Privacy Policy

Effective date: 12 November 2026 · Applies to the app “Lumelia” for Android (Google Play, package com.maivika.lumeliagame) and for iPhone and iPad (Apple App Store, bundle ID com.maivika.lumeliagame), version 1.0 and later.

1. Who we are

Lumelia is published on Google Play and the Apple App Store by Maivika (“we”, “us”). We are the controller of the personal data described here. Contact: [email protected]. Maivika is based in Vietnam.

2. Data stored on your device

To make the game work, the app saves the following in its private storage on your device. This data is not sent to us:

On Android, the app turns off Android's automatic app-data backup, so this data is not copied to your Google account backup. On iPhone and iPad, iOS may include it in your iCloud or computer backup of the device if you use backups; those backups are managed by Apple and you, and we have no access to them. Uninstalling the app deletes the data from the device.

3. Advertising (Google AdMob)

The free experience is supported by ads served by Google AdMob (Google LLC / Google Ireland Limited). We show full-screen ads only between paintings, never while you are painting, and rewarded ads only when you choose to watch one. When the app requests an ad, the Google Mobile Ads SDK collects and shares with Google:

• Device and other identifiers: on Android, the Android advertising ID and app set ID; on iOS, the identifier for vendor (IDFV) and, only if you allow tracking (see below), the advertising identifier (IDFA);
• IP address, which may be used to estimate your general (approximate) location;
• App interactions with ads (for example ad views and taps) and app launch information;
• Diagnostics (for example app launch time, hang rate and energy usage).

Google uses this data to show and measure ads, for analytics about ad performance and to prevent fraud and abuse. Depending on your choices and your region, ads may be personalized (based on your interests) or non-personalized / limited (based on general context such as approximate location). Data is encrypted in transit. Learn more: How Google uses information from apps that use its services and the Google Privacy Policy.

Optional ad partners (mediation)

AdMob can ask other ad networks to compete to fill an ad request (“mediation”). The networks below are optional: each one is added to the app and used only after we enable it, in the app and in our AdMob account, and in the EEA, UK and Switzerland only if it is listed in the consent message you see and you agree. When a network is used, it receives the same kind of data as Google above (advertising ID where available, IP address, device information, ad interactions) and uses it under its own privacy policy:

The current list of partners that may receive data in your region is always shown in the consent message and in Settings → Privacy options.

Consent (EEA, UK, Switzerland)

We use Google's User Messaging Platform (UMP), a Google-certified consent management platform that implements the IAB Transparency & Consent Framework. If you are in the EEA, the UK or Switzerland, you are asked for your choices before any ad is requested and before analytics starts. You can review or withdraw consent at any time in Settings → Privacy options. If you do not consent, Google may still serve non-personalized or limited ads, as permitted by law and Google's policies.

App Tracking Transparency (iPhone and iPad)

On iOS, after the consent step above, and only if ads can be shown, the app asks once through Apple's App Tracking Transparency (ATT) prompt whether it may track you across apps and websites owned by other companies. The prompt is not shown to a user we know to be under 13.

• If you tap Allow, the Google Mobile Ads SDK may use your device's advertising identifier (IDFA) to show and measure ads, including personalized ads where your consent choices allow it.
• If you tap Ask App Not to Track (or tracking is restricted on your device), the IDFA is not available to the app or to Google. You still see ads, but they are non-personalized, and the advertising-related consent signals sent to Firebase (§4) are set to “denied”.
• Ad installs may be measured with Apple's privacy-preserving SKAdNetwork, which does not reveal who you are.

You can change your choice at any time in iOS Settings → Privacy & Security → Tracking (or Settings → Lumelia).

Your controls on Android

You can reset or delete your advertising ID, or opt out of ads personalization, in Android Settings → Privacy → Ads (on some devices Settings → Google → Ads). After you delete your advertising ID, apps cannot use it for personalized ads.

4. Analytics (Google Analytics for Firebase)

We use Google Analytics for Firebase (Google) to learn, in aggregate, how people play: which paintings are started and finished, where players stop, how often ads and offers are seen, and whether purchases succeed. This helps us fix problems and decide what to make next. We do not use it to identify you.

