McLuck

Is McLuck safe?

McLuck works like an online casino that pays cash prizes, but without a casino licence, and it handles gambling harm through support tickets. Four states have told it to stop, Baltimore is suing, and its privacy policy collects face scans for payouts and allows your data to be "sold" or "shared" for advertising. We score McLuck 40/100, the same as Chumba Casino and just above Pulsz at 38.

The App Store listing reads like a free slots game. It talks about Gold Coins and jackpots and ends with "There Is No Real Money Gaming Offered in This App". McLuck's own website is plainer: you can play "with free Sweepstakes Coins (SC) for a chance to redeem real cash prizes and gift cards". The app has about 19,000 ratings in the US.

Which states have acted against McLuck?

Maryland's gaming agency wrote to McLuck on 7 May 2024 that it had no record of a licence, and asked it to confirm by the end of the month whether it offered casino games and, if so, to stop within 10 days. In June 2025 New York's Attorney General named McLuck among 26 sweepstakes casinos that were ending the sale of sweepstakes coins in the state after her cease-and-desist letters. Tennessee's Attorney General listed McLuck in December 2025 among about 40 operators that had agreed to comply with similar letters.

On 4 February 2026 the Illinois Gaming Board told McLuck it had seen slots and table games with cash and gift-card prizes on offer to Illinois users on 9 January, and demanded that it block residents or stop the prizes. The terms of 15 July 2026 exclude 16 states, including Maryland, New York and Tennessee, but not Illinois.

The City of Baltimore sued McLuck's operator and five other companies in March 2026, alleging illegal gambling, minimal age checks and designs that appeal to young users. That case is an allegation so far. Under our rules, four state orders and no fine put the regulatory record at 40, the same as Pulsz.

What data does McLuck collect?

Apple's label is short: identifiers may be used to track you, and contact details, identifiers and usage data are linked to you. The privacy policy, updated in November 2025, goes much further. It lists faceprints, selfies and government ID for identity checks, kept until the purpose is met or three years after your last contact. It covers copies of payment cards or Apple Pay screenshots as proof of payment, bank documents as proof of address, and location from your phone.

It also says McLuck may disclose identifiers, account details, browsing activity and location "in a manner that could be deemed 'selling' or 'sharing'". You can opt out by turning off marketing cookies or by switching on Global Privacy Control in your browser, which the policy promises to honour. The site does not respond to Do Not Track signals.

Tools against gambling harm

McLuck's player safety page speaks of "Computer Game Behavior Disorder" and points to gaming-addiction resources rather than gambling helplines, in wording that also appears in Pulsz's policy. Every tool works through support or the contact form. A daily cap on Gold Coin purchases can be changed again after 24 hours. A "Take a Break" lock lasts 7, 14 or 30 days. Self-exclusion lasts at least six months, and reopening afterwards adds a seven-day wait and some questions. The page warns that self-exclusion "is not fail-safe".

The terms also let McLuck close an account that has seen no play for 60 days, without notice, and coins in a dormant account expire. Disputes go to individual arbitration in Delaware unless you opt out within 30 days.

How to use McLuck more safely

1. Check that your state is not on the excluded list; Illinois residents are playing on a site their regulator called illegal.
2. Email support for a daily purchase limit before your first purchase.
3. Turn on Global Privacy Control in your browser, or switch off marketing cookies, to stop ad sharing.
4. Redeem prizes you want to keep before 60 days pass without play.
5. If you want arbitration out of the picture, send the opt-out within 30 days of signing up.

How we scored it

Privacy (36) is the weakest factor: face and ID data, payment card copies and data shared for ads, with a store label that shows little of it. Scams and harmful content (38) reflects cash-prize casino play described as free games. Regulatory record (40) and transparency and control (40) come next, with four state orders and harm tools that need a request. Security (45) is the strongest, mainly because we found no breach.