Privacy Policy

1What this policy covers

This policy applies to the LumaReef mobile app, the LumaReef television apps, the LumaReef viewer that runs in a browser, and the promotional site at lumareef.app. Together they are referred to as the “Service”.

The policy serves as the disclosure notice required under Turkish Personal Data Protection Law No. 6698 (KVKK). The identity of the data controller appears in the company details at the top of this page.

2The short answer: what happens today

LumaReef is designed not to collect more data than it needs in order to work. The length of this policy does not mean that we process a lot of data; it is long because it also states what we do not process.

Your aquarium — your tank, your fish, the names you give them, your layout and your language preference — is kept in your phone’s own storage. When you delete the app, this data is removed from the device.

The promotional site writes no cookies and does not track visitors. The app has no analytics tool, no crash reporter and no advertising identifier. No location data is collected; the app requests no camera, microphone, location, contacts or photo permission.

The only features that talk to our servers are screen pairing and, once it goes live, in-app purchase. The sections below set out the detail of those two.

3Data kept on your device

The mobile app keeps three records and all three stay only on your device. They are not sent to us.

• The state of your aquarium: tank dimensions, biome, pollution, the species you have added, the names you give your fish, hunger and health values, decor placement.
• Your camera view preference.
• Your interface language preference.

4Data that reaches the server

The data below reaches our servers only when you use the relevant feature.

• Pairing data: the six-digit code generated while you connect a screen, the type of the screen (television, browser, casting device) and the name you give the screen, if any. Your phone’s identity, its model information and its advertising identifier are not part of this flow.
• Screen access key: the key issued to the connected screen. The server stores an irreversible digest of the key, not the key itself.
• Connection records: on every request made to our servers, the server software writes the IP address, the time of the request and the requested address into its technical log. The same IP is also held as a temporary sixty-second counter key in the rate limiter that prevents abuse.
• Purchase status: once in-app purchase goes live, the notification from the store is used to process which entitlement was opened on which account and the end date of that entitlement. Your card number, your bank details and your billing address never reach us; the payment is taken by the App Store or Google Play.
• Support correspondence: the email address you share and the content of your message when you write to us directly.

5Purposes of processing and legal grounds

Every category of data is tied to a specific purpose and to one of the legal grounds in Article 5 of the KVKK. When the purpose ends, the processing ends with it.

• Establishing screen pairing and showing your aquarium on the connected screen — necessary for the conclusion and performance of the contract (Article 5/2(c)).
• Verifying that a purchase is valid, opening the subscription entitlement, and handling refund and cancellation requests — performance of the contract and legal obligation (Articles 5/2(c) and 5/2(ç)).
• Fixing errors, blocking automated and abusive requests, and keeping the service secure — legitimate interest (Article 5/2(f)).
• Answering your support requests — performance of the contract and legitimate interest.
• Keeping the records required by tax legislation — legal obligation (Article 5/2(ç)).

6What we do not do

The list below is not a statement of intent; it describes the situation today. If it changes, this policy changes.

• We use no analytics, measurement, crash reporting or advertising network component. None of these is installed in the app or on the site.
• We collect no advertising identifier, device fingerprint or cross-site tracking identifier.
• We collect no location data. The app requests no location permission.
• We do not sell or rent your personal data and we do not share it with advertising networks.
• We build no advertising profiles and we do no interest-based targeting.
• We send no marketing email without your explicit consent.
• We send no notifications; the app requests no notification permission.

7Screen pairing and viewer screens

When you connect a television or a browser to your aquarium, a six-digit code appears on the screen and you type that code into your phone.

The code is valid for five minutes and can be used once. After your phone approves it, a two-minute window remains for the screen to collect its key; the moment the screen collects the key, the code record is deleted.

The connected screen only displays. It cannot change your aquarium, make a purchase or reach your account details. Control sits in one place: the app on your phone.

