Last updated: September 25, 2026
Who we are
This policy explains how [TO CONFIRM: legal entity name] ("Lunex"), the operator of lunex.guru, handles personal data. For the purposes of data-protection law, Lunex is the controller of the data described here. [TO CONFIRM: EU/UK representative and data protection officer, if required.]
Data we collect
- Account dataEmail address, username, password (stored only as a one-way hash), avatar image if you upload one, email-verification and password-reset codes, and — if you enable two-factor authentication — your authenticator secret and hashed recovery codes.
- Sign-in and security dataFor each signed-in session: the IP address and browser user-agent it was created from, and its expiry (up to 30 days). We also record when you were last active on the site.
- Orders and purchasesWhat you bought or sold, prices, quantities, order status and timestamps, and the items delivered to you (license keys and download records).
- Wallet and payment dataDeposit addresses generated for your orders, top-ups and rent payments; the amounts, exchange rates and blockchain transaction IDs of those payments; your balance ledger; and the destination addresses of your withdrawals. We do not collect card or bank details.
- Seller dataSlot name, handle, logo, description, products and files, payout addresses for each coin you accept, slot plan and billing history, and sales records.
- Messages and supportPrivate chat messages and their attachments, messages you post to the public global chat, support tickets and their attachments, reviews you write, and reports you file.
- Slot analyticsWhen anyone views a slot or product page we record the page, a random visitor ID and session ID stored in the browser, the referring page (origin and path only), campaign tags in the link, browser, operating system and device type derived from the user-agent, and the country derived from the connection. The IP address itself is not stored with these records.
- Abuse preventionYour IP address or account ID is used as a key for short-lived rate-limit counters (for example, on sign-in and password reset). The sign-up and sign-in forms run a Cloudflare Turnstile check to tell people from bots.
- Error reportsWhen something breaks, technical error details are sent to our error-monitoring provider. This is configured not to include IP addresses, cookies or request headers.
How we use personal data
- To run your account, process payments, deliver purchases, operate balances, withdrawals and slot billing, and show you your history.
- To keep the platform secure: preventing fraud and abuse, protecting accounts, investigating reports and enforcing our Terms and Prohibited Goods Policy.
- To provide support and send service emails (verification, password reset, order and account notifications).
- To give sellers traffic statistics for their own slot pages. Sellers see aggregated counts (views, visitors, sources, countries, devices), not individual visitor identities.
- To meet legal, accounting and tax obligations.
Legal bases [TO CONFIRM with counsel]: performance of our contract with you (account, orders, balance, billing); legitimate interests (security, fraud prevention, slot analytics, service improvement); legal obligation (financial records); and consent where the law requires it.
We do not sell personal data and we do not use it for third-party advertising.
What other users can see
- Anyone: your username, avatar, public ID, "member since" date, reviews you have written, and — if you sell — your slot, products and ratings.
- A seller you buy from: your username and the details of your order with them. Sellers are not shown your email address.
- People you message: the messages and attachments you send them. Anyone using the global chat can read what you post there until it is deleted after 24 hours.
Public blockchain data
Cryptocurrency transactions are recorded permanently on public blockchains. Anyone can see the amounts and addresses involved in a payment, top-up or withdrawal, and addresses can sometimes be linked to a person. Lunex cannot change or delete blockchain records.
How long we keep data
- Global chat messages: deleted automatically after 24 hours.
- Sign-in sessions: expire after at most 30 days, and end immediately when you sign out or close your account.
- Closed accounts: closing your account disables it and ends all sessions, but the account record (including your email address) is currently kept so that orders, reviews and moderation history remain intact. [TO CONFIRM: whether and when closed-account email and profile data are anonymised or erased.]
- Orders, balance ledger, payments and withdrawals: kept for [TO CONFIRM: period required by accounting/AML law].
- Private messages, support tickets and attachments: kept until [TO CONFIRM: retention period].
- Slot analytics: kept for [TO CONFIRM: retention period].
Your choices and rights
- Update your username, avatar and password, manage two-factor authentication, and sign out other sessions from Settings.
- Close your account from Settings.
- Depending on where you live, you may have the right to access, correct, delete, restrict or object to processing of your data, and to receive a copy of it. To make a request, contact us through Support or email [TO CONFIRM: privacy contact email]. We may need to verify your identity first.
- Some data cannot be deleted where we must keep it by law or it is recorded on a public blockchain.
- You can complain to your local data-protection authority.
Security
Passwords are stored only as hashes, sessions use secure, HTTP-only cookies, traffic is encrypted in transit, private files are served through short-lived links after an access check, and optional two-factor authentication protects accounts. No system is perfectly secure; if we become aware of a breach affecting your data we will notify you as the law requires.
Children, transfers and changes
- Lunex is not intended for anyone under [TO CONFIRM: 18]. We do not knowingly collect data from children.
- Our providers may process data outside your country. [TO CONFIRM with counsel: transfer mechanism, e.g. Standard Contractual Clauses.]
- We will post changes to this policy on this page. Cookies and similar browser storage are described in the Cookie Policy.