Privacy Policy

• 1. Who is responsible for your data
• 2. What we collect and where it is stored
• 3. Legal bases explained
• 4. How long we keep data
• 5. Recipients and processors
• 6. Transfers outside the EEA
• 7. Your rights and how to use them
• 8. Complaints to a supervisory authority
• 9. Security
• 10. Personal data breaches
• 11. Children
• 12. No automated decisions, profiling or data sales
• 13. Changes to this policy
• 14. Contact

1. Who is responsible for your data

The controller of personal data processed through LumenStride (lumenstridee.com) within the meaning of Article 4(7) of the General Data Protection Regulation (EU) 2016/679 ("GDPR") is:

Juggler Games has not appointed a Data Protection Officer, because the limited processing described on this page does not require one under Article 37 GDPR. All questions and requests about personal data are handled through [email protected], which is read by the people responsible for data protection at Juggler Games.

LumenStride is a free social and educational games website. Everything on it runs on virtual credits that have no monetary value and cannot be bought, sold, transferred or exchanged. Because there are no payments, we never ask for bank details, card numbers, identity documents or a postal address.

2. What we collect and where it is stored

We have designed LumenStride so that as much as possible stays on your own device. The table below lists every category of personal data involved, where it comes from, where it is kept, why, on which legal basis and for how long.

Data	Source	Where it is stored	Purpose	Legal basis	Retention
Language choice (lms_lang cookie and lms_lang localStorage key)	You, when you pick a language or open a ?lang= link	Your browser only (first-party cookie and localStorage)	Show the site in your language	Art. 6(1)(f) – legitimate interest in a working, multilingual site	Cookie: 12 months; localStorage: until you clear it
Age confirmation and storage notice choice (lms_age_ok, lms_consent)	You, by clicking the confirmation and notice buttons	Your browser only (localStorage)	Remember that you confirmed you are 18+ and what you chose in the storage notice	Art. 6(1)(f) – showing the site only to adults and recording your choice; Art. 6(1)(a) for any optional storage you agree to	Until you clear it or reset your choice
Virtual credit balance and free refill status (lms_credits, lms_free_refill_used)	Generated as you play	Your browser only (localStorage)	Keep your practice balance between visits	Art. 6(1)(b) – providing the free service you asked for	Until you clear it
Optional profile: display name, email address and password (lms_user, lms_users)	You, on the registration form	Your browser only (localStorage). The password never leaves your browser and is never sent to our server	Let you sign in on this device	Art. 6(1)(b) – providing the optional account	Until you delete it or clear your browser data
Email address with timestamp and salted SHA-256 hash of your IP address	You, on the registration form	Our server, in a private text file that is not publicly accessible	Keep a record of the account and prevent misuse of the form	Art. 6(1)(b) for the account record; Art. 6(1)(f) for the IP hash (abuse prevention)	Until you ask for deletion or after 24 months of inactivity
Email address with timestamp and salted SHA-256 IP hash, plus a local marker (lms_unsub)	You, on the unsubscribe form	Our server (private text file); marker in your browser	Honour and remember your request not to receive email	Art. 6(1)(f) – respecting your choice and proving we did	Until you ask for deletion or after 24 months of inactivity
Messages you send us by email (address, name if given, content)	You, via your own email program (the contact page opens it with a mailto link)	Our mailbox at our email provider	Answer your question or request	Art. 6(1)(f) – replying to you; Art. 6(1)(b) where it concerns your account	As long as needed to resolve the matter, then deleted, normally within 24 months
Technical connection data: IP address, date and time, requested page, browser type	Your browser, automatically	Server and CDN log files at our hosting and CDN providers	Deliver pages, keep the service secure, detect attacks	Art. 6(1)(f) – security and stable operation	A short period set by the provider, after which logs are deleted or overwritten
IP address and browser data sent when fonts load	Your browser, automatically	Google (fonts.googleapis.com, fonts.gstatic.com)	Display the site typefaces	Art. 6(1)(f) – consistent, readable design	According to Google's own policies

Things we deliberately do not do

• No analytics tools, no advertising networks, no social media pixels and no third-party trackers.
• No marketing emails. We do not currently send newsletters. If we ever introduce one, it will be strictly opt-in, and you will be asked separately.
• No contact form that sends data to us. The contact page simply opens your own email program; nothing is transmitted by the website itself.
• No storage of your raw IP address in our own files. We keep only a one-way, salted SHA-256 hash, which cannot reasonably be turned back into the address.