• When it runs: analytics is off when the app starts. Events wait in memory until the consent step has finished. In the EEA, UK and Switzerland analytics is turned on only if your consent choices allow it (measurement and storage on your device); otherwise the waiting events are dropped and nothing is sent. On iPhone and iPad, analytics stays off in the EEA, UK and Switzerland. Elsewhere, where consent is not required, analytics is on; on iOS, its advertising-related signals (ad storage, ad user data, ad personalization) are allowed only if you also allowed tracking in the App Tracking Transparency prompt (§3). It is always off for a user we know to be under 13.
• What is collected: a random app-instance ID created by Firebase; game events (for example level started or completed, palette and mood used, ad shown or rewarded, offer or paywall viewed, purchase succeeded or failed, test group assigned) with their parameters (level, palette, product ID, price and currency, ad network and estimated ad revenue); session information; device model, operating system version (Android or iOS), app version, language, and country/region derived from the IP address. If your consent choices allow advertising measurement, Firebase may also collect the advertising ID and app set ID on Android, or the IDFA on iOS (only if you allowed tracking). On Android, Firebase may read the Google Play Install Referrer (how the app was installed, for example from a store page or an ad campaign) and use Android's Privacy Sandbox attribution APIs (permissions ACCESS_ADSERVICES_AD_ID and ACCESS_ADSERVICES_ATTRIBUTION) for privacy-preserving ad measurement.
• What is not collected: your name, email, photos, contacts, precise location, or the content of your paintings.
• Retention: event-level data is kept for up to 14 months and then deleted; aggregated reports without identifiers may be kept longer.
• Where: Google processes the data on its servers, including in the United States. For transfers from the EEA, UK and Switzerland, Google relies on the EU-U.S. Data Privacy Framework (and its UK and Swiss extensions) and on Standard Contractual Clauses. See Privacy and Security in Firebase.

5. Our servers: game configuration and purchase verification

We run two small services on Cloudflare (Cloudflare, Inc., which processes data for us, including in the United States; see the Cloudflare Privacy Policy). The game configuration service is used on Android and iOS; the purchase verification service only on Android.

Game configuration (remote config)

About twice a day the app downloads a settings file (for example how often ads may appear, or which offer is shown). The request contains no identifier from the app. Like any web request, it reveals your IP address and technical data such as the user agent to Cloudflare. We do not use these to identify you; they appear only in short-lived service logs (see retention below). Some settings are A/B tests: the app places itself in a test group using the random install identifier described in §2, which stays on your device. Only the group name (for example “control”) may be sent with analytics events, if analytics is on.

Purchase verification (Android only)

On iPhone and iPad this server is not used: App Store purchases are verified on your device (see §6) and no purchase data is sent to us. On Android, when you buy something, or when the app restores your purchases, it sends the package name, product ID, purchase type and the Google Play purchase token to our verification server. The server asks Google Play whether the purchase is valid, confirms (“acknowledges”) it, and listens for Google Play notifications about refunds, cancellations and renewals so that refunded items can be removed. The server stores:

• a one-way hash (SHA-256) of the purchase token, never the token itself;
• the product ID, purchase state (for example active, cancelled, refunded, expired), expiry date for subscriptions, the Google Play order ID, whether it was a test purchase, and timestamps;
• for refunds and cancellations reported by Google: the order ID, the refund type and reason code, and the date.

It does not receive or store your name, email address, Google account or payment details. Purpose: to grant what you paid for, to remove items that were refunded, and to prevent fraud (legal bases: performance of a contract and legitimate interests). Retention: purchase records are kept while the purchase can still be restored, refunded or disputed and for our accounting duties, and are deleted at the latest 3 years after the purchase ends or is refunded, unless the law requires longer.

Service logs: both services keep technical logs (time, address requested, status, IP address and user agent as seen by Cloudflare) for up to 7 days, for security and troubleshooting.

6. Purchases (Google Play Billing and Apple App Store)

Android: in-app purchases are processed by Google Play. Google collects your payment details under the Google Payments Privacy Notice. The app receives from Google Play only what is needed to unlock what you bought (product ID, purchase state, order ID and a purchase token), and checks it with our verification server as described in §5. We do not receive your name, email address or card details.

iPhone and iPad: in-app purchases are processed by Apple through the App Store (StoreKit 2), under the Apple Privacy Policy. Apple collects your payment details; we never see them. The app receives from Apple only the product ID and Apple's cryptographically signed transaction for it, which StoreKit verifies on your device; only verified purchases unlock content. The app keeps the transaction ID only as a one-way hash on the device and sends nothing about your purchases to our servers. Restore purchases asks the App Store for the purchases linked to your Apple Account. We do not receive your name, email address, Apple Account or card details.

7. What we do not do

• No sign-in or account. We do not collect your name, email (unless you write to us), contacts, photos, files, precise location, camera or microphone.
• No crash-reporting SDK. (If you opted in on your device, Google Play may share anonymous crash and performance statistics with us through the Play Console, and Apple may share anonymous crash and usage statistics with us through App Store Connect.)
• No sale of personal information for money.

8. Legal bases (EEA / UK GDPR)

• Performance of a contract: providing the game, the items you buy, and verifying purchases.
• Consent: personalized advertising, analytics, and storing or reading information on your device for these purposes where consent is required.
• Legitimate interests: non-personalized ads to fund the free game, ad measurement, fraud prevention, security logs, and delivering the game configuration.

