Privacy policy

1. Who we are

Lucky Surge Hub is the website at luckysurgehub.com. It is entertainment only. We do not offer real-money gambling, we do not offer prizes, and you cannot redeem virtual credits for cash.

This policy does not give a street address, a company number, or a licence number. Privacy requests go to [email protected]. For the UK GDPR and the Data Protection Act 2018, write to that email if you have a question about personal data in a message you sent us. The play counter itself stays on your device.

2. Information we collect

The site keeps a few items in localStorage on this browser, and only those items:

• Age confirmation (lsh-age). The value 18 after you confirm that you are 18 or older.
• Cookie choice (lsh-consent). Whether you chose Accept or Reject optional.
• Virtual credit balance (lsh-credits). The play counter. It has no cash value and it stays in this browser only.
• Break timer (lsh-pause). The end time of a break you choose to set on this browser.
• Sound preference (lsh-sound). On or off, and only if you accept optional storage.
• Recent wheel results (lsh-wheel-log). Up to 14 pocket numbers, only if you accept optional storage.
• Repeat stack (lsh-wheel-again). The last set of wheel markers, only if you accept optional storage.

We do not ask for your name, email address, phone number, or payment details in order to play. There is no contact form on the site.

We do not collect an account ID, a password, card numbers, a precise location, health data, or biometrics. We do not build a profile of you. We do not run analytics, and we do not place advertising tags.

If you email [email protected], [email protected], or [email protected], we receive the address you write from and whatever you put in that message. Please do not send identity documents or payment-card numbers. We do not need them, and the site never asks for them.

The pages are static. If the hosting provider sees ordinary connection logs, such as an IP address, the date and time of a request, and the address of the page requested, those logs are held by the host. They are not a member database we operate, and we do not use them as one.

3. How we use information

We use the items in this browser for these purposes only:

• to remember that you confirmed you are 18 or older;
• to remember the virtual credit counter;
• to remember a break you set, so the rooms stay closed until it ends;
• if you accepted optional storage, to remember sound, recent wheel results, and a repeat stack;
• to keep the pages operating as the entertainment you asked for, including ordinary security of those pages;
• to read and reply if you email us.

There is no promotional email programme, because we do not collect email addresses on the site. There is no A/B testing programme and no purchase processing. A result in a room is calculated in your browser. It is not sent to us as a record of play.

4. How we share

We do not sell personal information. We do not share it for cross-context behavioural advertising, and we do not share it with advertising networks. The virtual credit balance is not transmitted to us as part of ordinary play.

Hosting is the only processor of ordinary server logs of the kind described above. We do not appoint an analytics provider or an advertising provider.

We may disclose information if the law requires it, for example a valid request that obliges a disclosure about an email you sent us. We do not volunteer the contents of your browser storage, because we do not hold that storage.

If the site is transferred to someone else, we would update this policy first, before any such change takes effect. This policy does not describe a sale of a company, because it does not name one.

5. Cookies and localStorage

The site uses localStorage keys rather than advertising cookies. The names, whether each key is strictly necessary or optional, and how Accept, Reject optional, and Cookie choice work are set out in the Cookie Policy. That policy is part of how you should read this one.

6. Security

The pages are served over HTTPS in transit, where your browser and the host support it. There is no password database, because there are no passwords. There is no member database for us to encrypt at rest.

A static site has limits. Anyone who can use your device and its browser tools can read the localStorage keys. Use a device you trust. No method of storage removes every risk. Clearing site data removes the keys from that browser.

7. Children

The site is for people aged 18 and over. We do not knowingly collect information from anyone under 18. The age question is there to turn under-18s away.

If you believe a person under 18 used the site, they can clear the browser storage for luckysurgehub.com, which removes the keys on that device. Please also email [email protected] and tell us what you can. We will not ask you to send a child’s identity documents.

8. Retention

localStorage stays on the device until you clear site data for this site, until you reject optional storage (which removes the optional keys), or until a break timer is ended or expires and the page removes that key. We do not keep a server copy of those keys, so we cannot delete them for you from a database. The practical control is in your browser.

Support emails, if someone writes to us, are kept only as long as needed to handle the request and any legal need to keep a record of the correspondence. We do not add those messages to a mailing list.

How long a hosting provider keeps ordinary connection logs is set by that provider. Those logs are not a player history we maintain.

