SweepstakeReport Terminal · Effective October 15, 2026
Terminal privacy notice
What the Terminal keeps about you, why, for how long, and how to take it with you or delete it. The short version: an email, a password hash, your state, your list, your claim marks with any amounts you record on them and the claim time when you open a casino from the Terminal, the other numbers you type in, and any changes you report; the casinos you first visited through the Terminal's casino buttons or recorded a claim at, with the date of each first visit; and, only if you had a subscription before the Terminal became free, its status. Never a casino password, never a card number.
1. Who we are
The SweepstakeReport Terminal is run by Luck Incorporated LLC (“Luck Inc”, “we”). SweepstakeReport is owned by Luck Inc, which also runs Chance Infinite, a sweepstakes app. Chance Infinite is not listed here. The Terminal's data is kept for the Terminal only; it is not combined with Chance Infinite's. Until October 13, 2026 the Terminal sold subscriptions, through a Stripe account Luck Inc uses only for the Terminal; it sells nothing now, and the records of those subscriptions are used for the Terminal only.
This notice covers the Terminal app at sweepstakereport.com/terminal/app and its account, the casino links at sweepstakereport.com/go/ and the reports partner networks send us about them (section 3). The rest of sweepstakereport.com is a set of public pages with no accounts.
2. What we keep
| Data | What exactly |
|---|---|
| Account | Your email address; a salted hash of your password (never the password itself); the state you chose and when you last changed it; the plan your account's record holds (free for an account made since the Terminal became free; for an older account, the plan it had before, or free once its old subscription has ended; a record only: it changes nothing); when you confirmed you are 18 or older; when the account was created and last changed; whether your email is verified. |
| Your list | The casinos you track, stored as short codes such as mcluck, and the order you put them in. |
| Claims | Each time you mark a casino claimed: which casino, the time you gave, and when we recorded it. If you record it: the amount you received on that claim, in the casino's own coin, and whether you typed it or used “Same as last time” (which repeats your own last amount for that casino). When you open a casino from the Terminal and then mark it claimed within 30 minutes: the claim time, which is the number of seconds between the two. The Terminal measures it itself and never reads anything from the casino; if you did not open the casino from the Terminal, or more than 30 minutes passed, no claim time is kept. Undo removes the mark, its amount and its claim time. |
| Change reports | Each time you use “Report a change” on a casino: which casino, the kind of change you picked, your note and link if you add them, when you sent it, and its status (new, reviewed, applied or dismissed). A report is never shown to other users. Please leave personal details out of the note. |
| Casino first visits | The casinos you have visited, as our server counts a visit for partner links (section 3): which casino, and the date of your first visit there (the date only, in UTC, never the time of day). One date per casino, never replaced. A visit is noted when a click you made yourself on one of the Terminal's casino buttons (links at sweepstakereport.com/go/), while you are signed in, is your first visit to a casino open in your state, whether or not it went through a partner link, unless your state, or the state your connection appears to come from, keeps the click off partner links; and when you record a claim at a casino. When this notice took effect, the casinos on your list and those where you had recorded a claim were noted once too. Undoing a claim does not remove the note. It is how the Terminal uses a casino's partner link for your account at most once. A click on one of sweepstakereport.com's casino buttons (section 3) is never noted here. It is never sent to anyone else, and it is in your data download (section 10). |
| Casino link clicks | For a click on a casino link that goes through sweepstakereport.com/go/, by anyone, signed in or not: which casino, where the link was (as the link itself says: a part of the Terminal, a page of sweepstakereport.com, or other), the state the server went by, whether you were signed in, whether the click went through a partner link and, if not, which rule kept it off one, and the time. For a click that went through a partner link, or was kept off one only because you had visited the casino before, because the daily limit on partner links was reached or because the partner offer's link failed our check: which partner offer and network. Only for a click that went through a partner link: a random click number made for that one click. The state is the one on your account if you are signed in; if not, none, except for a click on one of sweepstakereport.com's casino buttons, where it is the state your connection appears to come from (section 7). This record holds no account, email, IP address or browser details, and we do not use it to find out who clicked. |
| Conversion reports | What a partner network's server tells ours when someone who came through a partner link signs up or buys at the casino (section 3): the click number it carries (the random number we put in that partner link), the network's own transaction id and offer id, the kind of event as the network names it, our commission on it and its currency, which network sent it, and when we received it. When the click number is one of ours for that network, the report is also noted with the casino that click was for. This record holds no account, email, IP address or browser details, and we do not link it to your account. |
| Consents | Which versions of the terms and this notice you accepted, and when. |
| Sessions | For each device you are signed in on: a hash of its session token, when it started, when it was last used and when it expires. Not the token itself. |
| Email links | For verification and password reset emails: a hash of the link's token, what it is for, and when it was made, expires and was used. |
