Your data.
Clearly explained.

This notice explains data processing on this website and in the LUMO app. Each is described separately.

Last updated: 9 September 2026

1. Controller

Please use the contact details above for privacy questions.

2. Visiting this website

This website is hosted by STRATO. Serving pages involves processing necessary connection and request data, including your IP address, time of access, requested file, transfer size, status code and browser-provided information about your browser and operating system. This is used to deliver and protect the website. The legal basis is Article 6(1)(f) GDPR; our legitimate interest is reliable and secure operation.

STRATO processes hosting data as part of providing the webspace. According to its published information, IP addresses used to detect and prevent attacks are retained for a maximum of seven days. Other technical logs are retained as needed for their relevant security or operational purpose. Further information is available in STRATO’s hosting and privacy information.

This website is temporarily served over HTTP, so the transmission of its content is not encrypted. It has no login, contact form or confidential-data upload.

3. Cookies and local preferences

This website uses no analytics tools, advertising trackers, external fonts or embedded third-party content. Images and website files are served from our own webspace. Our website sets no cookies.

You can reduce motion through “Cookie settings”. Only if you choose “Remember preference” do we save your choice and the time it was saved under lumo.site.preferences.v1 in your browser’s local storage. This information is not sent to us. The preference is used for up to 180 days; the entry is removed on your first subsequent visit after expiry. You can remove it sooner with “Delete saved preference” or your browser’s controls.

This storage serves only the function you expressly request: remembering your display preference (section 25(2)(2) TDDDG). Website preferences do not change advertising consent in the app.

Open cookie settings

4. Game progress in the LUMO app

LUMO does not require an account. Your progress, unlocked worlds, Light balances and game settings are stored on your device. The app also uses this data to calculate progress while you are away. We do not operate our own game server or upload your save to a server of our own. Local processing is necessary to provide the game (Article 6(1)(b) GDPR; necessary device storage under section 25(2)(2) TDDDG).

Your local save remains until the app or its associated data is deleted. We cannot reverse that deletion. Device backups may also include app data depending on your Apple settings; they are managed through the relevant device and backup controls.

5. Optional advertising in the app

LUMO integrates Google AdMob and Google’s User Messaging Platform (UMP). Optional video ads can provide extra Light. The potential reward is shown before a video. Normal gameplay does not require video ads. This website itself displays no AdMob advertising.

For users in the European Economic Area and Switzerland, the Google service provider is generally Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google and the advertising partners named in the consent choices may process data to serve ads. This may include IP addresses and approximate location derived from them, device identifiers, information about ads shown and interactions, and crash, performance and diagnostic data. Purposes include delivery, billing, measurement, troubleshooting and fraud prevention. Actual processing depends on region, settings and permitted ad types.

LUMO requests non-personalized ads and disables Google’s publisher first-party ID and publisher personalization. This does not mean no data is processed. The app currently does not request ATT permission to access Apple’s advertising identifier. UMP consent checks and ad preloading may involve communication before a video actually plays.

Where consent is required, processing relies on your choices (Article 6(1)(a) GDPR and section 25(1) TDDDG). Technically necessary processing that is legally permitted without consent follows the purposes and legal bases described in the consent dialog or by the relevant providers. The app does not request ads without UMP allowing requests. Refusing consent may limit available ads.

When advertising is enabled, you can reopen your choices in the app’s Settings under “Ad privacy” and change or withdraw them where available. Withdrawal applies to future processing. Retention by Google and participating partners depends on their purposes and privacy terms; we do not have direct access to their complete datasets. You can address requests to us or directly to the relevant provider.

Google and advertising partners may process data outside the EU/EEA, including in the United States. Google states that Google LLC is certified under the EU–US Data Privacy Framework and uses standard contractual clauses where required for transfers not covered by an adequacy decision. These arrangements do not automatically cover other advertising partners, whose safeguards must be considered separately. See Google’s transfer frameworks and retention policy for direct information. Further information about processing, retention and transfer safeguards is provided in Google’s privacy policy, Google’s partner-app information and the notices of partners listed in the consent dialog.

6. Email support

If you email us, we process your email address and the information you provide to respond to your request. The legal basis is Article 6(1)(b) GDPR for requests about use of the app or Article 6(1)(f) GDPR for other enquiries; our legitimate interest is handling your request. Messages are transmitted through the email services involved.

We retain correspondence for as long as needed to handle the enquiry and any follow-up questions. It is then deleted unless legal retention obligations or legitimate legal-defence reasons require further retention. Without the information needed to respond, we may be unable to handle your request.

7. Your rights

Subject to legal requirements, you have rights of access, rectification, erasure, restriction of processing and data portability. You may withdraw consent at any time for future processing. Where processing relies on legitimate interests, you may object based on your particular situation; you may object to direct marketing at any time.

You may also complain to a data protection supervisory authority, in particular where you usually live or work or where you believe an infringement occurred. To contact us, use the details in section 1. We do not make our own solely automated decisions producing legal or similarly significant effects about you.

8. Changes

We update this notice when features or services change. The current version is available here and through the app’s settings.