Privacy Policy

1What this policy covers

This policy applies to the LumaReef mobile app, the LumaReef television apps, the LumaReef viewer that runs in a browser (tv.lumareef.net) and the site at www.lumareef.net. Together they are referred to as the “Service”.

The policy serves as the disclosure notice required under Turkish Personal Data Protection Law No. 6698 (KVKK). The identity of the data controller appears in the company details at the top of this page.

2The short answer: what happens today

You can start trying the app without an account; your tank then stays only on your phone. Once you create an account, your aquarium is stored on our servers: that is how the tank you manage from your phone lives on the screens you connect. For this, your email address, the state of your aquarium, the screens you connect and, if you allow notifications, your device’s notification token reach the server.

The app, the viewer and the site contain no analytics tool, no advertising identifier and no advertising network; the site writes no tracking cookies. Only at the moment of an error does the mobile app send a crash report, not linked to your account, to our own server. We do not sell your personal data and we do not use it for advertising.

The app can ask for only two permissions and both are optional: the camera, to read the pairing QR code on a screen, and notifications, for care reminders. It asks for no location, microphone, contacts or photo permission.

You can delete your account at any time from the account screen of the app; if you signed up with an email address and a password, you can also delete it at www.lumareef.net/en/account/delete. The sections below list, one by one, which data goes where.

3Your account

When you create an account or sign in, the data below is stored on our servers.

• Account details: your email address, your name, whether your email address has been verified, and the date the account was created. If you register with email and password, your password is stored not in the clear but as an irreversible digest.
• Sign-in with Google: if you sign in with Google, Google sends us your email address, your name and the address of your profile picture; the access tokens Google issues to keep the sign-in link working are also stored with your account. We never see your Google password. When sign-in with Apple is enabled, the same rule applies to Apple.
• Sessions: a session record for every device you sign in on. The record contains the IP address the session was opened from and the description the device or browser gives of itself (user agent).
• Language and time zone: your language preference, so that notifications and account emails can be written in your language; your time zone, to work out which day a daily reward belongs to and to keep reminders out of night hours.
• Verification and reset codes: short-lived, single-use codes created for email verification, password reset and handing a sign-in over to the app.

4Your aquarium

Your aquarium is kept on the server, tied to your account, and connected screens read it from there.

• Tank: its name, biome, size, pollution level, care mode, light and substrate settings, and decor layout.
• Fish: their species, the names you give them, their time of birth, hunger and health values; a record of fish you removed from the tank or that died in realistic mode.
• Event log: the type and time of actions such as feeding, cleaning and adding fish, and who performed them (you, a connected screen or the system).
• Wallet and entitlements: your coin balance, your coin movements (earnings, spending, daily rewards, gifts), the species and items you bought with coins, and your active subscription and content entitlements with their end dates.
• If you set up a tank on your phone before creating an account, that tank is moved to your account when you create one.

5Notifications

If you allow notifications, the app obtains a device token from your phone’s operating system and saves it to your account together with the platform (iOS or Android). This token is not an identity; it is the address a notification is delivered to.

Notifications are sent through Google’s Firebase Cloud Messaging on Android and Apple Push Notification service on iOS. These services process the device token and the text of the notification (for example, that your fish are hungry) in order to deliver it. The text is prepared on the server in your language; to enforce frequency limits, we record which notification was sent when and whether it was delivered.

You can turn notification permission off at any time in your phone’s settings. When you sign out, the app deletes the token from the server; if that request fails, the token stays on the server and deletion is attempted again at the next sign-out. It is also deleted when the notification provider reports that the token is no longer valid, and when you delete your account.

6Camera

Camera permission is requested only to read the pairing QR code shown on a television or in a browser, and it is optional; if you do not allow it, you can type the code by hand.

The camera image is processed on your phone: the app extracts only the six-digit code inside the QR code. No photo is taken, the image is not saved and it is not sent to any server. The microphone is not used.

7Screen pairing and connected screens

When you connect a television or a browser to your aquarium, a six-digit code and a QR code appear on the screen; you scan or type the code with your phone. The server stores the type of the screen (television, browser, casting device), the name you give the screen, if any, the aquarium it is connected to and when the screen was last seen.

The code is valid for five minutes and can be used once. After your phone approves it, a two-minute window remains for the screen to collect its key; the moment the screen collects the key, the code record is deleted.

