Privacy Policy

Last updated: October 2026

This policy explains what Lumenhollow collects, why, and your choices. We try to collect as little as possible and never sell your data.

What we collect

• Account info — your email and login, or your Google account if you sign in with Google.
• Game data — your save: creatures, progress, items, Glims, settings.
• Basic usage/device info — standard logs (e.g., approximate region, browser type) for security and reliability.
• Analytics — Google Analytics records the pages you visit, how you arrived, your device and browser type, your approximate location (city level), and a few game moments (signing up, adopting a Glimkin, starting a checkout). We never send it your email, your username or your account ID.
• Purchase records — if you buy something, a record of what you bought and when (we never see or store your full card number).
• Messages you send us — e.g., support emails.

How we use it

• to run the game and save your progress;
• to keep accounts and the economy secure;
• to send essential emails (confirm your address, reset your password);
• to fix problems and improve the game, including seeing which pages and features people use.

Service providers we use

We share data only with the providers that help us run Lumenhollow, under their own terms:

• Supabase — accounts and game database;
• Vercel — website hosting;
• Resend — sending account emails;
• Google — optional “Sign in with Google”, and Google Analytics (visit statistics);
• Stripe — payments, if and when you buy something (we never see your full card details).

Cookies & local storage

We use your browser's local storage to keep your game save and sign-in session, and minimal cookies needed for the site to work. Google Analytics sets its own first-party cookies (named _ga) to count visits; Google keeps that event data for 2 months. You can opt out with Google's browser add-on or by blocking cookies. We don't use advertising trackers and we don't show ads.

Children's privacy

Lumenhollow is intended for players 13 and older. We don't knowingly collect personal information from children under 13 (or the minimum age in your region) without verifiable parental consent. If you believe a child has given us personal information, email us and we'll remove it. Signing up asks for your birth year, and accounts are not created for anyone under 13.

Your choices & rights

You can access, correct, or delete your account data — email [email protected]and we'll help. Depending on where you live (e.g., the EU/UK under GDPR, or California under CCPA/CPRA), you may have additional rights to access, port, or delete your data and to object to certain processing.

Data retention & security

We keep your data while your account is active and as needed to run the game and meet legal obligations, then delete or anonymize it. We use reasonable technical and organizational measures (including a server-authoritative design) to protect it — though no system is perfectly secure.

International transfers & changes

Your data may be processed in countries other than yours, including the United States. We'll update this policy as the game grows and post the new date above. Questions or requests? Email [email protected].