, language, time zone, screen size and approximate location (country, region, city) determined on the server from the IP address. The IP address is not stored: a pseudonymous network identifier is kept instead, from which the IP address cannot be recovered.
• Repeat visits: without analytics consent they are not determined, because the daily key does not link different days. With consent, a repeat visit is recognised by the random identifier of the browser or app installation. A browser whose storage was cleared counts as a new visitor unless device recognition is on; another browser or another device does unless you are signed in.
• Lotto Simulator's promotion links (lottosimulator.app/go/…) lead to a page of the app and add campaign tags to its address (utm_source, utm_medium, utm_campaign, utm_content); the app records them only together with consented analytics. The site's lottery statistics pages pass only the domain of the site you came from, and the same tags, into their links to the app, without writing to the device and without sending anything anywhere. If the owner switches on click counting for these links, the server increments an anonymous counter while redirecting (day, link and kind of request: ordinary, repeated, link preview or robot); no address or browser data is stored, and repeated taps are recognised with the same temporary rate-limiting key, deleted after 7 days. This counting is off by default.
• Only with separate device recognition consent: technical browser characteristics that allow the same device to be recognised after storage is cleared.
• Subscription status, product, merchant, expiration date, and transaction IDs received from RevenueCat, Apple, Google Play, or Paddle.
• On Android, an installation identifier: a SHA-256 hash of the ANDROID_ID; the ANDROID_ID itself never leaves the device. Used only to protect free trial runs and to deliver push notifications; the server keeps only its HMAC.

Lotto Simulator does not receive or store your full card number, CVV, bank password, or store payment details.

3. What the data is used for

• To log in, sync your account, and maintain unified access to PRO across the user's devices.
• To provide Free and PRO features, restore purchases, and verify current access rights.
• To show your profile (name and photo) and to greet you on your birthday in the app.
• For security, abuse prevention, diagnostics, support, and compliance with legal obligations.
• Notifications are available only with user permission; permission can be revoked in device or app settings.
• For statistics and improving the app, only with consent: how many people use the app, where visitors come from, which countries they are in and which features are used. This data is not used for advertising, is not sold and is not shared with third parties for their own purposes.

4. Legal grounds

Data is processed to fulfill the contract, comply with the law, protect legitimate interests in the security and reliability of the service, and on the basis of consent where required, such as for notifications.

Analytics and device recognition are based on consent only (Art. 6(1)(a) GDPR). Information is written to and read from the device for these purposes only after consent, in line with § 3-15 of the Norwegian Electronic Communications Act (ekomloven) and the ePrivacy rules. The anonymous visit counter of section 2 writes nothing to the device and reads no technical characteristics from it; we base the processing of the request address for this counter and for protecting the service on our legitimate interest (Art. 6(1)(f) GDPR) in general statistics and security. Counting clicks on promotion links without consent is switched off by default.

5. Analytics, Device Storage and Your Choice

Until you have made a choice, the app stores no analytics identifiers and sends no usage statistics. Whatever you choose, only an anonymous visit counter is kept: country, platform, network type, an automated-request flag and whether you are signed in, plus, to count guests per day, the daily key described in sections 2 and 8; no cookies, nothing written to the device and no device characteristics read (the contents are described in section 2). On the first visit a notice with equal “Decline”, “Customize” and “Accept” buttons is shown. You can change your choice at any time in “Privacy settings” at the bottom of this page or in the “About” window.

