Privacy policy

Who is responsible for your data

This policy covers the game Lumisla for Android and the website lumisla.com. The data controller is Creative Programming Piotr Glejzer, ul. Feliksów 63, 96-100 Skierniewice, Poland, NIP 8361870867, REGON 382446435. For privacy questions, write to contact@lumisla.com. We have not appointed a data protection officer.

What data goes where

Purpose	Data	Legal basis	Recipient	How long
Running the game	progress, results, hints, settings	the data stays on the phone and we have no access to it	nobody	until you uninstall the game or reset it in settings
Personalized ads	advertising ID, app set ID, IP address, device and app data, interactions with ads, diagnostics	consent (Art. 6(1)(a) GDPR)	Google (AdMob) and the ad partners listed in the consent form	set by Google: how long Google keeps data; you can withdraw consent at any time
Ads without personalization (no consent)	IP address, to deliver the ad; data for detecting invalid traffic and fraud, including data Google may store on the device for that purpose only	legitimate interest: delivering the ad you asked for, funding a free game and protecting it from fraud (Art. 6(1)(f) GDPR); Google says storing data on the device only to detect fraud needs no consent	Google (AdMob)	set by Google: how long Google keeps data
Ranking	player ID, Play Games name and avatar, point totals; diagnostics collected by Google	a service you ask for by signing in (Art. 6(1)(b) GDPR)	Google (Play Games)	until you delete your data in your Play Games profile or Google Account
The lumisla.com website	IP address, browser data	legitimate interest: delivering the site and protecting it from attacks (Art. 6(1)(f) GDPR)	Cloudflare (hosting, on our behalf)	as Cloudflare’s terms set it: Cloudflare’s privacy policy
E-mail	e-mail address, the message	legitimate interest: answering you (Art. 6(1)(f) GDPR)	Cloudflare (forwarding), Google (Gmail mailbox)	until the conversation ends, at most 12 months

What the game keeps on your phone

The game keeps everything only on your phone: finished levels and started boards, results and points, hints and stars, and your settings. The game has no accounts, and we have no server that receives players’ data. We don’t ask for consent for this storage because the game needs it to give you the game you asked for (Art. 399(3)(2) of the Polish Electronic Communications Law).

You remove all of it by uninstalling the game or by clearing its data in Android’s settings. “Start the trail over” in the game’s settings removes finished levels and started boards. Because there are no accounts, nothing exists outside your phone to delete.

Ads (Google AdMob)

The game shows only rewarded ads, and only when you ask for one: for a hint or a second chance. The ads come from Google AdMob. We chose to show ads and to pass the data they need to Google. Google then decides how it uses that data, as an independent controller, under Google’s terms for controllers and its own rules. We are responsible for asking for your consent and for what our game sends to Google.

With a personalized ad, Google collects the advertising ID, the app set ID, the IP address, device and app data, how you interact with ads, and diagnostics. The data is encrypted in transit. It is used for showing ads, analytics and preventing fraud. Google profiles your ad interests only with your consent.

In the European Economic Area, the UK and Switzerland, the game asks for your consent in Google’s form before the first ad. The form lists the companies that may receive your data for ads (what Google says about this). You can change your choice at any time in the game’s settings, in the “Ad privacy” row. Withdrawing consent doesn’t change what happened before. You can also reset or delete your advertising ID in Android’s settings.

Without consent, Google shows limited ads. Google says they switch off the collection, sharing and use of personal data for personalizing ads. The IP address is still used to send the ad to the device, and for detecting fraud and abuse Google may store data on the device that serves only that purpose (Google’s page on limited ads). Outside the EEA, the UK and Switzerland there is no form.

Ranking (Google Play Games)

The ranking is run by Google Play Games and works only once you sign in to Google Play Games. When you sign in, Google gives the game your player ID, name and avatar, and Google also collects diagnostics. The game sends Google only your point totals: for the current week and for all time. It sends nothing else. The data is encrypted in transit. Your name in the ranking shows the way you set it in Play Games. The game shows other players’ names as Google sends them and stores none of them. The game also keeps your points on your phone.

In the Google Play Games settings you can hide your activity or sign out. You delete your Play Games data in your Play Games profile or Google Account. Google processes this data under its privacy policy.

Google Play statistics

Google Play shows us aggregated install and crash statistics for the game (Android vitals). They come from phones that share diagnostic data with Google. They hold no data about single players.

The lumisla.com website

The website uses no cookies and no analytics, and loads nothing from other servers, fonts included. It is hosted by Cloudflare (Cloudflare Pages), which works on our behalf: it processes your IP address and browser data to deliver the site and protect it from attacks. The site is served over HTTPS.

E-mail

When you write to contact@lumisla.com, we use your address and your message only to answer you. Cloudflare Email Routing, which works on our behalf, forwards the message to a Gmail mailbox run by Google. We keep the message while the conversation lasts, then delete it, at the latest after 12 months.

Do you have to provide data

You can play without sharing any data with anyone. Data goes to Google when you ask for an ad. Consent to personalized ads is voluntary: without it you see limited ads and play the same way. Signing in to Play Games is voluntary: without it there is no online ranking, and your points stay on the phone. An e-mail address is needed only so that we can answer you.

We make no automated decisions about you. Google profiles your interests for personalized ads only with your consent.

Retention and deletion

We have no accounts and no server with players’ data, so the data we hold is only e-mail messages (up to 12 months) and what Cloudflare records on our behalf for the website. The periods that Google and Cloudflare set are described in their rules: Google, Cloudflare. You delete game data on the phone and Play Games data at Google, and we delete an e-mail message when you ask.

Security

The game’s data sits in the app’s own storage on your phone. Data that AdMob and Play Games send to Google is encrypted in transit, and the lumisla.com website is served over HTTPS.

Transfers outside the EEA

Google and Cloudflare may process data in the USA. Google LLC and Cloudflare, Inc. are active participants in the EU-US Data Privacy Framework, as the official list shows (more from Google and Cloudflare). If that framework stops applying, both companies use the standard contractual clauses approved by the European Commission. To get a copy of the safeguards we rely on, write to us.

Your rights

You have the right to access your data, to have it corrected or deleted, to restrict its processing, to object to processing based on legitimate interest, to data portability, and to withdraw consent at any time. Write to contact@lumisla.com. We answer within one month.

The game’s data stays only on your phone, so we have no access to it. We hold only e-mail messages, so in practice your rights towards us concern those. Google processes the AdMob and Play Games data: you exercise your rights towards Google in your Google Account.

You can also lodge a complaint with the Polish data protection authority, the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych), ul. Stawki 2, 00-193 Warsaw, uodo.gov.pl, or with the authority where you live.

Children

The game is meant for people aged 13 and older. The game does not check age. In Poland, a person under 16 can agree to personalized ads only with a parent’s or guardian’s consent. If you are under 16 and don’t have that consent, don’t agree to personalized ads in the consent form.

A parent or guardian can change this choice in the game’s settings, in the “Ad privacy” row. A parent can also ask us to delete any message a child wrote to us. If we learn that someone under 13 sent us data, we delete it.

Changes to this policy

When we change this policy, the new version appears on this page with a new date of the last change. We also describe a material change in the “What’s new” notes of the game’s update on Google Play.

This policy exists in Polish and English. If the versions differ, the Polish one prevails.