Crumbs, not
surveillance.

A cookie is a small text file your browser stores when you visit a site. The site can read its own cookies on subsequent visits. We also use a couple of related technologies — local storage and session storage — and we lump them all together as "cookies" in this document for clarity.

The complete list. If we add a cookie, we update this section, bump the version above, and ask for consent again where required.

Strictly necessary — always on

lk_session

Authentication token. Expires when you log out or after 30 days of inactivity.

lk_csrf

Cross-site request forgery defense. Session-only, cleared on tab close.

lk_consent

Your cookie preferences. 12 months. Always required to remember 'no thanks.'

Optional — off until you opt in

lk_locale

Preferred language / currency on the marketplace. 12 months. Saves you a click.

lk_seen

Listings you've viewed, used to power 'recently browsed.' 30 days.

lk_metric

Anonymous analytics ID (Plausible-style). No fingerprinting, no cross-site tracking.

Advertising — off until you opt in

These cookies are set by third-party advertising platforms when you accept the advertising category at the consent banner. They are not loaded at all if you decline.

_fbp

Meta Pixel browser ID. Used by Facebook/Instagram to measure ad conversions and build retargeting audiences. Set by Meta, governed by Meta's Data Policy. Up to 90 days.

_fbc

Meta click ID, stored when you arrive via a Facebook ad. Ties your visit to a specific ad click for attribution. Up to 90 days.

_gcl_au

Google Ads conversion linker. Measures whether a Google ad click led to an action on Luckiest (e.g. submitting an offer). Set by Google, governed by Google's Privacy Policy. 90 days.

We use Meta Pixel and Google Ads remarketing to run retargeting campaigns — showing ads on Facebook, Instagram, and Google to people who have visited Luckiest. These tools set the advertising cookies listed in section 02 above. They are loaded only if you accept the advertising category at the consent banner; if you decline or ignore the banner, these scripts do not run.

Three operational third-party cookies are always present regardless of your advertising choice: Stripe sets cookies during checkout to prevent payment fraud, and Cloudflare may set a security cookie (__cf_bm) to distinguish browsers from bots. Both are scoped to specific actions and lifetimes and covered by their providers' policies, linked in our subprocessor list.

Your opt-out rights

California residents (CCPA) may opt out of the sale or sharing of personal information for advertising at any time using the cookie preferences panel in the footer. EEA and UK residents (GDPR / UK GDPR) must opt in before advertising cookies are set — consent is never assumed. You may also opt out directly at Meta Ad Preferences and Google Ad Settings.

You have three layers of control. Each one is stronger than the last; all three are honored.

Banner

On first visit, you can accept all, reject all, or pick by category. Stored for 12 months.

Footer

A 'Cookie preferences' link in the footer reopens the same dialog at any time.

Browser

Browser-level blocking. We respect Global Privacy Control automatically.

Do Not Track & Global Privacy Control

We honor the Global Privacy Control (GPC) signal as a binding opt-out of optional cookies. Browsers that send a Do Not Track header are treated identically. You don't need to do anything else.

If we add or change a cookie, we update this page and re-prompt for consent on the affected categories. Material changes are also announced by email to active accounts.