Google (and any enabled ad partner) acts as an independent controller for some ad data. Data may be processed outside your country, including in the United States, under safeguards such as the EU-U.S. Data Privacy Framework and Standard Contractual Clauses.

9. US state privacy rights (including California)

Sharing the advertising ID and related data with Google or ad partners for personalized ads may be considered “sharing” for cross-context behavioral advertising or “targeted advertising” under laws such as the CCPA/CPRA and other US state privacy laws. You can opt out by: (a) using Settings → Privacy options in the app where it is shown; (b) deleting your advertising ID or opting out of ads personalization in Android settings, or, on iPhone and iPad, not allowing tracking (iOS Settings → Privacy & Security → Tracking); (c) emailing us. Requests to know, access, correct or delete data mostly concern data held by Google, which you can manage at Google Data & Privacy; we will help with anything we hold (see §5). We will not discriminate against you for exercising your rights.

10. Children

Lumelia is a general-audience game intended for adults and is not directed at children under 13 (or under the minimum age of digital consent in your country). We do not knowingly collect personal information from children. The store content rating describes the suitability of the content, not the intended audience. If you are a parent or guardian and believe your child under 13 has used Lumelia, contact us at [email protected]. We will explain how to delete the app's data and reset the advertising ID (or turn off tracking on iOS), and we will delete anything we hold that we can link to the request.

11. Retention and deletion

• On your device: kept until you delete it. Uninstall the app, or open Android Settings → Apps → Lumelia → Storage → Clear storage, to delete all game data, including finished paintings saved inside the app. On iPhone and iPad, delete the app (touch and hold the Lumelia icon → Remove App → Delete App, or iOS Settings → General → iPhone Storage → Lumelia → Delete App); copies inside existing iCloud or computer backups stay there until those backups are deleted. Images or videos you chose to save to your device gallery stay there until you delete them.
• Analytics: up to 14 months (§4).
• Purchase records on our server (Android only): at most 3 years after the purchase ends (§5). Your purchase history also stays with your Google account, or with your Apple Account for App Store purchases, so you can restore purchases. We hold no purchase records for iOS.
• Service logs: up to 7 days (§5).
• Advertising data: retained by Google and any enabled ad partner under their policies; you can reset or delete your advertising ID (Android) or turn off tracking (iOS) at any time.
• Emails you send us: kept only as long as needed to answer you (normally no longer than 24 months).

To ask us to delete purchase records, email us with the Google Play order ID (it starts with “GPA.”, see your Google Play order history).

12. Your rights

Depending on where you live, you may have the right to access, correct, delete, restrict or object to processing of your personal data, to data portability and to withdraw consent at any time (withdrawing does not affect processing before it). Contact us to exercise them. In the EEA/UK you may also complain to your local data protection authority.

13. Security

Game data is kept in the app's private storage (on iOS, the app's sandbox), which other apps cannot read. All network traffic of the app (ads, analytics, configuration, purchases) is encrypted (HTTPS/TLS). Purchase tokens and App Store transaction IDs are stored only as one-way hashes, on the device and (Android purchase tokens only) on our server.

14. Permissions

Android: the app declares these Android permissions. None of them lets the app read your files, photos, location, contacts, camera or microphone:

• INTERNET, ACCESS_NETWORK_STATE: load ads, analytics, game configuration and purchases.
• com.google.android.gms.permission.AD_ID: advertising ID (ads, and analytics where consent allows).
• com.android.vending.BILLING: Google Play purchases.
• VIBRATE: gentle haptic feedback (can be turned off in Settings).
• WRITE_EXTERNAL_STORAGE, only on Android 9 and older: to save an image or video of your painting to your gallery when you tap Save. It is not used on Android 10 and newer, and the app never reads your files.
• ACCESS_ADSERVICES_AD_ID, ACCESS_ADSERVICES_ATTRIBUTION and the Play Install Referrer service: added by Firebase for privacy-preserving ad measurement (§4).
• READ_BASIC_PHONE_STATE, WAKE_LOCK, FOREGROUND_SERVICE: added by the Google Mobile Ads SDK for its internal work (they do not give access to calls or phone numbers).
• Only if an optional ad partner (§3) is enabled: ACCESS_WIFI_STATE and CHECK_LICENSE (AppLovin), ACCESS_ADSERVICES_TOPICS (Unity Ads), and a Privacy Pass attestation permission (Liftoff).

Sharing a painting is always started by you, through Android's share sheet; you choose the app it goes to.

iPhone and iPad: the app asks for one permission, the App Tracking Transparency prompt described in §3. It does not ask for access to your photos, camera, microphone, location, contacts or Bluetooth, and it does not use the Files app. Network traffic uses HTTPS only.

15. Changes

We will post changes on this page and update the effective date. If changes are significant (for example, a new kind of data or a new partner), we will tell you in the app before they apply.

16. Contact

Maivika · [email protected] · Support page