Privacy

MiningLucky is a service by BTC PoW Lab. Privacy requests: contact@btcpowlab.com. Updated 24 September 2026.

Information used to provide the service

We use your email for account access and service messages; your reward address, selected network, orders and payment status to fulfil purchases; and mining telemetry to measure service delivery. We do not ask for seed phrases or private keys.

Storage and providers

Vercel hosts the website, Neon stores application records, and Resend delivers service email from BTC PoW Lab. Payment and hashpower providers receive the information necessary to process payments and deliver mining work. Blockchain reward addresses and transactions are public by the nature of the selected network.

Cookies and local storage

An essential secure session cookie keeps you signed in. Local storage remembers your language preference, rack configuration and demonstration sessions. The demo runs in your browser and is clearly identified. The live online indicator uses an anonymous random browser identifier rotated daily; it expires from the active count after two minutes and is not connected to your email, wallet or orders. Optional Google Analytics starts only after you accept it and measures public pages and the demo without wallet addresses, email or account identifiers. You can change your analytics choice in Privacy settings. We do not enable advertising personalization.

Account alerts

You can choose email alert categories and optionally enable push notifications for this browser. We store preferences, alert history, sending status and the browser push subscription. Your browser provider processes push delivery. Disable a channel in Account settings > Alerts; signing out removes the subscription from this browser. Account history remains available when delivery channels are disabled.

Retention and requests

Email access codes expire after ten minutes. Sessions last up to twelve hours, or up to thirty days if you choose to remember this device. Order, delivery and payment records are retained as needed to provide the service, resolve disputes and meet applicable obligations. You may request access, correction or deletion by email; records required for legal or accounting purposes may need to be retained.

Security

Private orders require authenticated access. Login codes are stored as keyed hashes, session tokens as hashes, and provider credentials remain server-side. Optional two-factor authentication stores the authenticator secret encrypted and recovery codes as keyed hashes. Authentication challenges expire after five minutes. We record security changes and successful second-factor access for account protection. Do not include wallet or authenticator secrets in support messages.