| Abuse counters | Short-lived counts of sign-in, sign-up and reset attempts, and of clicks on links at sweepstakereport.com/go/, keyed by a one-way keyed hash of your IP address or email, so they cannot be read back as either. A count of the change reports you send (at most 10 a day) is kept the same way, keyed by a one-way keyed hash of your account, and so are the counts behind the small daily limits on partner links (section 3): for the Terminal's buttons, per account and per connection (at most 30 a day for your account and 60 for your connection); for sweepstakereport.com's casino buttons, per connection and counted separately (at most 60 a day for your connection), keyed by a one-way keyed hash of your account or of your IP address. |
| Old subscription (only if you had one) | For a subscription started before the Terminal became free (section 8): the id of your customer record at Stripe, the plan it was for, and its status and dates (when it renews, whether and when it was cancelled). Not your card, your billing address or your invoices: those stay with Stripe. |
| Tracking records | What you type in: the redeemable balance and playthrough you enter per casino, reset timers you set, casinos you skip for the day, redemptions you log (casino, amount in dollars, method, the dates you asked and received it, and its status), and which in-app alerts you turned on. |
| Alert records | What you type in: per-casino alert levels (a balance, a number of days a redemption has been pending); the time of your daily summary, your quiet hours and the time zone they use. Portfolio, insights and the priority ranking are worked out from your records when you open them; they are not stored. |
| Stripe events | The id and type of each billing message Stripe sends us about an old subscription, so the same message is never applied twice. |
3. Partner links
Some casinos, through affiliate networks, pay a commission when someone signs up or buys at the casino after following a link from us. Such a link is a partner link: we may earn a commission when you sign up or buy at a casino after following a partner link. Partner status never changes order, estimates or ratings (terms of use, section 9).
- Which links in the Terminal. A casino's Open buttons (in its details, on Home and in the Reward Queue) go through sweepstakereport.com/go/ until your first visit to that casino through them, unless partner links are off for your state. There our server decides at the moment you click whether to send you through the casino's partner link or straight to the casino's own site. The buttons look the same either way. Every other casino link in the Terminal goes straight to the casino's own site.
- Which links on sweepstakereport.com. The Visit buttons in the casino lists on the app database page (sweepstakereport.com/apps/: Our picks, Most popular and Underrated), and the Web link on each app database fact sheet whose brand is a casino the Terminal lists, go through sweepstakereport.com/go/ on every click, whether or not you are signed in or have an account. There our server decides at the moment of each click whether to send you through the casino's partner link or straight to the casino's own site, by the partner offers in force at that moment. These links have no first-visit rule: a click on one of them may go through the casino's partner link every time (see the point on when a click never goes through a partner link, below). Such a click records nothing on your account: it is not a first visit for the Terminal's Open buttons, and a first visit recorded in the Terminal does not change where it goes. The buttons look the same either way; on the app database page and its fact sheets, a casino that had a partner offer on the date the app database page shows carries a Partner label. Every other casino link on sweepstakereport.com, such as a source, official rules or app store link, goes straight to the page it names.
- How the server decides. For the Terminal's Open buttons, your state means the state on your account, and the server never uses a partner link when you are not signed in; when your state is one where the Terminal is not available or is on our own list of states that never get partner links; when your connection appears to come from a state on either list (section 7); when the casino is not listed in the Terminal or is not open in your state; or when your account or your connection has reached a small daily limit on partner links per account and per connection (section 2). Through those buttons it uses a casino's partner link for your account at most once, on your first visit to that casino through them: never for a casino in your casino first visits (section 2), which hold every casino where you have recorded a claim. For sweepstakereport.com's casino buttons, your state means the state on your account if you are signed in, and otherwise the state your connection appears to come from (section 7). There the server may use a casino's partner link on every click, and never does when there is no such state; when your state is one where the Terminal is not available or is on our own list of states that never get partner links, or, if you are signed in, your connection appears to come from a state on either list; when the casino is not listed in the Terminal or is not open in your state or, if you are signed in, in the state your connection appears to come from; when the casino has no partner offer at that moment; or when your connection has reached a small daily limit on partner links from these buttons (section 2). Your casino first visits play no part there, and such a click is never added to them. Requests that are not a click you made on our own pages, such as link previews in messaging apps, search engine robots, pages a browser loads ahead of time and links on other websites, always go straight to the casino and are not remembered; so do clicks from browsers too old to tell our server what kind of request they are making. One exception: the casino buttons in your Terminal carry a short code tied to your account, so a copy of one of your own buttons' links, opened while you are signed in, counts as your click wherever it is opened. Our link sets nothing in your browser either way (section 6).