The access key issued to the screen is stored on the server not in the clear but as an irreversible digest. The key itself exists only on the screen: the television apps keep it in the device’s secure key store, and the browser viewer keeps it in the browser’s local storage (localStorage), so that the screen does not ask to be paired again every time it starts.

A connected screen only displays; it cannot change your aquarium, make a purchase or reach your account details. The key becomes invalid by itself after ninety days, and you can end the connection from your phone at any time before that. The record of an ended connection is marked invalid rather than deleted, so that the same key cannot be used again.

8Purchases

Subscription and coin purchases are made through the App Store or Google Play, and the store takes the payment. Your card number, your bank details and your billing address never reach us.

We use RevenueCat, Inc. (United States) to verify purchases and apply them to your account. The app sends RevenueCat not your email address but the random identifier of your account with us and the store’s purchase information. Alongside that, RevenueCat’s software kit sends the technical information the service needs to work: operating system and app version, your language and currency, and on iOS the device’s tracking permission status — the last of these is sent even though the app never asks for tracking permission. The IP address of the request also reaches RevenueCat’s servers. We do not make the SDK call that collects the advertising identifier. RevenueCat in turn tells our server which product was bought, the type of the transaction and its end date; we use this to open your subscription and coin entitlements.

Deleting your account does not cancel your store subscription: the subscription is tied to your Apple or Google account and keeps renewing unless you cancel it. The cancellation steps are in the Cancellation and Refund Policy.

9Weather and aquarium location

If you give your aquarium a location, the latitude and longitude are stored with your aquarium so that the light in the tank can follow the weather outside. The app does not use your phone’s location service and asks for no location permission.

Our server sends these coordinates, rounded to roughly one kilometre, to Apple’s WeatherKit weather service once an hour; the service is operated by Apple Inc. (United States). The request leaves from our server; your name, email address or IP address is not passed to Apple — it only sees our server’s address. When you remove the location, the coordinates are deleted and the requests stop. Weather data is provided by Apple Weather; data sources: https://developer.apple.com/weatherkit/data-source-attribution/

10App updates

When it starts, the mobile app checks for and downloads small updates from the servers of Expo (650 Industries, Inc.). The request carries the app version and platform. The device identifier Expo uses to recognise an installation and the error text of a previous crash are blanked by the app, so update checks do not make your device trackable and do not send crash reports. As with any internet request, your IP address reaches Expo’s servers.

11Connection and security records

On every request made to our servers, the server software writes the IP address, the time of the request, the requested address and the response time into its technical log. These records are used to fix errors and to detect abuse.

The rate limiter that prevents abuse holds your IP address, your account identifier or the screen’s identifier as a temporary counter key that deletes itself after between one minute and one hour.

12Crash reports

When the mobile app crashes, hits an unexpected error, freezes for a long time or is closed by the operating system because memory ran out, it prepares a crash report so that we can find and fix the problem, and sends it to our own server. If the report cannot be sent at that moment, it waits on the phone and the app sends it the next time it opens.

A report contains: the error message and a technical trace showing where in the app’s code the error happened; the screens opened and the server requests the app made just before the error (with identifiers and query details removed from addresses); the app version and the number of the installed update; the device model, operating system and version, language and time zone settings, and the memory and storage state at that moment.

A report is not linked to your account: your account identifier, email address, name, anything you typed, screenshots and any identifier that permanently recognises the device are not added to it. When a report reaches the server, your IP address appears in the connection log as with any request; the crash report server stores only a truncated IP address, with its last part removed, alongside the report.

Reports go to LumaReef’s own server (hata.sazora.io, in older app versions hata.lumareef.net; Contabo GmbH infrastructure, European Union), not to a third-party service, and are deleted automatically after ninety days. We use them only to fix errors.

13What is kept on your phone

The mobile app keeps the records below on your phone in order to work. They are deleted when you remove the app; when you sign out, your session key and account summary are deleted as well.

• Your session key: in the phone’s secure key store (Keychain on iOS, Keystore on Android).
• Your account summary (your identifier, email address and name) and your selected aquarium, so that you do not have to wait when the app opens.
• Your interface language and camera view preferences.
• The last known state of your aquarium — tank, fish and decor layout: a copy is kept on the phone so that the app can open without an internet connection too, and a tank you set up without an account is kept in the same record. The three-dimensional models of the fish you have downloaded are also kept in the app’s cache directory, so that they are not downloaded again at every start.
• Crash reports that could not be sent yet: until they are sent the next time the app opens.
• A copy of the notification token, whether the introduction screens have been seen, whether the store rating request has been shown, and a usage counter that decides when that request is made.

