Lingo Mystery Box

The USDC Drop — Privacy Notice

Last updated 17 August 2026.

1.Who is responsible

This drop is run by Blockstar Holdings, registered in the Seychelles. We are the data controller for everything described here.

For anything about your data, including the requests in section 6, write to ana@lingocoin.io.

This promotion is not sponsored, endorsed or administered by X Corp.

2.What we collect, and why

We never see your X password, your X email address, or your direct messages. We ask X only for read access, and we cannot post on your behalf.

What	Why	Legal basis
X user ID, handle	To identify you across sign-ins and pay out a prize	Contract — Art. 6(1)(b)
Account creation date, follower count, post count, verified status	To run the three eligibility checks in the terms, and to spot one person entering many times. Verified status is recorded but is not used to decide eligibility.	Legitimate interests — Art. 6(1)(f): running a fair draw
Boards dealt, boxes chosen, contents, seeds and timestamps	To run the game and to let anyone verify the draw was not rigged	Contract — Art. 6(1)(b)
Your referral code, and who invited whom	To award the extra boxes referrals earn	Contract — Art. 6(1)(b)
Contact details, from a winner only	To verify and pay the prize	Contract — Art. 6(1)(b), and legal obligation for tax records

Eligibility is decided automatically from your X profile at sign-in, against the three conditions in section 1 of the terms. No human reviews it. If you think you were turned away wrongly, write to the address in section 1 and a person will look.

3.Cookies

Three, all strictly necessary to run the drop. There is no advertising or analytics cookie, and nothing here tracks you across other sites.

Name	Purpose	Lifetime
`lingo_session`	Keeps you signed in	6 hours
`lingo_oauth`	Security check during X sign-in	10 minutes
`lingo_ref`	Remembers whose invite link you arrived on	7 days

4.Who else sees it

We do not sell your data and we do not share it for advertising. It is handled by:

Vercel — hosting, in Paris, France.
Supabase — the database, in France.
X — you sign in with them, so they know you used this service.
The Lingo app — if you claim a prize, we pass your X user ID and what you won so it can be credited.

Your data is stored in the EU. Vercel and Supabase are headquartered in the United States and may access it from outside the EEA in order to run and support the service; both are engaged under data processing agreements that incorporate the European Commission's Standard Contractual Clauses. Blockstar Holdings is registered in the Seychelles, outside the EEA.

5.How long we keep it

Your X profile details — until 90 days after the drop closes, then permanently scrambled.
Play records — kept indefinitely once scrambled, so the drop stays auditable. They no longer identify anyone.
Winner's records — kept for as long as the law requires us to keep records of the payment.

6.Your rights

You can ask us to:

give you a copy of your data, or correct it (Art. 15, 16);
erase it (Art. 17) — we do this by permanently scrambling the fields that identify you. The anonymous play records stay, because the draw has to remain auditable and they no longer point at you;
restrict or object to how we use it (Art. 18, 21);
receive it in a portable form (Art. 20).

Write to the address in section 1 and we will answer within one month. One consequence worth stating plainly: if you have us erase your details before a prize is settled, we cannot verify you and cannot pay it.

You also have the right to complain to your data protection authority — in the UK the ICO, in the EU the supervisory authority where you live.

7.Changes

If we change this notice we will update the date at the top. The version in force when you played is the one that applies to your entry.