- What our links remember. When you are signed in and a click you made on one of the Terminal's Open buttons is your first visit to a casino that is open in your state, and your state is not one of those above, the server notes that visit in your casino first visits (section 2), whether or not the click went through a partner link, for example because the casino had no partner offer then, is not listed in the Terminal, or the daily limit was reached. A claim you record at a casino is noted there too. Once your first visit to a casino is recorded, the Terminal never uses its partner link for your account later, even if the casino had no partner offer at that visit. Visits our server did not record, including any before this notice took effect, do not count. When this notice took effect, the casinos on your list and those where you had recorded a claim were noted as visits. The casino links in your Terminal carry a short code made from your account and the casino, so that our server can recognize a click on your own Terminal page even when your browser does not say, or does not say correctly, where the click came from. Our server checks the code at the moment of the click and does not store it (Cloudflare's request logs, section 8, can hold the address you opened for up to 7 days). A click on one of sweepstakereport.com's casino buttons is never noted in your casino first visits, signed in or not, and sets no cookie: it is only logged, like every click on these links (section 2). Nothing is noted when you are not signed in, and nothing is kept in your browser.
- What the network gets. A partner link passes through the partner network's own pages, which record the click and may set the network's own cookies under its own policies. From us the network gets at most a random click number, never your account, email or state (section 8).
- What the network reports back. If someone who came through a partner link signs up or buys at the casino, the network's server may tell ours, naming the click only by its click number: a conversion report (section 2). We use these reports to see which partner links work and what they pay. A conversion report holds no account, email, IP address or browser details, and we do not link it to your account. We keep each one for 400 days (section 9).
4. What we never collect
- No casino credentials, ever. The Terminal has no place for a casino username or password and never signs in to a casino.
- No casino balances, coins or redemptions are ever read from a casino. The Terminal keeps only the ones you enter yourself (section 2): the amount you received on a claim, and balances and redemptions, if you record them.
- The change notices in the Terminal (“What changed” and the “Changed” mark) come from public pages that we check ourselves: the casinos' own pages and, for some daily estimates, review sites. They are never read from your account at a casino, and they use nothing about you beyond your list and your alert settings.
- No card numbers or bank details. The Terminal sells nothing. The old subscriptions were paid on Stripe's own pages, and we received only a customer id and the subscription's status, never the card.
- No government ID, date of birth, name, address or phone number.
- No advertising or analytics trackers on the Terminal's pages: they load no tracking scripts or pixels and set no advertising cookies. When a click goes through a partner link (section 3), your browser passes through the partner network's own pages, which record that click and may set their own cookies under the network's own policies (section 8).
5. Why we keep it
- To run your account and show you the same list on every device.
- To keep the Terminal out of the states where it is not available, and to keep adults only.
- To choose which state's figures the public pages show (how many casinos the Terminal shows there, how many of them show a free sign-up bonus, and the typical daily amounts of those with a confirmed free daily reward, added up in Sweeps Coins), from the state your connection appears to come from, at the moment of the request and without storing it (section 7).
- To keep accounts safe: password checks, sign-in limits and lockouts.
- To send the emails you ask for (verification and password reset), once email is set up.
- To record which version of the terms and this notice you accepted.
- If you had a subscription before the Terminal became free: to show its status in Settings, to open Stripe's billing page for you so you can cancel it or see your invoices, to handle its cancellation, refunds and disputes, and to cancel it when you delete your account or when your state is added to the list where the Terminal is not available.
- If you send a “Report a change”: to re-check that casino's facts on its own pages, and for nothing else.
- If your claims have claim times: to show you how many minutes your claims take and how many coins per minute they gave you, worked out from your own records.