14Purposes of processing and legal grounds

Every category of data is tied to a specific purpose and to one of the legal grounds in Article 5 of the KVKK. When the purpose ends, the processing ends with it.

• Creating your account, keeping you signed in, storing your aquarium and showing it on connected screens — necessary for the conclusion and performance of the contract (Article 5/2(c)).
• Verifying purchases, opening your subscription and coin entitlements, and handling refunds and cancellations — performance of the contract and legal obligation (Articles 5/2(c) and 5/2(ç)).
• Sending care reminders when you allow notifications and showing the weather in the tank when you set a location — performance of the contract (Article 5/2(c)). When you turn the permission off or remove the location, the processing stops.
• Fixing errors (including reviewing crash reports), blocking automated and abusive requests, and keeping accounts and the service secure — legitimate interest (Article 5/2(f)).
• Answering your support requests — performance of the contract and legitimate interest.
• Keeping the records required by tax legislation — legal obligation (Article 5/2(ç)).

15What we do not do

The list below is not a statement of intent; it describes the situation today. If it changes, this policy changes.

• We use no analytics, measurement or advertising network component; none of these is installed in the app, the viewer or the site. The crash reporter in the mobile app reports only the moment of an error; reports go to our own server, not to a third party, and are not linked to your account. Telemetry features that send data to the makers of the software we use are kept switched off.
• We collect no advertising identifier, device fingerprint or cross-site tracking identifier; the app does not ask for permission to track you across apps and websites.
• We do not read your phone’s location; the app asks for no location permission.
• We do not record or send the camera image, and we do not use the microphone.
• We do not sell or rent your personal data and we do not share it with advertising networks.
• We build no advertising profiles and we do no interest-based targeting.
• We send no marketing email without your explicit consent; account emails are only for verification and password reset.

16Who we share data with

Your data is shared only with the service providers needed for the Service to work, and only as far as needed. These providers process the data on our behalf and cannot use it for their own purposes; the app stores and sign-in providers are subject to their own policies in their relationship with you.

• Servers, database and storage: Contabo GmbH (Germany). Your account, your aquarium, your paired screens, your notification tokens, the connection records and crash reports are processed on this infrastructure; LumaReef’s servers run in this provider’s European Union data centre.
• Site and viewer hosting: Contabo GmbH (Germany), on the same infrastructure. When you open www.lumareef.net or tv.lumareef.net, your IP address reaches this provider; what you type on the account deletion page is passed to our server through this provider. The site’s server-side functions run on that same infrastructure in the European Union.
• Google LLC (United States): authentication for sign-in with Google and notification delivery on Android through Firebase Cloud Messaging. For purchases on Google Play, Google acts under its own policy and as a data controller independent of us.
• Apple Inc. (United States) and, for App Store distribution, Apple Distribution International Ltd. (Ireland): notification delivery on iOS through Apple Push Notification service, purchase transactions on the App Store and, when enabled, sign-in with Apple. Apple is subject to its own privacy policy in this relationship.
• RevenueCat, Inc. (United States): verification of in-app purchases and reporting of subscription status to our server. RevenueCat processes customer data only on its servers in the United States.
• 650 Industries, Inc. (Expo, United States): distribution of mobile app updates.
• Apple Inc. (Apple Weather / WeatherKit, United States): only if you gave your aquarium a location, a weather request with coordinates rounded to roughly one kilometre that are not linked to your identity.
• Email delivery provider: no sender is configured today and no account emails are sent at all. Once a provider is switched on, the provider that delivers the verification and password reset emails processes the recipient address and the content of the email; this policy will be updated with that provider’s name.
• Competent public authorities: only where legislation makes it mandatory and after the legal basis of the request has been verified.

17Transfer abroad

None of the providers listed above has servers in Türkiye. Your account, your aquarium, your notification tokens, your purchase status, your connection records and crash reports are processed in Contabo’s European Union data centre; the site’s server-side functions run on the same infrastructure, notification delivery happens at Google and Apple, purchase verification at RevenueCat in the United States, and the weather request is answered by Apple in the United States. These data are therefore transferred abroad within the meaning of Article 9 of the KVKK.

The Turkish Personal Data Protection Board has to date issued no adequacy decision for any country. The data processing terms of the providers we use rest on the European Commission’s standard contractual clauses (Implementing Decision 2021/914); Railway, Vercel and Google are in addition listed as active participants in the EU-US Data Privacy Framework. Only the records kept on your phone and on your screen are outside this transfer.

