Privacy Policy — Lucky Echo Labs, Inc.

Effective date: August 12, 2026

1. Who we are

Lucky Echo Labs, Inc. ("Lucky Echo," "we," "us," or "our") is the data controller responsible for your personal information. You can contact us at legal@luckyecho.com or at 4701 Sangamore Road, Suite N100, Bethesda, MD 20816, USA.

2. What this policy covers

This policy applies to our websites (including luckyecho.com) and our mobile games — including Arrow Rush, Trivia Peak, Flashback Trivia, and Go Steps Daily — and any other apps or sites we publish that link to this policy (together, the "Services").

3. Information we collect

Information you provide:

Name and email address when you submit a support or privacy request, and the content of your message
Account information in games that offer accounts or sign-in (such as an email address, display name or handle, and avatar choices)
If you use an invite-a-friend feature, the contact information you choose to share for sending the invitation

Information collected automatically in our games:

Device information: device model, operating system and version, language, region, IP address
Device and advertising identifiers (such as Apple's IDFA/IDFV or Google's Advertising ID), subject to your platform-level consent choices (on iOS, we request permission through App Tracking Transparency before tracking)
Gameplay data: progress, levels, scores, sessions, in-game events, and items
Purchase records for in-app purchases and subscriptions (processed by Apple or Google; we do not receive or store your payment card details)
Crash reports and diagnostic data

Health and motion data (Go Steps Daily only): with your permission, we read step counts from Apple HealthKit or your device's step counter to power gameplay. Health and motion data is used solely to provide the game's features (contests, goals, streaks). It is never used for advertising, never shared with advertising partners, and never sold.

Information collected automatically on our websites:

Page views and visit counts via Cloudflare Web Analytics (cookie-free, IP-anonymized)
Referrer URLs, device type, browser type, and general geographic region
Your IP address may be used to determine your approximate region for CCPA compliance purposes; it is not stored

4. How we use your information

To provide, operate, and improve the Services (including saving game progress and running in-game events)
To respond to support requests and privacy inquiries
To process and deliver in-app purchases and subscriptions
To show advertising in our games, including (with your consent, where required) personalized advertising
To measure the performance of our games and marketing (analytics and install attribution)
To send push notifications you have opted into
To detect and prevent fraud, cheating, and abuse
To comply with legal obligations

Legal bases (GDPR): performance of a contract (Art. 6(1)(b)) for providing the Services and processing purchases; consent (Art. 6(1)(a)) for personalized advertising, tracking identifiers, health/motion data, and push notifications; legitimate interests (Art. 6(1)(f)) for non-personalized advertising, analytics, security, and responding to inquiries.

5. Third parties we share data with

We share data with service providers who operate parts of the Services on our behalf:

Advertising: AppLovin (ad mediation) and its participating ad network partners, including Google AdMob, Meta Audience Network, Unity Ads, Liftoff, Moloco, Mintegral, DT Exchange (Digital Turbine), InMobi, BidMachine, Yandex Ads, and Pangle
Analytics: Amplitude (product analytics)
Attribution: Adjust (install and campaign measurement)
Purchases: Apple App Store and Google Play (payment processing); RevenueCat (subscription management)
Notifications: Firebase Cloud Messaging (push notifications)
Websites and infrastructure: Cloudflare (hosting, DDoS protection, privacy-preserving analytics), Render and Supabase (hosting and backend infrastructure), Resend (email delivery for support and privacy responses)

These providers process data under their own privacy policies and our agreements with them. We do not sell your personal information for money. Personalized in-game advertising may constitute "sharing" (or a "sale") as defined by some U.S. state privacy laws — see Section 8 for how to opt out.

6. Data retention

We retain personal information only as long as necessary for the purposes above. Support and privacy request emails are typically retained no longer than 2 years. Game account and progress data is retained while your account is active and deleted or anonymized after prolonged inactivity or upon a verified deletion request. Rate-limiting records on our websites (hashed IP addresses) are automatically deleted after 24 hours.

7. Cookies and tracking

Our websites do not set tracking cookies; our web analytics (Cloudflare Web Analytics) is cookie-free and does not track you across sites. We use localStorage solely to remember your CCPA opt-out preference; this does not leave your device. Our games do not use cookies but do use device and advertising identifiers as described in Section 3.

8. Your rights (California and other U.S. states)

If you are a resident of California or another state with a comprehensive privacy law, you have the right to:

Know what personal information we collect about you
Delete personal information we have collected
Correct inaccurate personal information
Opt out of the sale or sharing of your personal information (including for personalized advertising)
Non-discrimination for exercising your rights

To exercise these rights, use our Privacy Request form at luckyecho.com/privacy-request or email privacy@luckyecho.com. We will respond within the time required by applicable law (45 days for CCPA requests, extendable as permitted). To opt out of personalized advertising: on iOS, decline tracking in the App Tracking Transparency prompt or enable "Allow Apps to Request to Track" restrictions; on Android, use the advertising-ID controls in system settings; on our websites, use the "Do Not Sell or Share My Personal Information" footer link or enable the Global Privacy Control (GPC) signal in your browser.

If you are located in the EU, EEA, or UK, you have the right to access (Art. 15), rectify (Art. 16), erase (Art. 17), restrict (Art. 18), and port (Art. 20) your personal data, to object to processing based on legitimate interests (Art. 21), to withdraw consent at any time without affecting prior processing, and to lodge a complaint with a supervisory authority. To exercise these rights, contact privacy@luckyecho.com. We will respond within 1 month as required by applicable law.

10. Children

Our Services are not directed to children under 13, and we do not knowingly collect personal information from them. In accordance with COPPA, if we learn that a child under 13 has provided personal information without verifiable parental consent, we will delete it as quickly as reasonably practical.

11. International transfers

We are based in the United States and process data there. If you use the Services from outside the U.S., your information will be transferred to and processed in the U.S. Where required, we rely on appropriate safeguards for such transfers, such as standard contractual clauses.