LootCubePrivacy Policy
LootCube (the website and mobile app, collectively "the service") values your privacy and handles personal information as described below.
Data DeletionInformation We Collect
The website uses Google Analytics to process page visits, session duration, and browser information. The mobile app uses Firebase Analytics to process app instance identifiers, device and app information, screen views and engagement time, search result counts, and use of filters, calculators, Chronicles, and notifications. Analytics events do not include search text, email addresses, nicknames, account IDs, or push tokens. You can turn this collection off under Settings → Data protection → Usage analytics. Google AdMob may process IP addresses, advertising and app set IDs, app interactions, and diagnostics for ad delivery, measurement, and fraud prevention. Firebase Cloud Messaging processes the app version, installation identifier, and push token.
Account & Login
If you choose Google sign-in, the unique account ID, email address, profile name, and profile image supplied by Google are stored in the Supabase authentication account and used for authentication, account management, and cross-device sync. LootCube never collects or stores your Google password. Sign-in is optional and most features work without an account.
Cloud Sync
For signed-in users, data such as filter settings, favorites, and rune inventory is automatically saved to the cloud for cross-device access. This data is accessible only by the account owner.
Scan error reports
Scan recognition runs in your browser. Submitting an error report saves your message, recognized text, matched options, recognizer version and browser information. Images you choose to attach are stored privately and used to reproduce errors, evaluate accuracy and improve recognition.
Local Storage
Filter settings, favorites, rune inventory, and other user data are stored in your browser or mobile app storage. Selected data is synchronized with the cloud when signed in. Mobile push notifications register an installation identifier, push token, notification settings, and favorite Terror Zones with the server without requiring sign-in. The device authentication key is kept in secure device storage; the server stores only its hash.
Third-Party Services
The service uses Google Analytics and Firebase Analytics (website and app usage analysis), Google OAuth (login authentication), Google AdMob (mobile advertising and advertising identifier processing), Firebase Cloud Messaging (push notifications and device tokens), Cloudflare (network infrastructure), and Supabase (authentication and data synchronization). Please refer to each provider's privacy policy for details.
Data Deletion
After signing in, you can delete your account from the web profile menu or the mobile app account settings. The authentication account, email and profile information, cloud sync data, and account-linked push notification data are permanently deleted. Publicly shared filters may remain after their account association is removed. Notifications registered without sign-in are separate from the account and can be turned off in app settings. Local data remains until browser or app data is cleared or the app is uninstalled.
Contact
For privacy or account deletion inquiries, contact [email protected].
Last updated: October 8, 2026