Privacy Policy

Version 2026-11-02

Template: this is a starting point written for Lumora's features, not legal advice. Have a lawyer review it for your country and business before launch, and fill in the bracketed details.

This policy explains what Second Entertainment collects when you use Lumora, why, and the choices you have. Contact: secondentertainment@protonmail.com.

What we collect

Account: email, password (stored hashed by our authentication provider), username, display name, date of birth.
Profile: avatar, optional gender and country/region, about, mood, interests, privacy settings.
Activity: friends, messages, chat-room and forum posts, groups, stories and photos, invitations, gifts, purchases of credits/items, game scores, room designs, and when you were last online.
Safety: reports you send or that are made about you, moderation actions, and automated scan results for photos.
Age verification: if you verify, our provider (Stripe Identity) checks your ID and selfie. We don't store your ID images; we receive the result and your date of birth from the document to confirm you're 18+.
Device: basic technical data (browser, IP address in server logs), and push-notification tokens if you turn them on.

How we use it

To run Lumora: show your page to the people you allow, deliver messages, keep your wardrobe and credits.
To keep people safe: enforce the 18+ rule and community rules, review reports, scan photos for prohibited content.
To send account emails (confirmations, password resets) and, if you opt in, push notifications.

We don't sell your personal information. We don't show third-party ads.

Who can see what

Your name, username, avatar and badges are visible to signed-in members so they can find and report accounts. Everything else on your page follows your privacy setting (Public / Friends only / Verified adults only). Your birthday is never shown — only your age, and you can hide it. Messages are visible to the people in the conversation, and to moderators when reported.

Service providers

We use: Supabase (database, login, file storage), our hosting provider (e.g. Vercel), Stripe (identity checks and, if offered, payments), OpenAI's moderation API (photo scanning — images are not used to train models under their API terms), our email provider, and browser push services. They process data only to provide their service to us. [List regions where data is stored.]

How long we keep it

Stories disappear after 24 hours (photos are deleted from storage when you delete them). When you delete your account we delete your profile and content, except records we must keep for safety, legal or fraud-prevention reasons (for example reports and moderation logs) for [period].

Your choices and rights

Edit your profile and privacy settings, block people, turn notifications on or off, and delete your account in Settings.
Depending on where you live (for example the EU/UK under GDPR or California under the CCPA), you may have rights to access, correct, delete or export your data, and to object to some processing. Email secondentertainment@protonmail.com.

Security

Data is encrypted in transit, access is limited by strict database rules, and staff tools are restricted to moderators and admins. No system is perfectly secure; tell us at secondentertainment@protonmail.com if you find a problem.

Adults only

Lumora is not for anyone under 18. If we learn an account belongs to a minor we suspend it and delete it after review.

Changes

We'll post updates here and ask you to accept significant changes.