Your account
When you sign in with Google, we save your email address, account name and profile picture. When you connect X or a wallet as a sign-in method, we save the X account ID and handle or public wallet address so each connected method can return to the same player profile. We also keep a record of your sign-ins, how many games you finish, your best Lulu score and your longest survival time.
Google and X handle their own sign-in. We do not receive your passwords. Wallet sign-in uses a short-lived ownership signature; we never receive your private key. You can manage connected sign-in methods in Profile.
Certificate sharing and mint access
Your certificate shows your public player name, records, ranks and artwork. Anyone with its link can view it. The link does not include your email or sign-in identifiers.
Connect X to post your certificate. We attach the picture and publish the post you approve. We temporarily store encrypted X authorization data for that post. We do not read direct messages or record video of your games.
For certificate posting, we save your X account, post and image IDs and certificate reference. Public mint checkout requires no account, game completion, or social post. If you use the separate game-linked mint flow, we use your completed games and wallet proof and save verified wallet and purchase records, encrypted in storage. Those purchase records help us check whether a mint went through before you try again. Your certificate post and Solana transactions are public.
Shop visits and spam protection
When you click a shop link, we may record the item, your country, the page you came from and information about your browser. A randomly generated code groups clicks from the same browsing session.
To limit spam, we count repeated requests over short periods. These counts use a scrambled code made from your IP address. The counters do not store the IP address itself.