9. Your choices and UK GDPR rights

Where the UK GDPR applies to personal data in an email you send us, or to any personal data we actually hold, you can ask us to:

• Be informed about what we hold and why, which this policy sets out;
• Access the personal data we hold about you;
• Rectify personal data that is inaccurate;
• Erase personal data, where a ground for erasure applies;
• Restrict processing in the cases the law allows;
• Object to processing based on legitimate interests;
• Port personal data you provided, where the right applies, in a structured, commonly used, machine-readable form;
• Withdraw consent where processing is based on consent. Withdrawal does not affect the lawfulness of processing before you withdrew it;
• Not be subject to a decision based solely on automated processing that produces a legal or similarly significant effect. The rooms do not make that kind of decision. A round result is a browser calculation about a play counter, not a decision about you.

How to ask: email [email protected]. Say which right you are using and, if you emailed us before, enough detail for us to find that correspondence. We respond within one month. If a request is complex, the law allows more time, and if we need it we will tell you within the first month. We do not discriminate against you for asking. There is nothing to buy on this site, so a request does not change a price, a credit pack, or a membership tier. Those things do not exist here.

The play counter, the age confirmation, the cookie choice, the sound preference, the wheel memory, and the break timer are on your device. You can access them, clear them, or change them in the browser’s site-data settings without waiting for us. We cannot export a balance we never received. Cookie choice in the footer lets you refuse optional storage again.

10. UK GDPR and the Data Protection Act 2018

This site is directed at the United Kingdom. The privacy regime that applies to personal data we handle is the UK General Data Protection Regulation and the Data Protection Act 2018. This section is the fuller account of that regime for the data this site actually touches.

Lawful bases

Consent. Optional preferences rely on consent. That is the sound preference, the recent wheel results, and the repeat stack. They are written only after you choose Accept, and only when the browser is not sending a Do Not Track signal that our pages treat as a refusal of optional storage. You can withdraw that consent with Reject optional, with Cookie choice, or by clearing site data. The record of the choice itself (lsh-consent) is kept so the choice bar does not reappear on every page and so the site knows whether optional storage is allowed.

Legitimate interests. Operating and securing the site is a legitimate interest. That interest covers remembering, on your device, that the age question was answered, keeping the play counter so the free entertainment you asked for can continue in that browser, remembering a break you started, and serving the pages over the host’s ordinary security controls. The interest is limited to running this free site. It is not an interest in marketing, in selling data, or in measuring an advertising audience. You can object by emailing [email protected] and by clearing the data on your device. Because we do not hold a server copy of the counter, clearing the browser is the step that removes it.

We do not rely on a contractual necessity to process payment data, because there is no contract to buy anything and no payment to process. We do not rely on a legal obligation to keep an identity file, because we do not collect one.

The data we actually hold

On the device, the data is the localStorage keys named in this policy and in the Cookie Policy. In our correspondence, the data is the content of emails sent to the contact addresses on this site, including the sending address and any detail you choose to include. In the host’s systems, the data may include ordinary connection logs such as IP address and request time. We do not combine those sources into a player profile.

No sale and no advertising share

We do not sell personal information. We do not share personal information for cross-context behavioural advertising. There is no advertising partner on these pages. A link to GambleAware, GamCare, GamStop, Samaritans, or the Information Commissioner’s Office leaves this site only when you choose to follow it. Following a link is a visit to that other site under its own policy.

How to complain

Contact us first at [email protected] and give us a chance to put the matter right. If you remain unhappy, you can complain to the Information Commissioner’s Office, the UK regulator for this regime. The ICO website is https://ico.org.uk/. The ICO helpline is 0303 123 1113. The ICO is not Lucky Surge Hub. You may complain to the ICO whether or not you write to us first, and we still ask that you contact us first so we can respond.

11. International users

The site is directed at the United Kingdom. Data entered in the browser stays on the device. It is not uploaded to a membership system in another country as part of play. Emails sent to our contact addresses are handled for that correspondence. We do not claim a headquarters in another country, and this policy does not name one.

If you write to us from outside the United Kingdom, we still handle that email only to answer it. Your browser storage remains under your control on your device.

12. Changes

We may update this policy by posting a new version on this page and changing the date. Last updated: 21 October 2026. The new version applies from the date it is posted. If a change would affect optional storage, the cookie choice bar can be opened again from Cookie choice in the footer.

13. Contact

Privacy requests go to [email protected]. Do not send them to a postal address. This policy does not name a data-controller company or a street address. We aim to reply to privacy requests within one month, as section 9 describes.