Lumo — Privacy Policy
Effective Date: July 27, 2026
Last Updated: July 27, 2026
This Privacy Policy explains with full transparency how personal data is collected, processed, stored, shared, and protected when you use the Lumo mobile application (the “Application” or “Service”), developed and operated by cosmicloopbyte (“Lumo,” “we,” “us,” or “our”). By downloading, installing, or using the Application, you acknowledge that you have read and understood the practices described in this Policy.
This Policy has been prepared with consideration for Türkiye’s Personal Data Protection Law No. 6698 (“KVKK”), the European Union’s General Data Protection Regulation (“GDPR”), and other applicable legislation.
1. Data Controller and Contact
- Data Controller: cosmicloopbyte
- Email: cosmicloopbyte@gmail.com
- Application: Lumo — Language Learning Application
You may send all privacy-related requests, questions, and applications to the email address above.
2. Brief Summary (Full Text Below)
In line with our commitment to transparency, we summarize the most important points first:
- You do not need to provide a first name, last name, email address, phone number, or identity information to use the Application. Your account is linked to an anonymous identifier unique to your device.
- We do not display advertisements, use third-party advertising/tracking SDKs, or collect your Advertising ID.
- We do not use analytics or crash-reporting SDKs.
- The microphone is used only for pronunciation exercises through your device’s own operating system speech-recognition service. The Application does not store or itself transmit your audio recording to its own servers; it evaluates your answer using only the resulting text.
- We do not sell your data.
- You can permanently delete your account and all associated data from within the Application by selecting Settings > Delete Account.
3. Personal Data We Collect
The Application processes the minimum amount of data required to perform its functions. Each data category, purpose, and source is described below.
3.1. Identity and Account Data
| Data | Description | Source |
|---|---|---|
| Device identifier (device ID) | An identifier unique to your device is generated and irreversibly hashed on the server to create an anonymous user identifier (userId). Your account is linked to this identifier. | Automatically (device) |
| Display name | Optional. If you do not provide one, a display name in the form “anonymous####” is assigned automatically. | You (optional) |
| Avatar and flag emoji | Visual preferences displayed on your profile. | You (optional) |
| Friend code | A short, unique code that you may share to add friends. | Automatically |
Note: Although the Firebase Authentication infrastructure is technically available, your identity is created using a device-based anonymous method, not an email address or social account.
3.2. Learning and Progress Data
Lesson completion records, questions answered and answer accuracy, streak day count, XP earned, number of words learned, heart/life, energy and gem balances, selected source and target languages and level (A1–C2), daily goal, and quest status.
3.3. Social Feature Data
Duel (PvP) matches, your answers, scores and win count; league ranking and cohort membership; posts and likes in the activity feed; friend connections and sent/received friend requests; and private duel rooms you create or join.
3.4. Purchase and Subscription Data
Premium subscription status and expiration date, energy/product purchases, and purchase validation records (purchase events). We do not receive your payment card information; all payments are processed by Google Play and our subscription infrastructure provider, RevenueCat (see Section 5).
3.5. Application Preferences
Sound effects, vibration (haptics), daily reminder and streak reminder preferences, and daily XP goal.
3.6. Microphone and Speech Data (Important)
For pronunciation questions, microphone permission (RECORD_AUDIO) is requested so that you can speak your answer. This feature uses Android’s on-device speech-recognition component (SpeechRecognizer):
- The Application does not itself record, store, or upload your audio to its own servers.
- Your voice is converted into text by your device’s operating system; we compare only this text with the correct answer.
- Depending on the provider installed on your device (for example, Google), speech recognition may take place under that provider’s own privacy policy. This component belongs to your operating system and is not controlled by the Application.
- You can use all other features of the Application without granting microphone permission.
3.7. Technical and Connection Data
To provide the Service, our infrastructure provider (Google Firebase / Cloud Functions) may temporarily process your IP address, transaction timestamps, and basic request metadata for security, abuse prevention, and Service delivery.
3.8. Data Stored Locally on Your Device
For faster and offline startup, the Application stores snapshots of progress, settings, and content in a local cache on your device (Room database / local cache). This data remains on your device and is deleted from the device when you uninstall the Application.
