Legal

Privacy Policy.

This policy covers the Keno Club app for iPhone and iPad and the FlyCow-operated services it can connect to. It is written to be read, not survived.

Effective: 7 August 2026 · Last updated: 11 September 2026

This revision adds how limited recent room messages are processed by Cerebras for automated chat replies.

The short version

A fresh installation needs iCloud and an internet connection to initialize or restore progress. Once initialized, ordinary play can continue offline; online features need a connection.
There is no separate Keno Club password. We ask for an email address if you choose to subscribe to club email. Email subscription is optional and is not required to play.
If you sign in with Game Center, optional online features turn on: leaderboards, the progressive jackpot, and — where enabled — VIP chat. These publish your display name, your club level, your VIP badge, your scores, and (if your platform profile has one) a small copy of your photo to other players.
Games that play for a progressive jackpot are sent to our servers — win or lose — because the jackpot is settled there and not in the app. The rest of your play stays on your device.
If you allow notifications, we store the device token Apple gives the app so we can deliver them, along with which categories you switched on. Offers are opt-in and off by default. Turn notifications off and the token is deleted.
We keep a pseudonymous key derived from your platform sign-in. We never store your raw Game Center identifier.
We do not sell your data, do not share it with advertisers, and the app runs no ad networks.
You can delete your online record yourself, in the app, at Settings → Delete My Account.
Coins are score. They have no cash value and cannot be redeemed, transferred, or exchanged for money or prizes.

1. Who we are

Keno Club is published by FlyCow Games Inc. ("FlyCow", "we", "us"). We are the controller of the data described in this policy. You can reach us any time at hello@flycowgames.com.

This policy is specific to Keno Club. FlyCow's company-wide data-retention policy is published separately at flycowgames.com/privacy-policy; where the two differ for Keno Club, this policy governs.

2. Playing offline — what stays on your device

A fresh installation requires an Apple Account with iCloud available and an internet connection to initialize or restore progress. After initialization, ordinary play can continue offline. The app stores the following locally:

Your coin balance and settings.
Your game history — the newest 10,000 games, including the numbers you marked, the balls drawn, bets, wins, and balances.
Your streak and daily-return state.

You can clear your history or reset all local progress from Settings inside the app. Deleting the app removes its local data under normal iOS behaviour.

If you are signed in to iCloud, iOS may include app data in your device backup, and the app keeps player progress in your own private iCloud database. That database belongs to your Apple Account: FlyCow cannot read it, and Apple's privacy policy governs it.

3. Keno Club: Game Services and Public Features

After initial iCloud setup, ordinary play can continue offline. Online features connect to FlyCow-operated servers and use your platform player identity (Game Center on Apple devices):

Leaderboards

Your display name, club level, VIP badge, crown title, and scores appear on public leaderboards visible to all players across platforms. If your platform profile has a photo, a small copy of it is uploaded to our servers and shown beside your name. Daily standings are kept for up to 14 days; all-time bests are kept while your player record stays active.

Progressive jackpots

The jackpots are settled on our servers, not inside the app. The app never decides for itself whether you won — it hands us the game and we work out the result — so every game that plays for a live jackpot is sent to us, win or lose. It goes in two parts: the numbers you marked and your bet when the game starts, and the balls drawn when it finishes. Our server counts how many you caught and pays any jackpot the game won. (Your ordinary paytable win is still worked out on your device — only the jackpots are settled with us.)

Whether a game plays for a jackpot depends on the jackpots running at the time, and the entry bar is your bet. Right now the lower one takes any game with a bet of 25 coins or more, so for most signed-in players this is most of their play. A smaller bet is not sent, and neither is anything you play signed out or offline.

We keep these games only for as long as settling them takes. The numbers you marked are held for 48 hours. The balls drawn are not stored at all — we keep a one-way fingerprint of them for the same 48 hours, so that one draw cannot be settled twice. If a game wins, its award record — your bet, how many spots you played, how many you caught, and the amount paid, but never the numbers themselves — is kept for 90 days so the award can be verified and cannot be paid twice.

Winning a jackpot is public. When a jackpot pays out, the win is shown to the rest of the club: the pot, the amount, and who won it — your display name and your profile photo, the same ones already beside your name on the leaderboards. Tapping a pot in the app opens its recent winners. We keep the newest 25 wins per jackpot, and no win stays on that list for more than 14 days. Deleting your account removes your wins from it.

The push notification is different and stays that way: the message that arrives on your lock screen names the pot and the amount and nobody at all. A lock screen is read by whoever is holding the phone; a winners list is opened inside the app by someone who came looking.

Identity

We verify your platform sign-in and keep only a pseudonymous key derived from it. Your raw platform identifier is used for verification only and is never stored. Display names and photos are presentation data, never credentials.

