Privacy policy

Last updated: November 2, 2026

Who we are

Captain Lotto is published by Keowee Digital, LLC, 606 Fieldgate Ct, Mauldin, SC 29662, United States.

Contact: support@captainlotto.com

What stays on your device

The following never leaves your device unless you take one of the actions described later in this policy:

• Scanned tickets, including the numbers you played and the ticket images
• Your play and win history
• Numbers you generate or save in the Pick tab
• App settings, including your jurisdiction and home screen layout
• Whether you have unlocked paid features, except the Captain plan, which our server checks when you run a pool (see Purchases)

Checking your numbers against a drawing happens locally. The app can tell you whether you won without ever reporting what you played.

What we request from our servers

The app fetches current and historical drawing results over HTTPS. These are ordinary requests for public lottery data. They do not include your tickets, your numbers, or any identifier for you or your device.

As with any internet request, our hosting provider (Google Cloud) processes the originating IP address in order to deliver the response. We do not use it to build a profile and do not retain it in our own records.

Ticket scanning

Scanning runs entirely on your device. The camera feed and the text recognition that reads your ticket are processed locally, and the recognition model ships inside the app rather than calling a service.

Optional: helping improve scanning

You can opt in, in the app's Help section, to share scans that you corrected. This is off by default. When it is on, and only when you have actually corrected something the app misread, we receive:

• An image of the ticket, with the barcode region and any serial number redacted before it leaves your device
• The raw text the scanner read, the plays it extracted, and any drawing dates
• The specific corrections you made
• The game and jurisdiction

We do not receive your name, an account, a device identifier, your location, or the barcode payload. Location metadata (EXIF) is stripped from the image.

How shared scans are used. Improving the scanner is assisted by AI: each shared image is analysed once by Google's Gemini model, run through Google Cloud's Vertex AI, which compares the ticket against what our scanner read and suggests where its reading rules fall short. We use those findings to improve the rules the scanner follows in future updates. Shared images are not used to train any AI model, ours or Google's: under Google Cloud's terms, Google does not use this data to train its models, and we do not train models at all.

Retention. A shared image is deleted as soon as it has been used to improve scanning, and in no case is it kept longer than 30 days. What we keep afterward is the anonymous correction statistics — that a particular kind of misread happened in a particular jurisdiction — which is what actually makes scanning better. Those statistics contain no image and nothing identifying you.

Pools

Pools let a group play together: a captain buys the tickets, the crew chip in, and the app keeps the record of who is in and what they are owed. For that record to be the same on everyone's phone, it has to live on our server, so pools are the one place where Captain Lotto has accounts.

Your pool account

When you first start or join a pool, you sign in: with Apple on iPhone, with Google on Android. On iPhone we ask Apple for no name and no email address; Apple gives us an anonymous identifier. On Android, Google always shares the name, email address and profile picture of the Google account you choose (Google's sign-in offers no way to ask for less), and our sign-in provider keeps them on your account. We use only the email address, to know which account is yours, for example when you ask us to delete it from the web; the name and picture are not used at all. None of them is shown to your crew or used to contact you. Either way, an account identifier is how our server knows which pool entries are yours. Our sign-in provider (Google Firebase) also records when the account was created and when you last signed in.

What our server keeps, and why

For each pool, our server keeps the pool's ledger: who is in it (by their anonymous account identifier), how many shares each person asked for and at what price, who has said they paid and whether the captain confirmed it, the draws and their deadlines, any prize the captain records when a draw settles, the pool's rules as numbers (share limits, deadlines, small-prize rules), and the date and time each member agreed to each version of the pool agreement. It also keeps the colour you picked for your crew avatar and the list of pools you belong to. If you have a Captain plan, it keeps a record of it on your account (see Purchases).

We keep these because a shared pool needs a record that no single phone can quietly change. Keeping it on our server is what lets the whole crew see the same thing on their own phones; stops anyone confirming their own payment or rewriting the ledger after a win; applies share limits and deadlines by one clock for everyone; keeps a timestamped record of who agreed to which rules; keeps your place in a pool if you reinstall the app; and makes it stick when a captain removes someone.

What our server cannot read

Everything a person writes in a pool is encrypted on your phone with the pool's key before it is sent: the pool's name, payment handles and payment notes, the agreement text, the name you go by in the pool, the names a captain enters for people who paid cash, and your legal name. The key travels only inside the invite link and never reaches our servers, so we store these as unreadable data. Your legal name is handed only to your pool's captain, who needs it to set up a trust if the pool wins a large prize; other members of the crew don't receive it.

Reporting and blocking

If something in a pool is abusive, you can Report it from the pool's menu. A report is the one time pool text reaches us readable, and only because you send it: your phone sends the part you chose to report (the pool's name, the name someone goes by in the pool, or the agreement), any note you add, which pool it is and your pool account, over an encrypted connection. The app shows you all of it before it goes. We use a report only to review it and act on it, and delete it after 90 days, or sooner if you clear your data or delete your account.

Leave and block takes you out of a pool and stops you joining its captain's pools again. The list of captains you've blocked is kept only on your phone.

