Children's privacy notice (not yet counsel-ratified)

Children use Luminara Adventure through a paired device profile under a grown-up account. There are no child-owned accounts. Parents and legal guardians exercise privacy rights on the child's behalf.

Child profiles store a server-generated play name (a pseudonym), the birth year a grown-up enters and the age band worked out from it (not a full date of birth), accessibility settings, sticker and progress state, and gameplay telemetry events.

Each record of play is tied to your child's play name and your account inside our service, so it is not anonymous. The ingest path persists child profile id, caregiver account id, subject token, session id, and a schema-bound payload. Inside the service those events are linkable to that child profile and the caregiver who manages it.

The app also creates a random install identifier on the device. When a grown-up pairs the child's device, and when that device renews the child's sign-in, the app sends it to our servers. It is not an advertising identifier or a vendor identifier. We use it only to tie the child's sign-in and the device's offline-ledger signing key to that device. It is pseudonymous and linkable to the child profile; it is not anonymous. It stays in the app's preferences on the device until the account's device data is cleared or the app is removed. On our servers it is held inside the identifier of that device's offline-ledger key and inside the child's sign-in token until that token expires. Removing the child profile or erasing the household deletes the key record.

• Real names, photos, or precise location
• Device contacts or advertising identifiers
• Biometric templates
• Child free-text unless a caregiver has explicitly opted in for that profile
• Behavioral advertising or third-party analytics on children

A caregiver must attest consent before a child profile is created. Gameplay telemetry requires that child's gameplay-telemetry consent. Withdrawal pauses telemetry without requiring full household erasure. The public-launch verifiable parental consent method is still under legal review.

Caregivers can export household records from the native app and can request erasure at /en/deletion or by emailing privacy@luminaraadventures.com if they have lost access. See the privacy notice for the implemented control set.