This Privacy Policy explains how Luma Play handles personal data when you use Marble Sudoku, Pixel Bomb, Clay Gallery, our websites, support channels, and related services (“Services”). Features and providers differ by game, platform, region, age, and your choices; this Policy identifies those differences.
1. Controller and contact
Luma Play UG (haftungsbeschränkt)
Wiesbadener Str. 3, 45145 Essen, Germany
Commercial register: Amtsgericht Essen, HRB 37485
Managing Director: Alla Kuznetsova
Email: team@luma-play.com
Luma Play is normally the controller for game data described here. App stores, platform-account providers, advertising partners, and portals may also process data as independent controllers under their own privacy notices.
2. Scope and age requirement
The Services are for users aged 13 or older. We use a neutral age-range screen before optional advertising and telemetry services start. A selected age range is stored rather than a full date of birth. On supported Android versions, Google Play may provide an age band or supervision signal; we use such signals only to enforce legal and age-appropriate access requirements. A user who indicates an age below 13 is not permitted to continue.
3. Information we process
a) Information stored on your device
Game progress, puzzle state, settings, language, accessibility choices, age range, consent status, acceptance version and time, entitlements, and local notification preferences may be stored locally. Local data normally remains on the device unless a cloud, leaderboard, support, or portal feature sends specified data online. Removing the app may remove local data, subject to operating-system backups.
b) Online game and platform features
Depending on the game and platform, we may process a pseudonymous or platform player ID, display name, selected country or avatar, scores, achievements, cloud-save progress, entitlement status, timestamps, and integrity or anti-fraud information. Leaderboard display names, country flags, scores, and ranks may be public inside the relevant game. We do not require a Luma Play email/password account; however, anonymous Unity profiles, Google Play Games, Apple Game Center, or CrazyGames accounts may be used.
c) App configuration, analytics, and diagnostics
Where enabled and permitted, Firebase services may process a Firebase installation ID, IP address, app and device information, language, approximate country, session and gameplay events, purchase/entitlement events, crash traces, diagnostics, and technical logs. Remote Config supplies settings and feature values; it may create a Firebase installation identifier even when analytics events are not collected. Crash reports may include device state and recent diagnostic context, but we instruct our games not to send free-form personal content in diagnostics.
d) Advertising and attribution
On ad-supported mobile versions, advertising providers may process IP address, device and app information, advertising or device identifiers where permitted, approximate location derived from IP, consent strings, age-restriction flags, ad requests, impressions, clicks, and fraud signals. Tenjin may process campaign and attribution data to measure installs and purchases where tracking is legally permitted. We configure age and consent restrictions and request contextual/non-personalised ads when required. We do not sell personal data for money. In some US states, personalised advertising may legally be considered “sharing”; you may opt out through the in-game privacy options or device/platform settings.
e) Push and local notifications
Marble Sudoku and Pixel Bomb may use Firebase Cloud Messaging on supported mobile platforms. If you allow notifications, Firebase and the operating-system provider process a push token, app/device information, and delivery data. Clay Gallery also uses locally scheduled notifications that remain on the device. You can disable notifications in the game or system settings.
f) Purchases
Google Play, Apple, or another platform processes payment details. We receive limited purchase information such as product ID, transaction or receipt identifier, purchase state, platform, and entitlement needed to deliver and restore the purchase. We do not receive full card or bank details.
g) Website, feedback, and support
When you visit our website, hosting and embedded-resource providers may receive IP address, browser/device information, requested URL, referring page, and timestamps in technical logs. When you contact us or submit feedback, we process the message, optional email/name, attachments, and diagnostic details you provide. Do not send sensitive personal information that is not needed to resolve your request.
4. Which services each game uses
Providers are included only on relevant platforms and may be disabled by age, consent, premium status, regional configuration, or build type.
