Privacy policy

How Lucry collects, uses and protects your data when you use our website, shop and services.

Last updated: 21 October 2026

1. Who is responsible

Lucry, the operator of lucry.org, is responsible for processing your data. You can reach us at support@lucry.org.

2. Data we process

  • Your account: when you sign in with Discord, we receive your Discord user ID, username, display name and avatar. We do not receive your Discord email address. We use this to create your account and keep you signed in.
  • Orders: the email address you enter for key delivery, products, durations, quantities, prices, time, the payment method you choose, the Litecoin payment address of your order, the amount received and the transaction IDs, and the keys or login details you received. If you pay with PayPal, also the name and email address of the paying PayPal account and the PayPal transaction ID.
  • Support tickets: your messages and our replies, linked to your account and, if you choose, to an order.
  • Security: your IP address is processed to deliver the website and protect it from abuse. We store the last IP address and country of your account (from sign-in, orders and tickets) to prevent fraud and enforce suspensions, and a salted hash of it to limit the number of orders and requests per connection.
  • Notes: our support may add internal notes to your account, for example about earlier support cases.

We process this data to provide our Services and fulfil your order (Art. 6(1)(b) GDPR), to meet legal obligations such as keeping accounting records (Art. 6(1)(c) GDPR), and in our legitimate interest in a secure shop without abuse (Art. 6(1)(f) GDPR).

3. Service providers

  • Cloudflare hosts the website and database and runs the bot check (Turnstile) when you create an order.
  • Resend sends the email with your key.
  • Discord handles sign-in. Discord's own privacy policy applies to your Discord account. We also use Discord to notify our team about orders, tickets and stock: your Discord name, the product, the order or ticket number and ticket messages, never your key or email address. Our support team can also look up orders, accounts and tickets with our own Discord bot. Your delivery email address and keys are only shown there to the team member who asks for them, in a reply only they can see, and are never posted in a channel. Announcements and status updates in our Discord server contain no personal data.
  • Moderation in our Discord server: Discord's AutoMod checks messages for invite links, spam and blocked words before they are posted. Our bot does not read your messages: it only sees who writes when and in which channel, to stop spam and hacked accounts. If it removes or times out a member, we keep their Discord ID, name, the channel and what happened, never the message text.
  • PayPal processes payments you request for an order and settle with us in a support ticket. PayPal's own privacy policy applies.
  • Litecoin Space is used to check the public blockchain for payments to your order's address. Only the address is sent, no personal data.
  • Kraken and CoinGecko provide the LTC exchange rate. No personal data is sent.

Some of these providers are based in the USA. Where data is transferred outside the EU, it is protected by the EU-US Data Privacy Framework or the EU standard contractual clauses.

4. A note on the blockchain

Litecoin transactions are public and permanent. Anyone can see the payment address, the amount and the time of a transaction, and nobody, including us, can delete them. We never publish which payment address belongs to which customer.

5. Cookies

We only use cookies that are needed for the website to work:

  • lucry_session keeps you signed in (30 days, or until you sign out).
  • lucry_oauth protects the Discord sign-in against forgery (10 minutes).

Your basket is kept in your browser's local storage (lucry-basket: only the chosen variants and quantities). It is not sent to us until you create an order, and it is emptied when you do.

There are no analytics, advertising or tracking cookies. Cloudflare Turnstile checks when you create an order whether you are human and may process technical data of your browser for that. All fonts are loaded from our own server, no data is sent to Google Fonts.

6. How long we keep data

  • Account data and support tickets: as long as your account exists. You can ask us to delete your account at any time.
  • Order and payment records: as long as tax and commercial law requires, which can be up to 10 years.
  • Last IP address and country: replaced at your next sign-in, order or ticket, deleted with your account.
  • Hashed IP addresses for rate limiting: deleted automatically after about one day.
  • Sign-in sessions: deleted when you sign out or after 30 days.
  • Log of what our support team looked up or changed with the Discord bot (order and account numbers, no email addresses): 90 days.
  • Moderation log of our Discord server (Discord ID, name, channel and action, no message texts): 90 days.

7. Security

All connections are encrypted (HTTPS). Keys and login details are stored encrypted. Our server never holds the private keys of the wallet that receives your payment.

8. Your rights

You have the right to access, correct and delete your data, to restrict or object to its processing and to receive it in a portable format. To use these rights, contact us at support@lucry.org or through a support ticket. You also have the right to complain to a data protection supervisory authority.

9. Changes

We update this policy when our services or the law change. The date at the top shows the latest version.