Privacy notice (not yet counsel-ratified)

Luminara Adventure is a play-based family support app for children ages 3–12. This notice covers the public website and the implemented backend services that store caregiver accounts and child-profile gameplay telemetry. The legal entity that operates the service, its registration, registered agent, and governing-law details are not yet named or published.

Collection is purpose-limited. Implemented classes include:

• Child gameplay telemetry: Schema-bound interaction events (for example session duration, world visits, and game completions). Ingest requires an authenticated child session. Each persisted event stores the child profile id, caregiver (parent) account id, the child subject token, session id, and the payload. Child display names are server-generated pseudonyms. Telemetry is therefore pseudonymous and linkable inside the service to a child profile and the linked caregiver account. It is not anonymous. Authorized operators and the linked caregiver can associate events with that child profile.
• Caregiver account information: Email address, display name, and household settings required to create and manage the grown-up account and link child profiles.
• App install identifier: When a caregiver pairs a child device, and when that device renews the child's sign-in, the app sends a random identifier it generated on that device. It is not an advertising identifier or a vendor identifier, and it is not taken from the hardware. We use it only to tie the child's sign-in and the device's offline-ledger signing key to that device. It is pseudonymous and linkable to the child profile inside the service; it is not anonymous. On the device it stays in the app's preferences until the account's device data is cleared or the app is removed. On our servers it is held inside the identifier of that device's offline-ledger key and inside the child's sign-in token until that token expires. Removing the child profile or erasing the household deletes the key record.
• Website functional data: The public support mailto contents a visitor chooses to send. This site does not set cookies.

We do not collect real names of children, photos, location data, device contacts, advertising identifiers, or biometric templates. Child free-text is not collected unless a caregiver has explicitly opted in for that profile.

Implemented purposes are:

• Provide and maintain the app, pairing, and caregiver tools
• Adjust play difficulty and show caregivers aggregate, five-minute activity windows — not per-tap traces
• Honor consent, export, and erasure requests
• Send service messages to the caregiver account
• Crash reporting via Sentry with child id scrubbed before send

Gameplay telemetry is consent-gated per child. There is no behavioral advertising and no third-party analytics on children.

Consent is deny-by-default. A child profile is created only after a caregiver attests consent for that child. Gameplay telemetry is persisted only while that child's gameplay-telemetry consent is active. A caregiver may withdraw gameplay consent without erasing the household; telemetry then pauses and historical records follow the retention schedule until erasure is requested.

The verifiable parental consent method that will be used at public launch is still under legal review. This notice does not claim that email verification alone is sufficient COPPA VPC.

We do not sell personal information. Processing that leaves Luminara-operated systems is limited to subprocessors listed on the subprocessors page. Organization or care-team sharing of child-identifying data requires a separately executed agreement and is not enabled in the current beta's browser portals.

Retention is per record class. There is no universal seven-year default. Raw telemetry events are kept for a shorter time than the summaries built from them; the windows are on the retention schedule. Caregiver accounts are kept until the caregiver requests deletion. Audit logs are append-only and are not erased with the account; erasure for those classes means access revocation. See the retention schedule.

Caregivers can request a structured export of household and child records from caregiver tools in the native app, and can request household erasure on the public deletion page (no app install required) or from in-app settings. Erasure removes the household account and cascades to its child profiles and gameplay records. Export paths are described on the data export page.

Email privacy@luminaraadventure.app for access, rectification, objection, or lost-access deletion help. Do not include a child's real name in that email.

• TLS 1.2+ in transit (TLS 1.3 preferred)
• AES-256-GCM at rest for encrypted personal fields
• Argon2id password hashing
• Append-only audit logs (updates and deletes rejected at the database)

These are engineering controls in the current implementation. They are not a certification, SOC report, or penetration-test attestation.

The product is designed for children and includes parental consent, no behavioral advertising, no third-party analytics on children, and parent-exercised access and deletion. Formal COPPA and GDPR certification, DPIA completion, EU representative designation, and counsel ratification of this notice are not finished. Nothing on this page is a compliance claim.