4. Purposes and Legal Bases for Processing Personal Data
| Purpose | Example | Legal Basis (KVKK Art. 5 / GDPR Art. 6) |
|---|---|---|
| Providing the Service | Recognizing your account and saving your progress | Performance of a contract |
| Social features | Duel matchmaking, leagues, and friend system | Performance of a contract / your explicit feature request |
| Gamification | XP, streaks, energy, and reward balancing | Legitimate interests / performance of a contract |
| Purchases and subscriptions | Premium validation and refund prevention | Performance of a contract / legal obligation |
| Security and abuse prevention | Detecting cheating or abuse and applying rate limits | Legitimate interests |
| Legal obligations | Compliance with applicable law when required | Legal obligation |
| Notifications (optional) | Daily and streak reminders | Your consent (may be disabled in settings) |
5. Third Parties and Data Sharing
We do not sell your personal data or share it with third parties for marketing purposes. Your data is processed only by the service providers acting as processors or subprocessors that are necessary to provide the Service, in accordance with their applicable privacy policies:
| Provider | Role | Data Processed |
|---|---|---|
| Google Firebase / Google Cloud (Cloud Functions, Firestore, Storage, Authentication) | Server infrastructure, database, and file storage | Account identifier; learning, social, preference, and technical data |
| RevenueCat | Subscription and purchase management/validation | Anonymous user identifier and purchase/entitlement information |
| Google Play Billing | Payment processing | Payment transactions (card information remains with Google) |
| Device Operating System Speech Service (for example, Google) | Speech-to-text for pronunciation | Live audio on the device/with the OS provider; see Section 3.6 |
We may also share your data only when: (i) required to comply with a legal obligation, (ii) necessary to protect our rights, or (iii) you have given your explicit consent.
6. International Data Transfers
The servers of our infrastructure providers (Google and RevenueCat) may be located outside Türkiye. Your data may therefore be transferred to other countries. Such transfers are carried out under appropriate safeguards required by the KVKK and GDPR (for example, standard contractual clauses) and the commitments of the relevant providers.
7. Retention Periods
- Account and progress data: Retained for as long as your account remains active.
- When you delete your account: Associated personal data is permanently deleted or irreversibly anonymized within a reasonable technical period, including removal from backups, and no later than 30 days. See Sections 9 and 10.
- Purchase/transaction records: May be retained longer when required for legal obligations such as accounting, taxation, and fraud prevention.
- Local cache: Deleted from your device when you uninstall the Application.
8. Data Security
We take reasonable administrative and technical measures to protect your data, including encryption in transit (HTTPS/TLS), server-side access controls, maintaining all game, balance, and reward logic in a server-authoritative architecture in which the client does not make final decisions, and irreversibly hashing your identifier. Although no method is 100% secure, we exercise appropriate care to protect your data.
9. Your Rights
Under KVKK Article 11 and the GDPR, you may have the right to:
- Learn whether your personal data is processed and access that data;
- Request correction (for example, you may change your display name in the Application);
- Request deletion or destruction (“right to be forgotten” — from within the Application or by submitting a request);
- Object to processing and withdraw your consent;
- Request data portability, where applicable;
- Request restriction of processing and submit a complaint to the relevant supervisory authority (the Personal Data Protection Authority in Türkiye).
To exercise these rights, contact us at cosmicloopbyte@gmail.com. We will respond within the period required by applicable law (no later than 30 days under the KVKK).
10. Deleting Your Account and Data
You have full control over your data:
- Within the Application: Go to Settings > Delete Account. After you confirm, your account and associated data—including your profile, progress, social content, preferences, and friend connections—will be permanently deleted from our servers. This action cannot be undone.
- By request: Send a deletion request to cosmicloopbyte@gmail.com.
After deletion, all personal data will be removed within a reasonable period and no later than 30 days, except for limited transaction records that must be retained by law (see Section 7).
11. Children’s Privacy
The Application is intended for a general audience. We do not knowingly collect personal data from children under 13 years of age (or the applicable minimum age in certain countries). If we learn that a child has provided us with data, we will take the necessary steps to delete it. If you are a parent or guardian and believe your child has provided data, contact us at cosmicloopbyte@gmail.com.
12. Cookies, Tracking, and Advertising
- The Application does not display third-party advertisements and does not collect the Advertising ID.
- No third-party tracking or analytics SDKs are used.
- The Application does not use web-browser cookies. It uses only local storage/cache technologies required for the Service to function (see Section 3.8).
13. Changes to This Policy
We may update this Policy from time to time. For material changes, we will provide notice within the Application or by another reasonable method. The “Last Updated” date will change with each revision. Your continued use of the Application after a change means that you accept the updated Policy.
14. Contact
For all privacy-related matters:
cosmicloopbyte —
cosmicloopbyte@gmail.com