Last updated: 31 October 2026.
Who provides Lucky Live
Lucky Live is provided by Lau Ho Fu, under the individual brand LuckyLiveLab.
Contact: Luckylivelab@gmail.com
Address: Flat O, Block 3, Kaiser Estate, 11 Hok Yuen Street, Hung Hom, Kowloon, Hong Kong.
Information we process
To connect the app, we process store identifiers and verified domains, Shopify authorization credentials and installation information. To provide live activity, session replays, traffic analysis and funnels, we process visitor and visit identifiers, timestamps, page paths, referral and UTM information, device dimensions and interactions.
Supported storefront replays collect page structure, public page text, image and style references, clicks and scrolling. Inputs and designated private regions are masked; checkout, account pages and unsupported embedded content are not recorded. Storefront text and URLs may nevertheless contain personal information. Pseudonymous visit identifiers do not make all recording content anonymous.
The checkout event collector sends event types, timestamps and visitor/visit identifiers. Its event payload does not include customer names, email, addresses, payment details, order contents or prices. We also process preferences, campaign labels, exclusion settings, usage counts, private viewing authorizations and information you choose to include in support correspondence.
Shopify privacy notifications may include customer ID/email and request identifiers. The app stores a limited receipt rather than the full notification body, phone numbers or order arrays. Pending processing may retain selected visitor identifiers to support scoped export or erasure. Completed receipts remove customer ID/email and selected visitor identifiers and are scheduled for removal after 30 days.
Why we process it
We use this information to provide app features, authenticate and restrict access, meter recording usage, maintain the service, and handle support and privacy requests. Storefront tracking and checkout pixel collection are gated by analytics permission. Merchants must configure appropriate store notices and consent controls. Visitors can decline or withdraw analytics permission through those controls.
Browser storage
After analytics permission, storefront localStorage holds a pseudonymous visitor identifier without an application-set expiry. Withdrawal removes it. Session storage holds visit, summary/resumption, attribution and cart baseline information for the browser page session and is cleared on withdrawal. Visits rotate after 30 minutes of inactivity; this does not mean all browser information is physically deleted after 30 minutes, and browsers may restore page sessions.
Authorized mobile viewers use a Secure, HttpOnly, SameSite=Strict access cookie with a maximum 30-day lifetime. Revocation or an inactive installation can deny access earlier. App localStorage keeps language, setup-guide and device sound/display preferences without an application-set expiry; recording filters use store-scoped session storage. Clearing browser storage removes local preferences, not server-side recordings.
Providers and access
Shopify provides installation, authentication and authorized store interfaces. The current public app is hosted on Cloudflare Workers and uses SQLite-backed Durable Objects storage. Processing is not restricted by the app to Hong Kong or another single jurisdiction. Providers may process IP addresses and connection or security logs even though the app's visit records do not contain a visitor IP field.
Store data is available to authorized app users. A valid private mobile viewing link permits its holder to access the store views it authorizes. Keep it private and revoke it if it is shared unintentionally. We do not use one merchant's private visitor records as another merchant's demonstration data.
Retention and deletion
New recordings have plan-specific expiry: one day for Free, seven days for Standard and 45 days for Pro. Each recording retains its original expiry after a plan change. Allowance and storage limits may stop new recording before that expiry. Expired recordings are unavailable for replay; application cleanup runs through reads and scheduled maintenance.
Application cleanup rules remove live presence after 24 hours since last seen, usage receipts 31 days after their usage cycle ends, and consent-revocation markers after 46 days. Per-store maintenance is scheduled hourly. These rules do not promise immediate erasure from every infrastructure backup.
Cloudflare documents a 30-day point-in-time recovery window for SQLite-backed Durable Objects. Selective deletion and application expiry do not establish immediate removal from recovery history. We prohibit restoring privacy-bearing store state into service unless a current deletion/revocation scope outside that restore can be verified and required erasures reapplied before access resumes. This is a restoration restriction, not a claim that a recovery drill or automated recovery service has been completed.
Primary store records and viewing access are subject to app uninstall and Shopify privacy handlers. A bounded lifecycle security receipt may remain for up to 35 days to prevent delayed or repeated cleanup from deleting a replacement installation or viewing authorization. It contains delivery metadata, a body digest and a captured revoked viewing identifier, rather than the full notification body.
The public Worker was inspected on 11 October 2026 with Logpush disabled, no Tail consumers and null observability configuration. This does not establish that all provider, account or security logs are absent. Cloudflare’s own privacy policy describes provider processing and retention based on service purposes and legal obligations; it does not establish a single numeric expiry for every platform log. Our app recording expiry should not be treated as that provider retention period. Cloudflare controls its provider-level retention under that policy; we do not promise a platform-wide log expiry or deletion date. Our own recording retention periods apply to application records, not every provider log.
Monthly summary counts retain the current month and previous 11 Hong Kong calendar months. They group recorded visits by arrival month, fixed traffic-source category and device. They omit visitor identifiers, URLs, notes and replay content; small-group totals are not guaranteed anonymous. CSV exports state the coverage start and mark incomplete months. Deleted recording history cannot be restored. Selective visitor erasure does not add their retained records to the summary archive; previously aggregated counts cannot be matched back to a visitor. App uninstall and shop erasure clear store summaries.
Support correspondence
Support correspondence can include your email address, store domain, issue description and any information you choose to send. We use it to resolve support and privacy requests. It is kept in the support mailbox separately from storefront recording storage; recording expiry does not delete email.
Our operating schedule is to retain unresolved correspondence while the request is handled. For a resolved request, review and remove unnecessary correspondence within 90 days after closure. Retain only information still needed for an ongoing dispute, security investigation or legal obligation, and review that exception when the matter ends. This is a manual operating schedule, not an automated 90-day mailbox deletion claim. Provider recovery copies may persist according to the mailbox provider's rules. Do not send passwords, private viewing links, payment details or entire visitor recordings by email.
Requests and security
Contact Luckylivelab@gmail.com about applicable access, correction, deletion or restriction requests. Visitors should also contact the store they visited, which can coordinate identification and scope. We may require proportionate verification before disclosing or changing information. Start with a request reference and store domain; do not send passwords, payment information, recordings or private viewing links in an initial message.
The app masks selected recording content and restricts store and viewing access. No service can guarantee that all information is anonymous or that all security risks are eliminated.
Changes
We may update this policy as the app changes. The current version and its last updated date will appear on the public policy page.