Data kept in localStorage stays on your device. We cannot see it, read it or delete it remotely. You can remove it at any time by clearing your browser's site data for lumenstridee.com, or by using the reset button described in our Cookie Policy, which also lists every cookie and storage key in detail.

3. Legal bases explained

The GDPR only allows processing when one of the grounds in Article 6(1) applies. We rely on three:

• Contract – Art. 6(1)(b). When you use the free practice features or create the optional account, we process the data needed to provide them, such as your credit balance and the email address linked to your account.
• Legitimate interests – Art. 6(1)(f). We have a legitimate interest in running a secure, working website in several languages, keeping it for adults only, preventing abuse of our forms, answering messages and respecting unsubscribe requests. We have weighed these interests against your rights. The data involved is minimal, expected by visitors and largely kept on your own device, so we consider that your interests do not override ours. You may object at any time (see section 7).
• Consent – Art. 6(1)(a). Where we ask for your agreement, for example for optional storage in the notice shown on your first visit or for any future newsletter, the basis is your consent. Consent is voluntary, and you can take it back at any time without affecting what happened before.

Storing and reading the lms_lang cookie and the localStorage keys listed above is strictly necessary to provide the service you request, which is why it does not require prior consent under the ePrivacy rules as implemented in Polish law.

You are not legally or contractually obliged to give us any personal data. Without an email address you simply cannot create the optional server record; all practice features remain available without it.

4. How long we keep data

• Browser storage (localStorage): until you delete it, clear your browser data or use the reset button. We have no access to it.
• lms_lang cookie: 12 months from when it was last set.
• Email record on our server (registration or unsubscribe): until you ask us to delete it, or automatically after 24 months without activity, whichever comes first. For unsubscribe requests, we may keep the bare email address for as long as necessary to make sure we never contact you, which is in your own interest.
• Email correspondence: for as long as needed to deal with your request, normally deleted within 24 months after the matter is closed, unless the law requires us to keep it longer or it is needed to defend a legal claim.
• Server and CDN logs: a short period set by our hosting and CDN providers for security purposes, after which they are automatically deleted or overwritten.

5. Recipients and processors

We do not share personal data with anyone for their own marketing. The only recipients are service providers we need to run the site:

• Hosting provider – stores our website files and the private email file, and keeps short-term server logs. It acts as our processor under a data processing agreement in line with Article 28 GDPR.
• Content delivery network (CDN) – delivers pages quickly and protects the site against attacks; it necessarily handles your IP address and may log it briefly for security. It also acts as our processor.
• Email provider – hosts our mailboxes, including [email protected], so that we can receive and answer your messages.
• Google (Google Fonts) – when a page loads, your browser requests typefaces from fonts.googleapis.com and fonts.gstatic.com. This transmits your IP address and basic browser information to Google Ireland Limited and Google LLC.

We may also disclose data to public authorities where a binding legal obligation requires it. You can ask us at [email protected] for the names of our current hosting, CDN and email providers.

6. Transfers outside the EEA

We aim to keep data within the European Economic Area. The one known exception is Google Fonts: Google may process the IP address it receives on servers in the United States. Google LLC is certified under the EU-US Data Privacy Framework, which the European Commission recognised as providing an adequate level of protection in its decision of 10 July 2023 (Art. 45 GDPR). In addition, Google uses the European Commission's Standard Contractual Clauses (Art. 46(2)(c) GDPR) as a safeguard. If any of our other providers ever transfers data outside the EEA, we will make sure that an adequacy decision or Standard Contractual Clauses apply. You can request a copy of the relevant safeguards by writing to [email protected].