- If you click one of the Terminal's casino buttons that goes through sweepstakereport.com/go/: to decide at that moment whether the click goes through a partner link, from which we may earn a commission (section 3), and to note your first visit to that casino, so that the Terminal uses its partner link for your account at most once. If you are signed in, this uses your state, your casino first visits, the state your connection appears to come from and the daily partner link counts in section 2; if you are not, nothing about you is used apart from the abuse counter in section 2, and the click goes straight to the casino. If you click one of sweepstakereport.com's casino buttons (section 3): to decide at that moment whether the click goes through a partner link, from which we may earn a commission. This uses the state on your account if you are signed in, the state your connection appears to come from and the daily partner link count for your connection in section 2; it never uses or adds to your casino first visits.
- Casino link clicks: to count how casino links are used and which rules applied, and to match what partner networks report to us by click number. These counts name no one.
- Conversion reports: to see which partner links work and what they pay. They name no one, and we do not link them to your account.
We do not sell your personal information, share it for advertising, or use it to profile you. A partner link passes the network at most a random click number, never your account, email or state (section 8).
6. Cookies
The Terminal sets two cookies. __Host-srt_session keeps you signed in. It is HttpOnly (page scripts cannot read it), Secure (sent only over HTTPS) and SameSite=Lax, and it holds a random token, nothing about you. It lasts 30 days from your last visit, and a session ends 180 days after you signed in whatever happens. Signing out deletes it. srt_in holds only the value 1 and tells the pages of sweepstakereport.com to show “Open Terminal” instead of “Log in”. Page scripts can read it; it is Secure and SameSite=Lax, lasts as long as your session and is deleted with it, and our servers never read it.
The Terminal also remembers one choice in your browser's own storage, not in a cookie and not on our servers: the Reward Queue order you pick (ready longest first, or biggest first). Signing out does not clear it; your browser's settings for this site do.
There are no advertising, analytics or third-party cookies in the Terminal. The public pages of sweepstakereport.com set no cookies; they read srt_in only to choose which button to show, and they count which links are tapped, without cookies or identifiers, and that count is not tied to your account. Links at sweepstakereport.com/go/ set no cookies; if you are signed in, they read __Host-srt_session to know your account for the checks in section 3. When a click goes through a partner link, the partner network's own pages may set their own cookies under the network's own privacy policy; the Terminal does not set or read them.
7. Your state and location
The Terminal is not available in California, Connecticut, Indiana, Louisiana, Maine, Montana, New Jersey, New York or Tennessee; Oklahoma from November 1, 2026. To enforce that it uses two things: the state you choose, which is stored on your account, and the state your internet connection appears to come from, which Cloudflare works out from your IP address on each request. That second one is used at the moment of the request and not stored, at sweepstakereport.com/go/ too, where it can keep a click off partner links (section 3), with one exception: for a click on one of sweepstakereport.com's casino buttons made while you are not signed in, it is the state the server goes by, and that click's log row keeps it (section 2). Your IP address is only kept as the one-way keyed hash in the abuse counters above. The public pages of sweepstakereport.com also use the state your connection appears to come from, at the moment of the request and without storing it, to choose which state's figures to show (section 5).
8. Who else handles it
- Cloudflare, Inc. hosts the Terminal and its database (Cloudflare Workers and D1). Cloudflare keeps request logs for the Terminal's server for up to 7 days; they can include the time, the page requested and network details.
- Email: the Terminal does not send email yet. When it starts, an email delivery provider will send verification and password reset emails and will receive your email address and the message. We will name that provider in this notice before it is used.
- Google Fonts: the Terminal app loads its typefaces from Google's servers, which, like any web server, receive your IP address and browser details when the fonts load.
- Stripe, Inc. processed the payments of the subscriptions the Terminal sold until October 13, 2026, in Luck Inc's Stripe account; the Terminal sells nothing now. If you had one, Stripe has the email address and Terminal account id we sent it at checkout, and the card details and, where asked, the billing address you gave on Stripe's pages; when you open Stripe's billing page from Settings, we send it your Stripe customer id. Stripe uses that information under its own privacy policy, at stripe.com/privacy, and keeps payment and invoice records as payment and tax rules require, including after you delete your Terminal account. We keep only your Stripe customer id, the plan it was for and your subscription's status and dates (section 2).
