Privacy Policy
Last updated October 6, 2026
What we collect, why, who else sees it, and the choices you have.
Draft: a lawyer has not reviewed this text yet, and it may change before launch.
01Who we are and our roles
Luaward is operated by [operator name and registered address — to be completed before launch]. For your account we decide why and how data is used (the controller). For the people who run your scripts or open your key pages we act for you (the processor). Privacy requests go through the notice form at /report; a direct privacy address will be listed here once it exists.
02What we collect
Account data: email, display name, sign-in method, passkeys and two-factor settings. Your scripts, stored encrypted. Your settings and what you do in the dashboard. Security records: IP address, browser, device and session details. When a script or key page runs: device ID, IP address, country, platform, executor, game and player identifiers, key and time. Payments: the plan, amount, method and time of each payment, and the reference Stripe or TrueMoney gives us for it. Card numbers go to Stripe and never reach us.
03Why we use it
To provide the service you asked for (contract); to check keys, stop abuse and fraud, and keep Luaward secure (our legitimate interests); to meet legal duties; and for anything optional, such as Beta usage data, only if you agree, which you can withdraw. We do not sell personal data and we do not use it for advertising.
04Visitors to key pages
People who open a key page created by a developer are that developer’s visitors. We process their data on the developer’s behalf, to issue keys and stop bypassing. We keep: a random visitor ID in a cookie, a salted hash of the IP address (never the address itself), the country Cloudflare reports, the browser type (for example Chrome), which steps were done and when, the Discord account ID if the page asks you to link Discord (we read only that ID), and the key we issued. The developer sees the country, browser, progress and Discord ID of visits to their page, and can block a visitor. Link providers (Linkvertise, Lootlabs, Work.ink) and Discord are independent of us and have their own policies.
05Who else handles data
Cloudflare (delivery, DNS and security), an email provider for sign-in and notification emails, and the infrastructure that hosts Luaward. For payments: Stripe (cards and PromptPay) and TrueMoney (gift vouchers). These providers only get what they need to do their job and are bound by their own terms with us. Also: Discord (only if a key page asks you to link it) and the link providers a developer chooses (Linkvertise, Lootlabs, Work.ink).
06How long we keep it
Account data while your account exists. Raw run records for 30 days; after that only daily totals remain, with no address and no device. Beta test data for 90 days. Deleting a script, a workspace or an account removes its data from our live systems, and from backups as they roll over. Key page visits and what happened on them: 90 days (a visit whose key is still valid is kept until the key ends).
07Your rights
Depending on where you live (for example under the GDPR, the UK GDPR, Brazil's LGPD or Thailand's PDPA) you can ask to access, correct, export or delete your data, to restrict or object to some uses, and to complain to your data protection authority. Send a Privacy request through the notice form; we answer within 30 days. Your keys can be exported from the dashboard.
08Children
Luaward is for developers and is not directed at children under 13 (or the higher age your country sets). We do not knowingly collect their data. If you believe a child has an account, tell us through the notice form and we will delete it.
09Security and breaches
Scripts are encrypted at rest, connections use HTTPS, sign-in supports passkeys and two-factor codes, and access is limited. No system is perfectly secure, so tell us at once if you find a problem. If a breach affects you we will tell you and the authorities within the time the law requires.
10International transfers
Luaward is operated from Thailand and data may be processed in the other countries where our providers operate. Where the law asks for it we rely on safeguards such as standard contractual clauses.
11Regional notes
EU and UK: [representative, if required — to be completed before launch]. California: we do not sell or share personal information for advertising. Thailand: you may complain to the Personal Data Protection Committee. Brazil: you may reach our data contact through the notice form.
12Changes
When this policy changes in a way that matters we will tell you before it takes effect, and the date at the top shows the latest version.