Privacy Policy

Account and authentication information

• Email address, display name, account identifier, and profile information you provide.
• Authentication identifiers and session information from Supabase and supported sign-in providers, including Sign in with Apple and Google.
• Apple may provide a private relay email address instead of your personal email. Lumluk does not receive or store plaintext account passwords.
• Encrypted Apple authorization information required to support account-security and authorization-revocation obligations.

Service and viewing information

• Series and episodes viewed, viewing progress, saved content, library activity, purchases, and Lux Coin balance and transaction history.
• Promotional-video interactions and other activity required to operate and improve the service.
• Device type, operating system, app version, platform, language, network information, and technical identifiers.
• Server logs, security events, diagnostics, errors, and performance information.

Purchase information

Mobile purchases are processed through Apple In-App Purchase or Google Play Billing and managed with RevenueCat. Website payments may be processed by Stripe. Lumluk receives transaction identifiers, product identifiers, price and currency information, purchase status, storefront or country, and validation metadata. Lumluk does not receive or store complete payment-card details.

Notification information

If you enable notifications, we process Firebase Cloud Messaging device tokens, platform information, notification preferences, and token activity information. Notification permission can be changed through the application and device settings.

We use information to:

• Create, authenticate, secure, and support accounts.
• Stream content and provide encrypted offline downloads.
• Maintain viewing progress, libraries, purchased access, and Lux Coin balances.
• Validate purchases, prevent duplicate credits, reconcile transactions, and detect fraud or abuse.
• Deliver requested notifications and service communications.
• Enforce device and session limits.
• Diagnose failures, maintain service reliability, and protect Lumluk and its users.
• Comply with legal, accounting, tax, and platform obligations.

Lumluk does not sell personal information or use third-party advertising networks to track users across unrelated applications.

Depending on your platform and activity, information may be processed by:

• Supabase: authentication and account sessions.
• MongoDB hosting and Lumluk backend infrastructure: application records and service operation.
• Cloudflare R2/CDN: media and asset delivery.
• Firebase Cloud Messaging: push-notification delivery.
• RevenueCat: mobile purchase management and transaction events.
• Apple: Sign in with Apple and Apple In-App Purchase.
• Google: Google authentication, Firebase services, and Google Play Billing.
• Stripe: website payment processing.
• Railway and Vercel: backend and website hosting.

These providers process information under their own terms and privacy policies. Information may be processed in countries other than your country of residence.

Lumluk uses HTTPS/TLS, access controls, session management, and other technical safeguards. Offline video files are encrypted on the device using AES-GCM, with encryption keys protected through platform-secure storage. Decrypted temporary playback files are removed after use.

No system is completely secure. You are responsible for protecting your device and account credentials.

• Account and profile information is generally retained while the account remains active.
• Viewing progress, library records, notification preferences, and active-device information are retained as needed to provide the service.
• Notification tokens are unregistered or deactivated when they are no longer valid, when you sign out, or after an inactivity period. Limited token records may remain temporarily for delivery troubleshooting and abuse prevention.
• Purchase, Lux Coin ledger, accounting, webhook, fraud-prevention, and audit records may be retained after account deletion when required for legal, tax, accounting, dispute, security, or duplicate-transaction prevention purposes. Where practical, retained records are deleted, minimized, or pseudonymized.
• Server logs and security records are retained only for operational, security, and legal needs.

Subject to applicable law, you may:

• Review and update available profile information.
• Control notification categories and device-level notification permission.
• Request assistance concerning your account or transaction history.
• Delete your account from the application.

Lumluk currently does not provide an automated portable-data export tool. You may contact us regarding an access or privacy request.

The application supports immediate deletion and, where presented, scheduled deletion with a recovery period. Deletion removes or de-identifies account information and revokes active sessions and supported Sign in with Apple authorization.

Deleting an account removes access to its library, viewing history, Lux Coins, and content-access records. Consumable Lux Coins cannot be transferred to a replacement account. Limited transaction and security records may be retained as described in Section 5.

Account deletion does not itself create a refund. Refund requests are handled under applicable law and the policies of Apple, Google, Stripe, or the relevant payment provider.

Lumluk is not directed to children under 13, and we do not knowingly create accounts for children under 13. Users who have not reached the age of majority should use the service with permission from a parent or legal guardian. Content-rating information and acknowledgment screens are provided for applicable content but do not replace parental supervision.

We may update this Privacy Policy when the service, legal requirements, or providers change. Material revisions may be communicated in the application, on the website, or by requiring acceptance of a new policy version.

Company: Lumluk Co. LTD

Address: 9/1 Islamic Foundation Building, 3rd Floor, Room 306, Arun Amarin Road, Arun Amarin Subdistrict, Bangkok Noi District, Bangkok 10700, Thailand

Email: lumlukcoltd@gmail.com

Website: https://lumluk.vercel.app