Privacy Policy

Effective date: May 31, 2026.
Lowball ("we", "us", "Lowball") operates the website at https://lowball.it ("the Service"). This Privacy Policy explains what information we collect, how we use it, and what choices you have.

1. Information we collect

Information you give us

• Email address — used to send you a magic-link sign-in token and round-result notifications.
• Phone number (optional) — if you choose phone sign-in, your number is sent to our SMS provider (Plivo) to deliver a one-time code.
• Picks — the integer you submit during a round and the timestamp at which you submitted it.

Information we collect automatically

• Log data — IP address, user agent, request path, and timestamp for each API request. Stored in AWS CloudWatch for up to 30 days for security and debugging.
• Cookies and similar technologies — we use a small number of cookies and the browser's localStorage to remember whether you're signed in and to remember your cookie consent choice. See the "Cookies and advertising" section below for the full list, including cookies set by Google AdSense.

2. How we use information

• To create and authenticate your account.
• To run the daily round (compute the lowest unique number, credit tokens, store outcomes).
• To send you sign-in links and round-result notifications.
• To prevent abuse, detect fraud, and keep the Service secure.
• To show advertising via Google AdSense (see below).

We do not use your information for marketing emails. We do not sell your personal information to third parties.

3. Cookies and advertising

Lowball uses cookies and localStorage for two purposes:

3.1 Strictly-necessary storage

• lb_session (localStorage): your signed JWT session token, stored on your device. Cleared when you log out.
• lb_seen_{round_id} (localStorage): a flag so we don't show the same round's result twice.
• lb_cookie_consent (localStorage): remembers your cookie-consent choice.

3.2 Advertising (Google AdSense)

We use Google AdSense to show ads on the Service. Google and its partners use cookies (including the DoubleClick DART cookie and others) to serve ads based on your prior visits to this site or other sites.

• You can opt out of personalized advertising by visiting Google Ad Settings.
• You can also opt out of third-party vendor cookies by visiting aboutads.info or, in the EU, youronlinechoices.eu.
• Google's privacy policy: policies.google.com/technologies/ads.

If you live in the European Economic Area, the United Kingdom, or Switzerland, we (through Google) ask for consent before loading personalized-advertising cookies and you may withdraw that consent at any time using the cookie banner on the Service.

4. Third-party services we use

• Amazon Web Services (AWS) — site hosting, computation, database. AWS privacy.
• Amazon SES — to deliver sign-in and round-result emails.
• Plivo — to deliver phone sign-in codes via SMS. Plivo privacy.
• Google AdSense — to serve advertisements. Google privacy.
• GoDaddy — domain registrar for lowball.it.

5. How long we keep your information

• Account profile (email/phone, token balance): until you ask us to delete it.
• Pick history: until you ask us to delete it.
• One-time codes / magic-link tokens: at most 15 minutes (email) or 5 minutes (SMS) before they expire; deleted automatically.
• Server logs: 30 days.

6. Your rights

If you live in the European Economic Area, the United Kingdom, or Switzerland (GDPR)

You have the right to access, correct, port, restrict, or delete the personal data we hold about you, and to object to its processing. You may also lodge a complaint with your local data protection authority. We act as the data controller for your account information.

If you live in California (CCPA / CPRA)

You have the right to know what personal information we collect, the right to delete it, the right to correct it, and the right not to be discriminated against for exercising these rights. We do not "sell" or "share" your personal information as those terms are defined under the CCPA / CPRA.

How to exercise these rights

Email us at play@lowball.it with the subject "Privacy request" and the address or phone number on your account. We'll respond within 30 days.

7. Children's privacy

The Service is not directed to children under 13, and we do not knowingly collect personal information from anyone under 13. If you believe a child has provided us with personal information, please contact us and we will delete it.

8. Security

We use HTTPS everywhere, store sign-in tokens as HMAC-signed JWTs with a secret held in AWS Secrets Manager, hash one-time SMS codes before storing them, and limit access to production systems. No method of transmission or storage is 100% secure, but we work to protect your data.

9. International transfers

Our servers are located in the United States (AWS us-east-1). If you access the Service from outside the United States, your information will be transferred to and processed in the United States.

10. Changes to this policy

If we make material changes, we'll post the updated policy at this URL and update the effective date at the top. If you have an account, we'll also email you.

11. Contact

Questions or requests? Email play@lowball.it.