18Retention periods

Data is kept for as long as the purpose of processing requires and, once that period ends, for the limitation and retention periods laid down by legislation. At the end of the period it is deleted, destroyed or anonymised.

• Account and aquarium data (account details, aquariums, fish, event log, wallet and coin movements, entitlements, notification records, paired screens, notification tokens): for as long as your account exists; deleted immediately when you delete your account.
• Sessions: a session that is not used for seven days becomes invalid; when you sign out on a device, that device’s session is deleted, and when you delete your account, all of your sessions are deleted.
• Verification, reset and sign-in handover codes: invalid as soon as they are used or when their lifetime of between three minutes and one hour runs out.
• Pairing code: five minutes; the window for the screen to collect its key: two minutes. Screen access key: ninety days.
• Notification token: deleted when you sign out, when the provider reports that the token is invalid, or when you delete your account.
• Connection records: for as long as the hosting provider retains its logs; they are not archived separately on our side. Rate limiter counters delete themselves after between one minute and one hour.
• Crash reports: ninety days; since they are not linked to your account, they are deleted automatically when this period ends rather than when you delete your account.
• Financial records such as the sales and payment reports received from the stores: for the retention periods required by tax and commercial legislation.
• Purchase history at RevenueCat: for RevenueCat’s retention periods. Deleting your account does not delete this record automatically — our server makes no call to RevenueCat while deleting your account; you can request its deletion by writing to the address in the company details.
• Support correspondence: for as long as is needed to settle your request and to be able to answer a later objection; deleted once that period is over.
• Records on your phone: until you remove the app.

19Deleting your account

You can delete your account from the account screen of the app; this route works regardless of how you signed in. If you signed up with an email address and a password, you can also use www.lumareef.net/en/account/delete — that page currently allows signing in only with an email address and a password. Deletion cannot be undone and takes effect immediately; connected screens lose access at once.

Deleting your account does not cancel your store subscription; you need to cancel it separately in the store account you bought it with. Deletion removes the following in a single operation:

• Your account details, your password, your Google or Apple links and all of your sessions.
• All of your aquariums, fish, decor layouts and your event log.
• Your paired screens and your notification tokens.
• Your coin balance, your coin movements, the content you bought and your entitlements.
• The records of the notifications sent to you.

20Data security

All traffic between our servers and your devices is carried encrypted. Passwords, screen access keys and single-use sign-in codes are stored on the server not in the clear but as irreversible digests; the session key on your phone sits in the device’s secure key store.

No technical measure provides absolute security. If we determine that personal data has been unlawfully obtained by others, we notify the data subjects and the Personal Data Protection Board as soon as possible, in accordance with Article 12/5 of the KVKK.

21Children’s privacy

LumaReef is aimed at a general audience and does not knowingly collect personal data from children. If you are under eighteen, you may use the Service only with the permission and under the supervision of your parent or guardian.

If we learn that a child’s data is being processed without parental permission, we delete the record. If you notice such a situation, write to the address in the company details.

22Your rights under Article 11 of the KVKK

You may apply to the data controller to exercise the following rights in relation to your personal data.

• To learn whether your personal data is processed and, if it is, to request information about it.
• To learn the purpose of the processing and whether the data is used in line with that purpose.
• To know the third parties in Turkey or abroad to whom the data is transferred.
• To request that incomplete or incorrectly processed data be corrected.
• To request that the data be erased or destroyed within the conditions set out in the law.
• To request that correction, erasure and destruction operations be notified to the third parties to whom the data was transferred.
• To object to a result against you arising from analysis carried out solely by automated systems.
• To claim compensation if you suffer damage because the data was processed unlawfully.

23How to apply

You may send your application to the email address or the postal address in the company details, together with information that confirms your identity. We conclude your request free of charge within thirty days at the latest; if the operation has a separate cost, a fee from the tariff set by the Personal Data Protection Board may be charged.

If your application is refused, if you find our answer insufficient, or if you receive no answer in time, you may lodge a complaint with the Personal Data Protection Board within thirty days of learning the answer and in any case within sixty days of the date of the application.

24Changes to this policy

This policy may change as the Service develops. When we make a change, we update the “last updated” date at the top of the page; for an update that materially changes the purposes of processing or the parties data is shared with, we also give notice inside the app.

The text in force is always the text on this page.