Lumipals
Privacy Policy
Last updated: November 14, 2026
- You can play Lumipals as a guest without giving us any personal information.
- If you choose to sign in with Google or Apple, we receive your name and email address (and, with Google, your profile picture). We use them only to create your account and save your game progress.
- We do not sell your data, show ads, or use tracking or advertising cookies.
- You can delete your account and all of its data at any time.
1. Who we are
Lumipals (“Lumipals”, “we”, “us”) is a free puzzle game available at lumipals.app and as an app you can add to your phone’s home screen. This policy explains what information Lumipals collects, how it is used, and the choices you have.
2. Information we collect
When you play as a guest: your progress (completed levels, stars, settings) is stored only in your browser’s local storage on your own device. It is not sent to us. The only thing the game sends is an anonymous count when a level is started, won, runs out of moves or is left unfinished (for example “level 4-6: +1 win”), with no account, device ID or other information about you.
When you sign in with Google, Google shares the following with Lumipals, with your permission:
| Data | Why we use it |
|---|---|
| Name | To show your name in the game, for example on your profile. |
| Email address | To identify your account and let you sign in on other devices. |
| Profile picture (URL) | To show your avatar in the game. |
| Google account ID | A unique number used to link your sign-ins to the same account. |
We only request these basic profile permissions. We cannot see your Google password, contacts, files, Gmail or any other Google data.
When you sign in with Apple, Apple shares your name (if you choose to share it), an email address and a unique Apple account ID. You can choose “Hide My Email”, in which case Apple gives us a private relay address instead of your real one. We use these only to create your account and let you sign in on other devices.
Game data linked to your account: levels completed, stars earned, number of moves, daily-puzzle streaks, your sparks, diamonds and helpers, and the dates and times these happened.
Purchases: if you buy diamonds, our payment partner Lemon Squeezy handles the payment and your card or payment details. We never see or store them. We receive and keep an order number, which pack you bought, the amount, the currency and the date, so we can add your diamonds and handle refunds.
Technical data: our hosting providers may automatically record standard technical information such as IP address, browser type and request times, for security and to keep the service running.
3. How we use your information
- To create and maintain your account and sign you in.
- To save your progress and sync it across your devices.
- To improve the game. For example, we look at overall statistics like “how many players finish level 12” to fix levels that are too hard. These statistics are anonymous totals per level and day and do not identify you.
- To keep the service secure and prevent abuse.
- To show the weekly top-players list. Signed-in players appear there only under a generated nickname (for example “Sunny Otter 42”) with their weekly score. Your name, email and picture are never shown.
We do not use your information for advertising, we do not sell or rent it, and we do not use it for automated decisions about you.
4. Google user data
Lumipals’ use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Information received from Google is used only to provide sign-in and account features in Lumipals, and is never transferred to others except as needed to provide those features (see section 5), to comply with law, or as part of a merger or acquisition with notice to you.
5. Who processes your data
We use a small number of trusted service providers, only to run the game:
- Supabase stores account and game-progress data and handles sign-in.
- Google provides “Sign in with Google”.
- Apple provides “Sign in with Apple”.
- GitHub Pages hosts the website and game files.
- Lemon Squeezy processes diamond purchases as our reseller (merchant of record), including payment, receipts, sales tax and refunds, under its own privacy policy.
These providers process data on our behalf under their own security and privacy commitments. We do not share your personal information with anyone else.
6. Cookies and local storage
Lumipals uses your browser’s local storage to keep your settings, your guest progress and, if you sign in, your login session. We do not use advertising or third-party tracking cookies.
7. How long we keep data
We keep your account and game data for as long as your account exists. When you delete your account, your personal information and game data are permanently deleted from our database within 30 days. Guest data stays on your device until you clear your browser data or uninstall the app.
8. Your choices and rights
- Play without an account: signing in is always optional.
- Delete your account: use Settings → Delete account in the game, or email us (section 11). This permanently removes your account and all associated game data.
- Access or correct your data: contact us and we will help.
- Revoke Apple access: on an Apple device, go to Settings → your name → Sign in with Apple, or visit account.apple.com.
- Revoke Google access: you can remove Lumipals’ access at any time from your Google Account connections page.
Depending on where you live (for example in the EU, UK or California), you may have additional rights, such as data portability or objecting to processing. Contact us to exercise them.
9. Children
Lumipals is suitable for all ages and contains no ads. The whole game can be played for free; optional diamond purchases require signing in, and we ask players under 18 to get a parent’s or guardian’s permission first. Children can play fully as guests without providing any personal information. Signing in with Google or Apple is intended for users old enough to have their own account under Google’s or Apple’s rules, or with a parent’s permission. If you believe a child has given us personal information without permission, contact us and we will delete it.
10. Security
Data is sent over encrypted connections (HTTPS) and stored with access controls, so each player can only read and change their own data. No method of storage is 100% secure, but we work to protect your information.
11. Contact us
For privacy questions or requests, including deleting your data, email us at ringhost@gmail.com. We aim to reply within 30 days.
12. Changes to this policy
If we change this policy, we will update the date at the top of this page. If the changes are significant, we will also tell you in the game.