• Necessary storage (always): language, theme, sign-in session, your consent choice and the data of features you use.
• Analytics (only with consent): localStorage entries loto_an_profile_v2 (random identifier), loto_an_session_v2 (session, ends after 30 minutes of inactivity), loto_an_queue_v2 (events not yet sent), loto_an_first_touch_v2 (first traffic source), loto_an_user_v2 (account sign-in marker used to count sign-ins and sign-outs) and loto_an_legacy_v2 (identifier from the previous app version, kept only to delete its data at your request). No cookies are used for analytics.
• Device recognition (separate consent, only together with analytics): a technical browser fingerprint used to recognise the same device.
• Google Analytics 4 (only with analytics consent): after you press “Accept”, the Google Analytics tag of Google LLC (for users in the EEA, the UK and Switzerland: Google Ireland Limited) is loaded as an independent control counter of visits and product events: page view, combination generation, opening a PRO feature, the PRO screen, checkout start and a confirmed purchase (without amounts). No user identifier is sent, Google Signals and ad personalisation are off, IP anonymisation is requested; Google sets the cookies _ga and _ga_* (kept for up to 2 years). With “Decline” the tag is not loaded and nothing is sent to Google; withdrawing consent disables the tag and deletes these cookies on this site. Google processes the data under its own privacy policy.
• PostHog (only with analytics consent): after you press “Accept”, the product analytics service of PostHog Inc. with data stored in the EU (PostHog EU Cloud) is loaded so we can understand how the app’s features are used and find errors: product events and taps, tap heatmaps, loading speed, error reports and session recording (a replay of what happens on the screen). Session recordings hide every input field, e-mail addresses, long numbers and tokens; the owner panel is not recorded, and network request contents and the console are not stored. After you sign in, only the internal account identifier is used and no e-mail address is sent; after you sign out, a new anonymous identifier is created. PostHog keeps localStorage entries with the prefix ph_ on the device (device and session identifiers); no cookies are used. With “Decline” PostHog is not loaded and receives nothing; withdrawing consent stops collection and deletes these entries on the device. Data already sent to PostHog can be deleted on request to support. PostHog processes the data on our behalf.

Withdrawing consent immediately stops collection, removes these entries from the device and requests deletion of this device’s analytics data on the server. Declining also deletes data collected on this device by the previous app version. Automated browsers, test and local environments are not counted in statistics.

6. Service providers

This service may use Supabase for account and server data, RevenueCat for subscription status, Apple and Google Play for in-app purchases, Paddle for web payments, as well as hosting, email delivery, and notification providers. Each provider processes data according to its own terms and applicable law.

Our own statistics are processed in Supabase and are not shared with advertising services. With your analytics consent, independent statistics are kept in parallel in Google Analytics 4 (Google LLC / Google Ireland Limited) and in PostHog (PostHog Inc., data stored in the EU), see section 5; without consent nothing is sent to these services. Approximate location is determined on our servers; IP addresses are not passed to third-party geolocation services.

To assess the site's visibility in search, the owner receives Google's aggregated reports on impressions and clicks in Google search results (queries, pages, countries, devices) from Google Search Console. No data about Lotto Simulator visitors is sent to Google for this.

IP geolocation by DB-IP · DB-IP Lite databases, CC BY 4.0

Cloudflare Turnstile may protect forms, and Firebase Cloud Messaging (Google) delivers push notifications on Android.

7. International data transfer

Providers may process data in other countries. Where necessary, legally required transfer mechanisms and contractual safeguards are used.

8. Retention period

Data is retained only for as long as necessary for the account, app functionality, security, accounting, and legal responsibilities. Subscription and transaction records may be retained longer if required by law or to protect the rights of the user and operator.

Analytics events are kept for no more than 13 months and then deleted; anonymous visit counters by country, promotion-link click counters and owner-visit counters are kept for up to 25 months; daily rows of the guest counter for up to 400 days. For days that begin after this version takes effect, a guest's daily key is replaced by a random value within an hour after its day ends; keys of earlier days stay as they are until their row is deleted after 400 days. The owner's service notifications about visits are kept for up to 13 months; their technical duplicate-protection key contains the guest's daily key, which is likewise replaced only in notifications of days that begin after this version takes effect. The log of consent decisions (a random choice identifier, the decision, policy version, date, platform, language and country, with no IP address and no account) is kept for up to 3 years as proof of consent.

9. User rights

Depending on the country, the user may request access, correction, deletion, restriction, data portability, objection to processing, or withdrawal of consent. Some records cannot be deleted immediately if legally required to be retained.

You can delete this device’s analytics data at any time with the “Delete this device’s analytics data” button in “Privacy settings”.

10. Safety and children

Technical and organizational security measures are used, including access control and server-side subscription verification. No system guarantees absolute security. The Service is not intended for children under the age of digital consent established by applicable law.

11. Changes and contact

For significant changes, the document date will be updated and, where necessary, a notification will be displayed. For privacy questions, please use the official support channel.

12. Account deletion

You can delete your account in the app on Android, iPhone or at lottosimulator.app: sign in with your e-mail, open “Account”, tap “Delete account” and confirm. If you cannot sign in, write to support from the account’s e-mail.

The account, e-mail, profile, avatar, saved combinations, PRO access, settings and notification subscriptions are deleted immediately and permanently. Purchase records and anonymised analytics are kept without any link to the account (section 8). Cancel an App Store or Google Play subscription separately in the store.