Privacy Policy

Last updated: 1 May 2026  ·  Effective: 1 May 2026

Save My Seat ("we", "us", "our") is operated by Lucky Dragon Pty Ltd (ABN pending), based in Victoria, Australia. This policy explains how we handle your personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).

1. What we collect

• Email address — when you sign in, we collect and store your email address to create and maintain your account.
• Display name — optional name you enter, shown to people viewing the same seat.
• Seat hold data — which seat you hold, when you held it, and when it expires.
• Usage data — Cloudflare Workers automatically log request metadata (IP address, timestamp, user agent) for security and performance. These logs are retained for up to 30 days.

2. How we use it

• To authenticate you (sending a one-time code to your email).
• To display your seat hold status to other users watching the same seat in real time.
• To send transactional emails (login codes only — we do not send marketing email).

3. Who we share it with

We do not sell or share your personal information with third parties for marketing. We use the following sub-processors to operate the service:

• Supabase Inc. (USA) — database and authentication. Data is stored on servers in the AWS ap-southeast-2 (Sydney) region where possible. Supabase Privacy Policy.
• Cloudflare Inc. (USA) — hosting and edge delivery. Cloudflare Privacy Policy.
• Resend Inc. (USA) — transactional email delivery. Resend Privacy Policy.

4. Data retention

• Seat holds are automatically deleted when they expire (3 hours after creation).
• Your account (email + name) is retained until you request deletion.
• You can request deletion of your account at any time by emailing privacy@luckdragon.io.

5. Your rights

Under the Australian Privacy Act, you have the right to:

• Access the personal information we hold about you.
• Correct inaccurate information.
• Request deletion of your account and associated data.
• Complain to the Office of the Australian Information Commissioner (OAIC) if you believe we have breached your privacy.

6. Security

We use industry-standard security measures including TLS encryption in transit, row-level security in the database, and one-time codes for authentication (no passwords stored). We will notify affected users within 30 days of becoming aware of any data breach that is likely to result in serious harm.

7. Cookies and local storage

We use browser localStorage to store your session token and app preferences (e.g. whether you have seen the intro screen). We do not use tracking cookies or third-party advertising cookies.

8. Children

Save My Seat is not directed at children under 13. We do not knowingly collect personal information from children.

9. Changes to this policy

We may update this policy from time to time. Continued use of the service after changes are posted constitutes acceptance of the revised policy.

10. Contact

For privacy enquiries: privacy@luckdragon.io
Lucky Dragon Pty Ltd, Victoria, Australia