The app also generates a random installation identifier the first time it talks to our servers, and sends it with leaderboard submissions so the same installation can be recognised across requests. It is not your device identifier and not an advertising identifier: it is specific to this app, it is not shared with anyone else, and resetting the app's data or reinstalling replaces it with a new one. Jackpot settlement does not use it — a jackpot game is identified by the signed record our server issues when the game starts.

Gameplay aggregates

Our servers keep bounded daily totals (games played, virtual-coin wagers and wins) for leaderboards, jackpot accounting, and abuse prevention. Apart from those totals, individual games reach us in exactly two ways.

Games that play for a progressive jackpot, as described above — sent whether they win or lose, because that is how the jackpot is settled. Each one carries the numbers you marked, your bet, the balls drawn, and the times the game started and finished.

A big-hit announcement in VIP chat. If you are a Club member and VIP chat is on for you, a win paying at least three times your bet is posted to the room as a one-line notice giving the draw number, how many spots you played, how many you hit, your bet, and the award. It never includes the numbers themselves, and it is kept for as long as any other chat message.

Nothing else about a game leaves your device.

VIP chat

If enabled for your account, messages you send are visible to other members and retained for up to 90 days.

Notifications

Keno Club can send you push notifications — a jackpot going, one of your own wins landing while you are away, a coin drop, an account or billing message, and, only if you ask for them, offers. Switching them on creates a record on our servers. Here is exactly what that record is.

A device token. When notifications are on, Apple gives the app a device token: a long string, minted by Apple, that names this copy of Keno Club on this device as a place a notification can be delivered. It is an address, not an identity — it is not your Apple Account, not your email, not your phone number, and not an advertising identifier. Every app on iOS that sends notifications has one, because it is the only way iOS will deliver them. We send it to our servers and store it beside your pseudonymous key, so that we know which notifications are yours. We use it for one thing: sending you notifications. We never sell it, never share it with advertisers, and it goes nowhere except to Apple's notification service, which carries the message to your phone.

What you switched on, and where those settings live. There are five switches — Jackpots, Your wins, Account, Game alerts, and Offers and sales — plus a pause-all switch. Your choices are stored on our servers, not just on your phone, because the decision about whether to send is made on our side and your phone is not consulted at the time. Stored with them are your device's language and time zone. The time zone is what keeps notifications out of your night — quiet hours run on your own clock, not ours — and what we count the daily limits against, so the app cannot become noisy. One honest exception, which the app also states beside the switch: an urgent billing or account problem is sent even when Account is off or everything is paused, because not being told is the whole problem.

Offers are opt-in, and we keep the proof. Offers and sales is off unless you turn it on, and our servers refuse to send a promotional notification unless a record of your consent is stored — whatever the switch on your phone happens to say. When you turn it on we record that you agreed, the exact words you were shown, the app version, and the time. Turning it off records a withdrawal rather than erasing the earlier record: a consent trail you can quietly rewrite is not a consent trail. It is deleted when the rest of your notification record is.

What is in a notification. The message itself is written to be safe on a lock screen, where anyone holding your phone can read it: it carries the pot, the amount, and where to go if you tap. It never carries your name, your photo, your key, or anything identifying another player. A swept-jackpot notification tells everyone else which pot went and for how much, and never who won it — the winner's name is shown inside the app, on the pot's winners list (section 3), not on anybody's lock screen.

Turning it off, and deletion. Switch any category off in the app, or turn notifications off for Keno Club in iOS Settings. If you revoke permission in iOS Settings, the app notices the next time you open it and deletes the device token from our servers, taking your switches and your consent record with it. Settings → Delete My Account removes all of it too. The token also goes if Apple tells us it has stopped working, or if the same device registers again as a fresh installation. There is one more clock on it: if we have not heard from that copy of the app for 180 days, we delete the token and your switches with it. The app registers again the next time you open it, so nothing is lost by coming back.

We also keep a short record of which notifications we decided to send you and which we held back and why, so that one event cannot notify you twice and so the daily limits can be counted. It is deleted after 14 days. We do not record whether you opened a notification.

Your choices

Offline play after setup stays on your device; progress is also stored in your private iCloud database when available. You can delete your online record yourself at any time from Settings → Delete My Account: this erases your leaderboard standing, your stored photo, your entries on the public jackpot winners lists, the recent games we still hold for jackpot settlement, your jackpot player record, and your notification record — device token, switches and consent — from our servers. It does not affect your platform account, your purchases, or the game history on your device. Local data clears from Settings or by uninstalling the app. Coins have no cash value and cannot be redeemed or transferred.

