Privacy Policy

The short version

TrendLotto is free to use without an account, and we collect as little as we can get away with.

• We collect your account details if you register: username, email address, and a password we store only as a hash.
• We collect what you create: saved tickets, saved numbers, generated picks and reports, and your forum posts.
• We collect limited technical data — IP address and browser user-agent — to prevent abuse and diagnose problems.
• We do not sell or rent your personal data, we do not run advertising, and we do not embed third-party analytics or tracking pixels.
• You can change most of your data yourself, and you can ask us to delete your account at any time.

The rest of this page is the detail behind those five lines. Where something is a choice rather than a necessity, we say so.

Who is responsible for your data

TrendLotto ("we", "us") operates this website and decides how the personal data described below is used. In data-protection terms, we are the controller of that data.

For any request or question about privacy, write to contact@trendlotto.com, the address also published on the contact page. If you need our registered legal details in order to serve a formal notice, ask from that address and we will provide them.

This policy covers this website. The community forum at forum.trendlotto.com is part of the same service and is described in its own section below.

What we collect

Data you give us

Your password is hashed with bcrypt before it is stored. We never keep the plaintext, we cannot read it back, and no member of the team can tell you what it is. If you lose it, the only route is to reset it.

Data we collect automatically

• Registration metadata — the IP address and browser user-agent recorded when an account is created. This exists to catch bulk account creation and ban evasion.
• Login activity — when an account last signed in, and session records used to invalidate tokens when you change your password.
• Server logs — IP address, timestamp, requested path and user-agent for requests to our servers, kept on a rolling basis for security and debugging.
• Rate-limiting counters — we count login and registration attempts per IP address so that automated guessing can be blocked. This processing is short-lived.
• Administrative audit records — when a member of the team performs an administrative action, we log what was done, by which admin username, from which IP address, and the outcome. The admin username is stored separately from the account so that the record stays traceable after an account is closed.

What we deliberately do not collect

• No payment data. The service is free and no payment is processed through this site, so we never receive card or bank details.
• No advertising or analytics identifiers. There is no Google Analytics, no advertising network, no tracking pixel and no cross-site tracking on this site.
• No precise location, contacts, or device files. We do not request access to your location, address book, camera or photo library.

Cookies and local storage

We use a small number of storage entries and no advertising cookies at all. Here is the complete list.

The first three exist only to keep you signed in; signing out removes them. Because we set no advertising or analytics cookies, there is nothing for a consent banner to ask you about, which is why you will not see one. If that ever changes we will add a proper banner and update this page first.

The forum is a separate application and sets its own session cookies when you use it. Those are described by the forum itself.

Why we use it, and on what basis

We do not use your data for automated decision-making that produces legal effects about you, and we do not profile you for advertising.

Who else sees your data

We do not sell or rent your personal data, and we do not share it for advertising. It is disclosed only in the following situations.

• Service providers. We use a hosting provider to run the servers and databases, and a transactional email provider to deliver password-reset and verification messages. They process data on our instructions and only to provide that infrastructure.
• The community forum. The forum at forum.trendlotto.com is part of this service, and it runs as a separate application. When you open it while signed in, we pass it your username, email address, display name and avatar URL so it can match or create your forum account instead of asking you to register twice. Anything you post there is public.
• Legal requirements. We may disclose data if we are legally required to, or if it is necessary to establish, exercise or defend a legal claim. Unless we are prohibited from doing so, we will tell you.
• A change of ownership. If the service were ever transferred to another operator, the data described here would transfer with it, and this policy would continue to apply to it until you were told otherwise.

The draw results, prize breakdowns and other lottery data we publish come from public official sources. They contain no information about you.

Where your data is kept

Our servers are hosted on infrastructure that may be located outside the country you live in, including in the United States. That means your data may be transferred to and stored in a jurisdiction whose laws differ from your own.

Where we transfer data internationally, we rely on the safeguards that our providers put in place for that purpose. If you would like more detail about where a particular piece of data is held, write to us and we will explain what we can.

How long we keep it

• Account and profile data — for as long as your account exists. If you ask us to delete your account, we remove the account and the content tied to it.
• Saved tickets, numbers, picks and reports — until you delete them or your account is closed.
• Password-reset tokens — stored only as a SHA-256 hash, valid for 30 minutes, and invalidated as soon as they are used.
• Email-change verification codes — a short-lived six-digit code that stops working once it has been used.
• Server logs — kept on a rolling basis and overwritten as they age, rather than archived indefinitely.
• Administrative audit records — retained so that administrative actions remain traceable. These reference the admin's username, which is stored separately for exactly this reason, and do not contain data about ordinary users beyond an account identifier.

Where we keep something longer because a legal obligation requires it, we keep only what that obligation requires.

Your rights and how to use them

Depending on where you live, you may have some or all of the following rights over your personal data:

• Access — be told what we hold about you and get a copy of it.
• Correction — have inaccurate data put right.
• Deletion — have your data erased, subject to any legal obligation to keep it.
• Portability — receive the data you provided in a usable, machine-readable form.
• Restriction and objection — ask us to limit or stop certain processing, including processing based on our legitimate interests.
• Withdraw consent — turn off the newsletter or win notifications whenever you like, without affecting anything else.
• Complain — lodge a complaint with the data-protection authority in your country. We would appreciate the chance to fix the problem first.

Things you can change yourself, right now

• Display name, bio and avatar — on your profile page.
• Email address — also on your profile page. We confirm the change with a six-digit code sent to the new address, so a typo cannot lock you out.
• Password — on your security page. Changing it invalidates other sessions.
• Newsletter and win notifications — via the toggles in your account settings.

Things to ask us for

For an export or the deletion of your account, email contact@trendlotto.com from the address on the account, so we can be sure the request is really yours. We aim to respond within 30 days. There is no charge unless a request is clearly excessive or repeated.

If you want to stop receiving email from us entirely, note that password-reset and email-change messages are part of the account and cannot be switched off — but we will not send you anything else unless you asked for it.

Children

This site is about lottery games and is intended for adults who are of legal age to play in their jurisdiction. It is not directed at children, and we do not knowingly collect personal data from anyone under 18.

If you believe a child has created an account, write to contact@trendlotto.com and we will delete the account and the data attached to it.

How we protect it

The measures below are the ones actually in place, not a wish list:

• Traffic to the site is encrypted in transit with TLS.
• Passwords are hashed with bcrypt. Plaintext passwords are never stored and cannot be recovered by us.
• Sessions use short-lived access tokens (about 30 minutes) with a separate refresh token, rather than one long-lived credential.
• Sign-in and registration are rate-limited per IP address to slow down automated guessing.
• Changing your password invalidates sessions issued before the change, so a stolen session stops working.
• The authentication cookie is HttpOnly and Secure, so scripts on the page cannot read it and it is not sent over plain HTTP.
• Administrative access is role-based and every administrative action is written to an audit log.
• Password-reset tokens are stored as one-way hashes, are single-use, and expire in 30 minutes.
• Database and configuration backups are taken so the service can be restored after a failure.

No system is perfect, and we will not pretend otherwise. If you think you have found a security problem, please tell us at contact@trendlotto.com before telling anyone else, and give us a reasonable chance to fix it.

Changes to this policy

If we change how we handle personal data, we will update this page and the "last updated" date at the top. If the change is significant — for example, if we ever introduce payments or advertising — we will say so on the site rather than quietly editing the text, and where the law requires it we will ask for your consent before the change applies to you.

Continuing to use the site after a change means you accept the updated policy. If you do not, you can ask us to delete your account.