Privacy Policy

Lucky the Banker ("we," "us," or "our") operates the website at luckythebanker.com(the "Platform"). This Privacy Policy explains how we collect, use, store, and protect your personal information when you use our exam preparation and education platform.

By using the Platform, you agree to the collection and use of information in accordance with this policy. If you do not agree, please do not use the Platform.

Account Information

• Email address (used for authentication via one-time passcode)
• Display name (derived from your email)

Usage & Performance Data

• Quiz scores, answers, and completion times
• Study streaks, XP, and achievement badges
• Progress and mastery data per exam section
• Bookmarked questions and custom tests
• Activity logs (quiz starts, completions, milestones)

Technical Data

• IP address (for rate limiting and security)
• Browser type, device information, and user-agent string
• Pages visited, referring page, URL campaign parameters, and time spent on pages
• A randomly generated analytics session identifier
• Feature and funnel events, such as quiz starts, answers, completions, and sign-up steps

Optional Content and Communications

• Questions, prompts, or study material you submit to optional AI features
• Support requests, feedback, and email preferences
• Referral or affiliate attribution associated with links you use

We use cookies and similar technologies for authentication, preferences, attribution, and analytics. Cookies currently used by the Platform may include:

• ltb_session — An httpOnly session cookie that keeps you logged in. Expires after 30 days. Essential for authentication.
• ltb_analytics_session — A randomly generated first-party identifier used to group page and feature events into a browsing session. Expires after 2 hours.
• ltb_utm and ltb_ref — Remember campaign or referral attribution. These may remain for up to 30 days.
• ltb_theme — Your preferred color theme (light, dark, or system). This may remain for up to 1 year.
• ltb_onboard_exam, email-capture status cookies, andhero_lead_email — Remember onboarding or sign-up choices and, when you submit it, your email address so the sign-up flow can continue. These may remain for up to 30 days.

We use Google Analytics 4 to measure traffic and use of the Platform. The Google Analytics tag is loaded when pages are visited and may use identifiers or cookies, such as _ga, depending on Google's configuration and your browser. Google may process device, browser, approximate-location, page, referral, and interaction information under its own privacy terms.

We also record first-party analytics in our database. These records can include the analytics session identifier, page path and query string, referrer, time on page, user agent, feature events, and—when you are signed in—your account ID and email address. We use these records to understand product usage, diagnose problems, and improve study experiences.

You can block or delete cookies using your browser settings. Blocking essential cookies may prevent authentication or preferences from working correctly.

• To authenticate you and maintain your session
• To track your study progress and provide personalized learning
• To power spaced repetition and adaptive study recommendations
• To award achievements, streaks, and rewards
• To send study reminders (if enabled)
• To improve the Platform and fix bugs
• To measure traffic, attribution, feature adoption, and study-flow performance
• To prevent abuse and enforce rate limits

Account, study, and first-party analytics data is stored using Supabase, a hosted PostgreSQL database platform. Supabase provides encryption at rest and in transit, role-based access control, and backups. The Platform is hosted by Vercel. No online system can guarantee absolute security.

We do not sell, trade, or rent your personal information to third parties.

We do not use personal information for cross-context behavioral advertising. We disclose information to service providers only as needed to operate, secure, measure, and improve the Platform, including:

• Vercel for website hosting and delivery
• Supabase for database hosting and account data
• Google for Analytics and optional Google authentication
• Resend for transactional and opted-in email delivery
• Sentry, when enabled, for application error and performance diagnostics
• OpenAI, when you choose to use an AI-assisted study feature
• If required by law, regulation, or legal process
• To protect the rights, safety, or property of Lucky the Banker or its users

These providers may process information in the United States or other countries where they operate. Their handling of information is also governed by their applicable terms and privacy policies.

We retain account and study data while your account is active and as reasonably necessary to provide the Platform. Analytics, security, support, and transaction records may be retained for legitimate operational, legal, and fraud-prevention purposes. Cookie durations are described above. If you request account deletion, we will delete or de-identify personal data associated with your account within 30 days, except where retention is required by law or reasonably necessary for security, fraud prevention, or resolving disputes.

All Users

• Access the personal data we hold about you
• Request correction of inaccurate data
• Request deletion of your account and data
• Opt out of non-essential communications
• Block or delete browser cookies using your browser controls

California Residents (CCPA)

• Right to know what personal information is collected and how it is used
• Right to delete personal information
• Right to opt out of the sale or sharing of personal information (we do not sell personal information or use it for cross-context behavioral advertising)
• Right to non-discrimination for exercising your rights

EU/EEA Residents (GDPR)

• Right of access, rectification, and erasure
• Right to restrict or object to processing
• Right to data portability
• Right to withdraw consent where processing is based on consent
• Right to lodge a complaint with a supervisory authority

The Platform may be used by minors under parental supervision. We do not knowingly collect personal information from children under 13 without parental consent. If you believe a child under 13 has provided us with personal data without consent, please contact us so we can delete it.

We implement appropriate technical and organizational measures to protect your data, including HTTPS encryption, httpOnly session cookies, rate limiting, security headers, and access controls. However, no method of transmission over the Internet is 100% secure.

We may update this Privacy Policy from time to time. We will notify users of material changes by updating the "Last updated" date at the top of this page. Continued use of the Platform after changes constitutes acceptance of the revised policy.

If you have questions about this Privacy Policy or wish to exercise your rights, contact us at:

Lucky the Banker
Email: support@luckythebanker.com
Website: luckythebanker.com