Privacy Policy
This is a draft pending legal review. Items in [brackets] will be completed before launch.
Who we are
[COMPANY_NAME] is the controller of your personal data. Contact: [CONTACT_EMAIL], [REGISTERED_ADDRESS].
What we collect
Account data: email, a salted password hash, display name and subscription status. Usage data: games played and playtime (needed to pay developers), level progress, scores, saves, and basic device and browser information; IP addresses are used for security and stored only as a daily-rotating hash for fraud checks. Payment data is handled by our payment provider; we never see or store full card numbers. Support data: messages you send us.
Children
We do not knowingly collect personal information from children without verifiable parental consent where the law requires it. Children use Lumarcade through a parent’s account in Kids mode. In the Kids area we show no personalised ads, run no third-party trackers or analytics, offer no chat or public profiles, and keep only what is needed to save progress. Parents can review, correct or delete their child’s data and withdraw consent at any time from the account page or by emailing us.
How we use data
To run and secure the Service, save progress, process payments, calculate developer revenue shares, prevent fraud and abuse, fix problems, provide support and meet legal obligations. With your consent we count anonymous page views to improve the site.
Legal bases (GDPR/UK GDPR)
Contract (running your account and Pass), legitimate interests (security, fraud prevention, improving games), consent (optional analytics and marketing email) and legal obligation (tax and accounting records).
Sharing
With service providers such as hosting (Cloudflare), payments and email, under contracts; with developers only as aggregated statistics that do not identify you; with authorities when the law requires; and in a business transfer, with notice. We do not sell personal data, and we never sell children’s data.
International transfers
Data may be processed in other countries using appropriate safeguards such as standard contractual clauses.
Retention
We keep data only as long as needed. Session data expires after 30 days. Inactive child progress is deleted after [PERIOD]. Financial records are kept for the period tax law requires, without your name or email after account deletion.
Security
Encryption in transit, hashed passwords, access controls, audit logs and backups. No system is perfectly secure; we will notify you and regulators of a breach as the law requires.
Your rights
Depending on where you live, you can access, correct, delete, restrict or port your data, object to processing, withdraw consent and complain to a regulator. Use "Download my data" and "Delete account" on your account page, or email us.
Cookies
See our Cookie Policy.
Grievance officer (India)
[GRIEVANCE_OFFICER_NAME], [CONTACT_EMAIL]. We acknowledge complaints within 24 hours and resolve them within the period the DPDP rules require.
Changes
We will post updates here and notify you of material changes.