Two further details on the same features, for completeness:

Shared online identity. Our chat, leaderboard and jackpot services use a shared pseudonymous player key so your profile and activity can be connected across those Keno Club services. It is not an advertising identifier.
Chat specifics. Where VIP chat is enabled, the chat service receives your display-name snapshot, message text, reactions, club level, a salted pseudonymous key, your big-hit announcements, and — only if your platform profile has a photo — a small recompressed avatar. Messages are kept for at most 90 days or the most recent 100,000 messages in a room, whichever is smaller. Reports and moderation records are kept longer so that a report cannot be erased by deleting a message. The chat service never receives your balance, your purchase history, your email, or your raw Game Center identifier.

Automated chat replies

House Regulars are automated participants in club chat. To help their replies fit the conversation, we send Cerebras, our AI service provider, a bounded excerpt of recent room messages: up to 20 messages from the last five minutes, limited to 240 characters each. The request can also include basic room and game activity and a shortened display name. We do not attach account email addresses, coin balances, purchase histories or raw Game Center identifiers to these requests. Anything you write in a message may be included, however, so please do not post private information. You can play without posting in chat.

This recent-message context is held temporarily in our service's memory, separately from the room's chat history. Cerebras states that API requests are not used to train models and request and response content is not retained as stored logs. Temporary in-memory prompt caching may occur. See Cerebras's privacy policy and its prompt-caching information.

Optional club email

If you enter your email address in the app and confirm the subscription, we use it to send club news, promotional messages, daily-return links and account messages. Subscribing is optional. We do not obtain your address from Apple or Game Center.

We store the address with your pseudonymous player record, subscription status and consent history. We send a confirmation email first; promotional email starts only after you confirm. We use Resend to deliver these messages on our behalf. Resend processes recipient addresses, message content, delivery information and email-open events. Open measurement is enabled; click-tracking redirects are disabled. An open event can be generated when an email image loads, including through a mail provider’s privacy proxy, so it does not reliably establish that you read a message. We do not use this information for advertising across other companies’ apps or websites.

Every club email includes an unsubscribe link. You can also switch email off in the app’s email settings. Unsubscribing stops promotional email; it does not itself delete the subscription record. Settings → Delete My Account deletes the email address from our player record. A one-way keyed digest remains in an anti-abuse ledger to prevent repeated collection of a verification bonus; it contains neither the address nor a player-account identifier. You can also contact us to request access or deletion, including provider-held delivery records.

4. Purchases

Coin packs and VIP Club membership are sold by Apple through the App Store. Apple processes the payment; we never see your card, your billing address, or your Apple Account email. The app checks with Apple whether your membership is active, and carries a single yes/no "VIP" flag to our servers so member features work.

We do not receive, store, or transmit purchase histories, product identifiers, prices, or receipts to our own servers. Refunds, cancellations, and subscription management are handled by Apple at apps.apple.com/account/subscriptions.

5. Analytics and attribution

The app contains the AppsFlyer Strict SDK for install attribution. In the shipping configuration it is switched off: it is built without IDFA or AdSupport, no advertising identifier is collected, no user identifier is sent to it, and no App Tracking Transparency prompt is shown. It stays off unless a server-side switch is turned on.

We will not turn that switch on without first updating this policy and the App Store privacy label. If and when it is enabled, AppsFlyer may receive a device identifier, coarse product interactions, and verified purchase lifecycle events. It never receives your Keno numbers, draw results, chat content, display name, avatar, raw Game Center identifier, or coin balance.

The app runs no advertising networks and shows no ads.

6. What we do not collect

Keno Club does not collect, and has no code to collect:

Your location.
Your contacts, photos library, camera, microphone, or health data.
Your financial information, browsing history, or search history.
Crash or performance telemetry — there is no third-party diagnostics SDK in the app.
Your game history as a record. The newest 10,000 games sit on your device — the numbers, the balls, the bets, the balances — and that archive is never uploaded, in whole or in part.
What you do with a notification. We know we sent it; we do not know whether you saw it, opened it, or ignored it. There is no read receipt and no open tracking.

One thing that list does not cover, and we would rather say it twice than once: individual games. A game that plays for a progressive jackpot is sent to us on its own, win or lose, because that is where the jackpot is settled — and at today's settings that is most of the games a signed-in player plays. Section 3 sets out exactly what is sent and how long it is kept.

We do not sell personal information, and we do not share it for cross-context behavioural advertising.

