Privacy Policy

Support requests

When you submit the support form, we store the request type, message, optional contact or account identifier, and processing status. Only authorized administrators can view this information, to investigate problems, respond, and verify deletion requests. Do not include passwords or sensitive payment information. Requests are retained while needed to handle your issue or meet legal obligations; you may request deletion through /en/support.

Scope

This policy applies to the Loto Bingo mobile app, public website, backend APIs, and internal admin tools. Loto Bingo is a virtual-point bingo game. Tickets deduct points and winners receive the room’s virtual point prize pool. There are no real-money bets, cash withdrawals, or real-world prizes.

Apple sign-in tokens

Apple authorization codes are exchanged on our server. The resulting refresh token is encrypted, excluded from profile API responses, and used only to manage and revoke the Apple account connection.

Account data

When you use the app, we may process your display name, avatar, guest or signed-in status, email, Google or Apple identifier, guest device identifier, login token, last activity time, and language or theme preferences. Guest device identifiers help restore the same guest account on the same device and limit abuse.

Game and wallet data

We store room information, room players, ready states, loto tickets, drawn numbers, winners, game history, coin balance, wallet transactions, daily rewards, lucky wheel rewards, and premium status where applicable. This data is required to run realtime gameplay, calculate results, prevent abuse, and support users.

Technical and analytics data

The app may collect usage events such as screens viewed, sessions, technical errors, device type, operating system, language, approximate region, and performance events. We use Firebase Analytics or similar services to understand traffic, improve the product, and diagnose issues.

How we use data

We use data to create and authenticate accounts, synchronize realtime rooms, enforce game rules, keep reasonable history, grant coins or premium benefits, prevent spam or fraud, provide support, analyze product health, protect our systems, and comply with legal requirements. We do not sell your personal data.

Third-party services

The app may integrate Google Sign-In, Sign in with Apple, Firebase Analytics, Firebase/Google services, RevenueCat for App Store/Google Play point-purchase verification, realtime/WebSocket services, hosting, and databases. These providers receive only the data needed for their functions and process it under their own policies.

Point purchases

When point packs are available, purchases are processed by Apple or Google and verified through RevenueCat. RevenueCat receives a pseudonymous account identifier, product and transaction identifiers, purchase status, and store transaction details. We do not receive your payment-card number. Credits are recorded in the server wallet; duplicate notifications and restores do not issue extra points. Refunds reverse the related points, including spent-point debt. Premium is not offered in this release.

Purchase records after deletion

When an account is deleted, minimal pseudonymous billing identifiers and transaction records may be retained for refund processing, fraud prevention and audit. These records do not restore the closed account or grant new points.

Age suitability

The game is intended for adults aged 18 or above, subject to any higher store or regional age requirement. It is not directed at children. Parents may contact the support form about personal-data concerns.

Advertising and Premium

This release does not show advertisements and does not offer Premium. Consumable point packs use App Store or Google Play billing when available.

Retention

Account data is kept while the account remains active. Some game history, wallet transactions, security logs, or anonymized records may be retained longer to preserve game integrity, resolve disputes, prevent fraud, or comply with legal obligations.

Security

We use token authentication, admin access controls, CSRF protection for web forms, API rate limiting, database access controls, and HTTPS in production. No system is perfectly secure, but we design the service to reduce the risk of unauthorized access, loss, or misuse.

Your choices

You may sign out, edit your profile, and request account and data deletion in the app or through /account-deletion. Deleting your account may remove access to coins, history, premium status, and guest data; some anonymized or legally required records may remain.

Contact

For privacy, deletion, or account questions, use the support form at /en/support. Requests are sent to the Loto Bingo administration inbox.