7. Your rights and how to use them

Under Articles 15 to 21 GDPR you have the following rights:

• Access (Art. 15) – to find out whether we process your data and to receive a copy of it, along with information about how it is used.
• Rectification (Art. 16) – to have inaccurate data corrected or incomplete data completed.
• Erasure (Art. 17) – to have your data deleted ("right to be forgotten"), for example when it is no longer needed or you have objected to its processing.
• Restriction (Art. 18) – to ask us to keep your data but not otherwise use it, for example while we check a disputed point.
• Data portability (Art. 20) – to receive data you gave us under a contract or consent in a structured, commonly used, machine-readable format, or to have it sent to another controller where technically feasible.
• Objection (Art. 21) – to object at any time, on grounds relating to your particular situation, to processing based on our legitimate interests. We will then stop unless we have compelling legitimate grounds or need the data for legal claims.
• Revoking consent (Art. 7(3)) – to take back any consent you have given, at any time and as easily as you gave it, without affecting the lawfulness of earlier processing.

Article 22 GDPR (automated individual decisions) does not apply, because we do not make any such decisions (see section 12).

How to exercise your rights

Send an email to [email protected], ideally from the address you used on LumenStride, and tell us which right you want to use. Because the only server-side data we hold is your email address with a timestamp and an IP hash, writing from that address is usually all we need to confirm it is you. If we have reasonable doubts, we may ask for a little more information, but never for identity documents beyond what is necessary.

We will answer without undue delay and at the latest within one month of receiving your request. In complex cases or where we receive many requests, this period can be extended by up to two further months; we will tell you within the first month if that happens and why. Exercising your rights is free of charge.

Data stored in your browser is fully under your control: you can view, change or delete it yourself at any time through your browser settings or the reset button in the Cookie Policy.

8. Complaints to a supervisory authority

If you believe we are processing your personal data unlawfully, you have the right to lodge a complaint with a supervisory authority (Art. 77 GDPR). The authority responsible for Juggler Games is:

You may also complain to the supervisory authority of the EU or EEA member state where you live, where you work, or where the alleged infringement took place. We would appreciate the chance to resolve your concern first, so please feel free to contact us at [email protected], although this is never a precondition.

9. Security

We protect personal data with technical and organisational measures appropriate to the small amount and low sensitivity of the data we hold:

• The whole site is served over encrypted HTTPS connections.
• The email file is stored outside the public web directory, is not linked from anywhere and is protected against direct access.
• IP addresses are stored only as salted SHA-256 hashes, never in plain form, in our own files.
• Passwords for the optional profile never reach our server at all.
• Access to the server and mailboxes is limited to the few people at Juggler Games who need it and is protected by strong authentication.
• We collect no payment data, no identity documents and no special categories of data.

Data in your browser is only as secure as your device. On shared computers, use the sign-out function and clear site data when you finish.

10. Personal data breaches

If a personal data breach occurs, we will notify the President of UODO without undue delay and, where feasible, within 72 hours of becoming aware of it, unless the breach is unlikely to result in a risk to your rights and freedoms (Art. 33 GDPR). Where a breach is likely to result in a high risk to you, we will also inform you directly, without undue delay, in clear language, explaining what happened, the likely consequences and the steps we have taken or recommend (Art. 34 GDPR). We document every breach, whether or not it has to be reported.

11. Children

LumenStride is intended for adults only. You must be at least 18 years old to use the site, and we ask every visitor to confirm this. We do not knowingly collect personal data from anyone under 18. If you believe a minor has given us an email address, please write to [email protected] and we will delete it promptly.

12. No automated decisions, profiling or data sales

We do not make decisions based solely on automated processing that produce legal or similarly significant effects for you, and we do not create profiles of your behaviour or interests. Your practice rounds and virtual credit balance are not linked to you as a person and are not used to evaluate you in any way. We do not sell, rent or trade personal data, and we do not share it with advertisers or data brokers.

13. Changes to this policy

We may update this policy when the site, the law or our providers change. The date at the top of the page always shows the latest version. If we make a significant change, for example introducing a new purpose or a new type of provider, we will point it out clearly on the site before it takes effect and, where the law requires it, ask for your consent again.

14. Contact

See also our Cookie Policy, Terms & Conditions and Contact page.