7. How long we keep things

Data	Where	Kept for
Game history, balance, settings	Your device	Until you clear it or uninstall — newest 10,000 games
Daily leaderboard rows	Our servers	14 days
All-time bests and player profile	Our servers	While your player record is active; pruned after 400 days of inactivity
Games sent for jackpot settlement — the numbers you marked and your bet	Our servers	48 hours
The balls drawn in those games	Our servers	Not stored — only a one-way fingerprint, for 48 hours, so one draw settles once
Jackpot award records — your bet, how many spots, how many you caught, the amount paid; never the numbers	Our servers	90 days
Public jackpot winners list — your display name, your photo and the amount you won	Our servers	The newest 25 wins per jackpot, and none older than 14 days
Notification device token, your category switches, and your language and time zone	Our servers	Until you turn notifications off, delete your account, or the token stops working — and in any case 180 days after we last hear from that copy of the app
Your consent to promotional notifications — that you agreed, the wording shown, and when	Our servers	With the token above; a withdrawal is recorded rather than erasing the record
Which notifications we decided to send or hold back	Our servers	14 days
VIP chat messages	Our servers	90 days, or the newest 100,000 messages per room — whichever is smaller
Recent context for automated chat replies	Our service's memory and Cerebras	Our context includes only messages from the last five minutes; Cerebras may temporarily cache prompts in memory, as described above
Moderation reports	Our servers	Kept for abuse handling
Club email address, subscription and consent records	Our email service and delivery processor	While the subscription record remains; the address in our player record is deleted when you delete your account. A non-reversible anti-abuse digest is retained.
Support emails	Our mailbox	2 years from resolution

When you delete your account, retained award totals are anonymised rather than removed, so that jackpot accounting stays correct without pointing back at you.

8. Your choices and your rights

Play offline after setup. Ordinary play can continue after progress has been initialized. Leaderboards, live jackpots, chat and other online features need a connection.
Stop club email. Use the unsubscribe link in a message or the app’s email settings. To delete the address from our player record, use Settings → Delete My Account.
Delete your online record. Settings → Delete My Account, inside the app. It removes your leaderboard standing, your uploaded photo, your profile, your entries on the public jackpot winners lists, the recent games we still hold for jackpot settlement, your jackpot player record, and your notification record — the device token, your switches, your promotional-consent record, and the log of what we sent you.
Turn notifications off. Category by category in the app, or all at once for Keno Club in iOS Settings. Revoking permission in iOS Settings deletes the device token from our servers the next time you open the app — you do not have to ask us.
Delete local data. Clear history or reset progress in Settings, or uninstall the app.
Access, correction, portability, objection. Depending on where you live — including under the GDPR in the UK and EEA, and the CCPA/CPRA in California — you may have the right to request a copy of your data, correct it, restrict or object to its processing, or complain to your data-protection authority. Email hello@flycowgames.com and we will respond within the time your law allows.
No discrimination. Exercising any of these rights never changes your odds, your paytable, your coins, or your membership.

9. Who processes data for us

Apple Inc. — Game Center sign-in, display name and photo, App Store payments, iCloud backup, and the Apple Push Notification service that issues the device token and carries every notification to your device.
Cloudflare, Inc. — hosts our leaderboard, progressive-jackpot, and chat services, and this website.
Resend — delivers optional club email and processes delivery and email-open information as described above.
Cerebras — processes limited recent room messages and activity to generate contextual replies for automated House Regulars, as described above.
AppsFlyer Ltd. — install attribution, currently disabled as described in section 5.

We do not disclose personal information to anyone else, except where we are legally required to, or where it is necessary to investigate abuse or protect players.

10. Children

Keno Club simulates casino-style play and is intended for adults. It is not directed to children, and we do not knowingly collect personal information from anyone under the age required by their local law to use a simulated-gambling product. If you believe a child has provided us with data, email hello@flycowgames.com and we will delete it.

Keno Club offers no real-money gambling and no opportunity to win real money or prizes.

11. Where your data is processed

Our services run on Cloudflare's global network, so the server that answers you is typically the one nearest you. Data may be processed in the United States and other countries whose data-protection laws differ from your own. Where required, we rely on standard contractual clauses or equivalent safeguards for these transfers.

12. Security

Traffic between the app and our services is encrypted in transit. Access to production systems is restricted and audited. Identity keys are stored only in HMAC-derived form. No system is perfect, but the design goal is that a breach of our servers would expose no raw platform identifiers, no payment data, and no long-term record of your play — because we do not hold them. What it could expose includes subscribed email addresses and consent records, chat and profile data, and the last 48 hours of games sent for jackpot settlement — for those, the numbers you marked and your bet — and, for players who have notifications on, the device tokens we hold and the notification settings beside them. A device token cannot be used to read anything from your phone, and on its own it cannot be used to send you anything either — sending also requires the signing key Apple issued us, which is held separately as a secret and is not stored with the tokens. We still treat a token as personal data, and delete it as soon as it is no longer needed. A breach would not expose the balls drawn, which we keep only as a one-way fingerprint, the game history on your device, or anything at all about games played signed out.

13. Changes to this policy

If we change how Keno Club handles data, we will update this page and change the "Last updated" date above. Material changes — in particular, enabling any new data collection — will be reflected here and in the App Store privacy label before the change ships.

14. Contact

Questions, requests, or complaints about this policy:

Email hello@flycowgames.com

FlyCow Games Inc.
365 Meadowview Place
Parksville, BC V9P 1W2
Canada
Telephone: +1 604 616 1943