Privacy Policy

1. Controller

The controller responsible for data processing on Luminous (as defined by the EU General Data Protection Regulation, GDPR) is the person named in our Impressum (legal notice), where you can also find our contact details for any privacy question.

2. What data we process

We process the following categories of personal data:

• Account data: email address and password (stored in hashed form) when you register.
• Profile data: optional username and country, and any cosmetics (banners/titles) you equip.
• Content you create: video/channel ratings, written reviews, lists, and VideoGuessr highscores — all linked to your account.
• Lumies & purchase data: your Lumies balance and transaction history within Luminous. Card and payment details are entered directly on Stripe's hosted checkout page — we never receive or store your card number.
• Technical/usage data: IP address and standard server logs (via our hosting provider), collected for security and operation of the service.

3. Legal basis for processing

We process your data to perform the contract with you (Art. 6(1)(b) GDPR) — e.g. creating your account, storing your ratings/reviews, crediting purchased Lumies. Server/security logs are processed based on our legitimate interest in operating a secure, reliable service (Art. 6(1)(f) GDPR).

4. Service providers we use

We rely on the following processors, each acting under a data processing agreement:

• Supabase — database, authentication, and file storage.
• Vercel — application hosting.
• Stripe — payment processing for Lumies purchases. Stripe processes your payment details directly; see Stripe's privacy policy.
• YouTube Data API (Google) — search queries and video/channel IDs are sent to Google to retrieve video information; no account data is shared with Google. Use of this API is subject to the Google Privacy Policy.

Some of these providers are based in, or process data in, the United States. Where data is transferred outside the EU/EEA, we rely on the European Commission's Standard Contractual Clauses (Art. 46 GDPR) as implemented by these providers.

5. Cookies and local storage

We use one strictly necessary cookie to keep you signed in (managed by Supabase Auth) and store your dark/light theme preference in your browser's local storage. Neither is used for tracking or advertising, and neither requires consent under applicable law, as both are necessary for the site to function as you request.

6. How long we keep your data

We keep your account data for as long as your account exists. If you delete your account, all associated personal data (ratings, reviews, lists, Lumies balance, profile information) is permanently deleted. Some records may be retained longer where required by law (e.g. tax-relevant transaction records).

7. Your rights

Under the GDPR, you have the right to:

• request access to the personal data we hold about you (Art. 15),
• request correction of inaccurate data (Art. 16),
• request deletion of your data (Art. 17) — you can also delete your account and all associated data yourself, at any time, from your profile menu,
• request restriction of processing (Art. 18),
• receive your data in a portable format (Art. 20),
• object to processing based on legitimate interest (Art. 21), and
• lodge a complaint with a data protection supervisory authority — in our case, the Bavarian State Office for Data Protection Supervision (Bayerisches Landesamt für Datenschutzaufsicht).

8. Security

We use industry-standard measures to protect your data, including row-level access controls on our database, encrypted connections (HTTPS), and never storing raw payment card data on our own systems.

9. Changes to this policy

We may update this Privacy Policy from time to time to reflect changes to our practices or legal requirements. The “Last updated” date above reflects the most recent revision.

10. Contact

For any privacy-related question or to exercise your rights, please contact us using the details in our Impressum.