Pool tickets

When a captain shares pool tickets, the images and the numbers on them are encrypted on the captain's device before upload and can only be read by members holding the pool's key. An image is a photo of a paper ticket, a courier service's scan, or, for a ticket bought online, a screenshot if the captain adds one. That key travels inside the invite link and never reaches our servers, so we cannot read pool tickets. Encrypted pool images are automatically deleted 24 hours after the drawing. The encrypted numbers stay with the pool as the record of each draw until the pool is deleted. So does a fingerprint of each ticket's barcode, or of its order number for a ticket bought online or through a courier, made with the pool's key so that we cannot work out the barcode or order number from it. The order number itself stays on the captain's phone. We keep the fingerprint so the same ticket can't be added to a pool twice.

Captain Lotto never handles money. The app records who owes what so a group can keep an honest ledger, but it does not collect, hold, or transfer funds. If a captain provides a payment handle, the app builds a link that opens your payment app of choice. Anything that happens there is between you and that service, under their terms and privacy policy, not ours.

Because the invite link contains the pool's key, treat it like a password. Share it only with people you intend to admit to the pool.

Leaving, clearing and deleting

• Leave a pool from the pool's screen. Your unpaid places in open draws go.
• Settings → Your Data → Clear all user data erases everything on your phone and takes you out of every pool on our server. Pools you captain close for their crew. Your account itself stays, so you can join pools again later, and so does its Captain plan record, as your purchases do.
• Settings → Your Data → Delete pool account does all of that and deletes your account (with the name, email address and picture, if you signed in with Google) and its Captain plan record, which frees the purchase to be used with a new account. On iPhone it also revokes Captain Lotto's access to your Apple Account.
• Without the app, see captainlotto.com/delete-account for how to delete your account or ask us to.

In each case, a share you already paid for in a draw stays in that draw's ledger with your name removed and shown as "Former member", so the crew's split still adds up. Nothing else about you is kept.

When a captain closes a pool, our server deletes it, ledger and all, 30 days later. If a prize the captain recorded in that pool reached the pool's trust threshold — the size of win its agreement says calls for a trust — we keep it for 180 days instead, so the crew still has the record while a large prize is being claimed.

Purchases

Paid features are sold through the App Store and Google Play. Those stores handle the transaction and tell the app whether a purchase succeeded. We never receive your payment details. Apple's and Google's own privacy policies govern what they collect when you buy something.

If you redeem a support code, the app checks it against our server. Codes are not tied to your identity, except as described for the Captain plan below.

The Captain plan

Running a pool as its captain takes the Captain plan, and because a pool is shared, our server has to know the plan is in force. So while you are signed in to pools, the app sends our server the proof of your Captain plan that the store gave your phone: Apple's signed record of the purchase, Google Play's purchase token, or the support code that granted it. We check Apple's record ourselves, and ask Google Play whether a Play token is valid.

We keep, on your pool account, which store the plan came from, which plan it is, when it ends, and a fingerprint of the purchase (or of the support code; the code itself is not kept). We keep these so that one purchase serves one account, and so that a captain whose plan has lapsed can finish the current draw but not open new ones. When that happens, your crew see that the pool is paused because the captain's plan has ended. This record contains no payment details. It is deleted with your pool account (see "Leaving, clearing and deleting").

What we do not do

• No analytics or tracking SDKs
• No advertising, and no sale or sharing of personal information
• No accounts or logins anywhere except pools, which are optional
• No location collection
• No selling, renting, or trading of any data to anyone

Children

Captain Lotto is intended for adults of legal lottery-playing age in their jurisdiction. It is not directed at children, and we do not knowingly collect information from anyone under 18.

Your choices and rights

Most of your data never leaves your device, so it is under your direct control: deleting the app removes everything stored there. Deleting the app does not remove your pool account or your place in your pools — use Settings → Your Data in the app (see "Leaving, clearing and deleting" above) or contact us.

For anything you shared through the scanning program, contact us at the address above and we will delete it on request. Shared scans carry no identifier linking them to you, so please include enough detail — such as the approximate date and jurisdiction — for us to locate them.

Captain Lotto covers Powerball and Mega Millions, which are United States games, and the app is distributed only in the United States and its territories. If you are a California resident, the CCPA gives you the right to know what personal information we collect, to request its deletion, and not to be discriminated against for exercising those rights. We do not sell or share personal information as those terms are defined by the CCPA, so there is nothing to opt out of. We extend these same rights to everyone who uses the app.

If the business changes hands

If Keowee Digital, LLC is sold, merged, or otherwise transfers ownership of Captain Lotto, information covered by this policy may transfer with it. Any acquirer would remain bound by the commitments made here for information collected before the transfer, and we would note the change in the app before it takes effect. This does not apply to anything stored only on your device, which was never ours to transfer.

Changes

If this policy changes materially, we will update the date above and note the change in the app. Continuing to use Captain Lotto after a change means you accept the updated policy.

Contact

support@captainlotto.com Keowee Digital, LLC, 606 Fieldgate Ct, Mauldin, SC 29662, United States