- Partner networks: the affiliate networks that run the casinos' partner links (section 3). When a click goes through a partner link, our server sends your browser to the network's link for that casino, usually with a random click number added, and tells your browser not to pass on the page you came from; the network then sends you on to the casino. We send the network nothing else: never your account, email or state. Like any web server, the network's servers receive your IP address and browser details when your browser loads their pages, and those pages may set the network's own cookies. If you then sign up or buy at the casino, the network and the casino may record that you came through that link, and the network's server may tell ours, by click number, that a sign-up or purchase followed, with the network's transaction id, its offer id and our commission (a conversion report, section 2). They use what they collect under their own privacy policies.
We share data with no one else, except where the law requires it.
9. How long we keep it
| Data | Kept until |
|---|---|
| Account and consents | You delete your account. |
| Your list | You remove a casino, or delete your account. |
| Claims | You undo the mark (within 10 minutes of making it), or you delete your account. Removing a casino from your list keeps its claim marks. An amount you clear from a claim is removed at once. A claim time stays with its claim and is removed with it, including when you delete your account. |
| Change reports | You delete your account. |
| Casino first visits | You delete your account. Each casino keeps only its first date. |
| Casino link clicks | 400 days, then removed daily. They hold no account, so deleting your account does not remove them. |
| Conversion reports | 400 days, then removed daily. They hold no account, so deleting your account does not remove them. |
| Sessions | You sign out, 30 days pass without use, or 180 days pass since you signed in, whichever is first. Expired sessions are removed daily. |
| Email links | They expire (verification after 48 hours, password reset after 30 minutes); expired ones are removed daily. |
| Abuse counters | About two hours at most (two days for the count of change reports you send and the daily partner link counts); expired ones are removed daily. |
| Old subscription, tracking and alert records | You delete your account. Records you delete yourself, such as a redemption, a balance or an alert, are removed at once. A skip for the day ends at your next midnight and is removed daily after that. |
| Stripe events | 30 days, then removed daily. |
| Request logs at Cloudflare | Up to 7 days. |
| Payment records at Stripe | Kept by Stripe, not by us, for as long as payment, tax and accounting rules require, even after you delete your Terminal account. |
| Backups | Database backups can restore any point in the last 30 days, so data you delete can remain in them for up to 30 days, after which it is gone. |
10. Download, change or delete
- Download: you can download everything on your account as a file, at any time, including your claims with their amounts and claim times, your tracking and alert records, your casino first visits, your account's plan record (section 2) and, if you had one, your old subscription's status and dates. You can also download your claims, redemptions, balances and portfolio summary as CSV files. No file contains your password hash, any token or any Stripe id.
- Change: you can change your state, your list, its order and your password.
- Delete: you can delete your account at any time with your password. A subscription Stripe could still charge is cancelled at Stripe first. Your account, list, claims, change reports, casino first visits, tracking and alert records, subscription status, consents, sessions and email links are then removed from the live database at once, and so are the abuse counters tied to your email or your account. Backups follow within 30 days. Casino link clicks and conversion reports hold no account, so they are not part of the download or the deletion (section 9).
- If your state becomes one where the Terminal is not available, you can still sign in to download your data or delete your account.
- By email: you can also ask us to see, correct or delete your data, or use any other privacy right the law of your state gives you, by writing to support@luckincorporated.com. We may ask you to confirm that the account is yours before we act, for example by writing from the email address on it. We respond within 45 days, or sooner where a state law requires.
11. Security
Passwords are hashed with PBKDF2 (SHA-256) and a random salt per account. Session and email tokens are stored only as hashes. Sign-in attempts are limited and repeated failures lock that address out for a while. All traffic uses HTTPS. No system is perfectly secure; if we learn of a breach that affects your data, we will tell you as the law requires.
12. Adults only
The Terminal is for people 18 or older. We do not knowingly keep data about anyone younger; if you believe a minor has an account, tell us and we will delete it.
13. Changes
Each version of this notice carries a date; this one is in force from October 15, 2026. When it changes in a way that matters, the Terminal asks you to accept the new version before you continue.
14. Contact
Luck Incorporated LLC, for SweepstakeReport. Privacy questions and requests, including requests to exercise your privacy rights or to delete your data: support@luckincorporated.com. We may verify your identity first, and we respond within 45 days, or sooner where a state law requires.
See also the terms of use and the Terminal overview.