The screen’s access key becomes invalid by itself after ninety days. You can also end the connection at any time before that; the record of an ended connection is marked invalid rather than deleted, so that the same key cannot be used again.

8Who we share data with

Your data is shared only with the service providers needed for the Service to work, and only as far as needed. Those providers cannot use the data for their own purposes.

• Application servers and database: Railway Corp. (United States). Screen pairing and purchase verification run on this infrastructure.
• Promotional site and viewer hosting: Vercel Inc. (United States). When you open the site or a connected screen, your IP address reaches this provider’s servers.
• App stores: Apple Inc. and Google LLC. Purchase and subscription transactions take place in their systems; only whether the transaction is valid comes back to us.
• Subscription infrastructure: once in-app purchase goes live, RevenueCat, Inc. (United States) comes into play and relays store notifications to us. As of the last update date of this document, purchasing is not live.
• Competent public authorities: only where legislation makes it mandatory and after the legal basis of the request has been verified.

9Transfer abroad

The servers of the providers listed above are located outside Turkey. Pairing data, connection records and purchase status are therefore transferred abroad within the meaning of Article 9 of the KVKK.

The transfer is made under safeguards such as undertakings that provide adequate protection and standard contractual clauses. The aquarium data that stays on your device is outside this transfer; it never leaves for the server.

10Retention periods

Data is kept for as long as the purpose of processing requires and, once that period ends, for the limitation and retention periods laid down by legislation. At the end of the period it is deleted, destroyed or anonymised.

• Pairing code: five minutes. The window opened for the screen to collect its key: two minutes.
• Screen access key: ninety days. When you end the connection, the key becomes invalid immediately.
• Connection records: for as long as the hosting provider retains its logs; they are not archived separately on our side. The IP counters in the rate limiter are deleted by themselves after sixty seconds.
• Purchase and invoice records: ten years, as required by tax legislation.
• Support correspondence: two years from the closing of the request.
• The aquarium data on your device: until you delete it or remove the app. The reset option in the app deletes this data from the device.

11Data security

All traffic between our servers and your device is carried encrypted. The access keys of screens are not stored in the clear on the server but as irreversible digests; the key itself exists only on the screen.

No technical measure provides absolute security. If we determine that personal data has been unlawfully obtained by others, we notify the data subjects and the Personal Data Protection Board as soon as possible, in accordance with Article 12/5 of the KVKK.

12Children’s privacy

LumaReef is aimed at a general audience and does not knowingly collect personal data from children. If you are under eighteen, you may use the Service only with the permission and under the supervision of your parent or guardian.

If we learn that a child’s data is being processed without parental permission, we delete the record. If you notice such a situation, write to the address in the company details.

13Your rights under Article 11 of the KVKK

You may apply to the data controller to exercise the following rights in relation to your personal data.

• To learn whether your personal data is processed and, if it is, to request information about it.
• To learn the purpose of the processing and whether the data is used in line with that purpose.
• To know the third parties in Turkey or abroad to whom the data is transferred.
• To request that incomplete or incorrectly processed data be corrected.
• To request that the data be erased or destroyed within the conditions set out in the law.
• To request that correction, erasure and destruction operations be notified to the third parties to whom the data was transferred.
• To object to a result against you arising from analysis carried out solely by automated systems.
• To claim compensation if you suffer damage because the data was processed unlawfully.

14How to apply

You may send your application to the email address or the postal address in the company details, together with information that confirms your identity. We conclude your request free of charge within thirty days at the latest; if the operation has a separate cost, a fee from the tariff set by the Personal Data Protection Board may be charged.

If your application is refused, if you find our answer insufficient, or if you receive no answer in time, you may lodge a complaint with the Personal Data Protection Board within thirty days of learning the answer and in any case within sixty days of the date of the application.

15Changes to this policy

This policy may change as the Service develops. When we make a change, we update the “last updated” date at the top of the page; for an update that materially changes the purposes of processing or the parties data is shared with, we also give notice inside the app.

The text in force is always the text on this page.