| Game | Mobile versions | CrazyGames / Web version |
|---|---|---|
| Marble Sudoku | Firebase Remote Config, Analytics, Crashlytics and Cloud Messaging; Unity Gaming Services for anonymous authentication, Cloud Save and leaderboards; Google Play Games or Apple Game Center where enabled; Unity LevelPlay advertising (including enabled demand partners such as Google AdMob, Unity Ads and Mintegral); Tenjin attribution; Google Play or Apple purchase services. | CrazyGames SDK for portal operation, ads, identity information supplied by the portal, and portal Data storage. Marble’s online leaderboard services may also use Unity Gaming Services where enabled. Mobile advertising, Firebase telemetry, Tenjin and mobile stores are not used in the portal build. |
| Pixel Bomb | Firebase Remote Config, Analytics, Crashlytics and Cloud Messaging; Google Play Games or Apple Game Center cloud features; mobile advertising mediation and enabled ad partners; Tenjin attribution; Google Play or Apple purchase services. | CrazyGames SDK for portal operation, ads, identity information supplied by the portal, and portal data storage. Mobile SDK paths are disabled in the portal build. |
| Clay Gallery | Firebase Remote Config, Analytics and Crashlytics; Google Play Games cloud save and achievements on Android where enabled; Unity LevelPlay advertising and enabled ad partners; Tenjin attribution; Google Play or Apple purchase services; on-device local notifications. | CrazyGames SDK for portal operation, ads, identity information supplied by the portal, and portal data storage. Mobile SDK paths are disabled in the portal build. |
5. Purposes and legal bases
- Contract: provide gameplay, purchases and entitlements, selected cloud saves, leaderboards, requested support, and platform features.
- Legitimate interests: secure and operate the Services, prevent fraud and cheating, diagnose faults, maintain aggregate performance, and improve gameplay, where those interests are not overridden by your rights.
- Consent: store/access information where required, personalised advertising, tracking/attribution, optional analytics, and notifications. You may withdraw consent prospectively.
- Legal obligations: accounting, tax, consumer requests, law-enforcement obligations, and protection of legal claims.
6. Age, consent, and privacy choices
Age selection is an eligibility and privacy control, not marketing consent. Users aged 13–15, and other users who are below the applicable digital-consent age, receive a restricted configuration: optional analytics and attribution are disabled, tracking is not requested, and any permitted ads are limited to age-appropriate contextual treatment. Users old enough to decide may receive Google’s consent flow and, on iOS, Apple’s tracking prompt where applicable. Refusing personalised ads or tracking does not block access to core gameplay.
Where available, open Settings → Privacy Options to review advertising choices. You can also reset the advertising identifier, limit tracking, withdraw app permissions, or disable notifications in device settings. Withdrawal does not affect processing already lawfully performed.
7. Recipients and provider information
We disclose data only as needed to operate the purposes above: hosting/support vendors; Google/Firebase and Google Play; Apple; Unity and LevelPlay; enabled ad partners; Tenjin; CrazyGames; professional advisers; authorities where legally required; and a successor in a merger or transfer with appropriate safeguards. Provider details may be reviewed at Firebase Privacy, Unity Player Privacy, Google Privacy, Apple Privacy, Tenjin Privacy, and CrazyGames Privacy. The consent form may show the current list of ad partners for your region.
8. International transfers
Some recipients process data outside Germany, the EEA, Switzerland, or the UK, including in the United States. Where required, transfers rely on an adequacy decision, the EU–US Data Privacy Framework for participating organisations, standard contractual clauses, or another lawful safeguard. You may contact us for information about applicable safeguards.
9. Retention
- Local game and privacy choices remain until changed, cleared, or removed with app data.
- Cloud progress and anonymous service profiles remain while the feature/profile is active and until deletion, subject to limited backup and fraud-prevention retention.
- Leaderboard entries remain for the relevant competition/history period or until deletion where applicable; anti-cheat records may be retained as needed to protect fair play.
- Analytics, attribution, advertising, crash, portal, and platform data follow our configured periods and the relevant provider’s retention rules; we periodically review whether continued retention is necessary.
- Support correspondence is normally kept until the request is resolved and for a reasonable limitation period afterward. Transaction and accounting records are retained for statutory periods.
10. Your rights
Subject to applicable law, you may request access, correction, deletion, restriction, portability, or objection; withdraw consent; and lodge a complaint. To help locate game data, include the game, platform, player/support ID if available, and country, but never send a password or full payment details. Use our Data Deletion page or email team@luma-play.com. We may verify the request and cannot delete data controlled solely by a store or platform; use that provider’s tools as well.
You may complain to your local supervisory authority or our competent German authority: Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (LDI NRW), www.ldi.nrw.de.
11. Security
We use organisational and technical safeguards appropriate to the risk, including access controls, transport encryption, integrity-protected local saves where implemented, vendor controls, and data minimisation. No system is completely secure. Keep your device and platform account protected and contact us if you suspect misuse.
12. Children
We do not knowingly permit children under 13 to use the Services or knowingly collect their personal data through them. If you believe a child under 13 has provided data, contact us so we can investigate and delete it where appropriate. Content ratings such as PEGI 3 or “Everyone” describe content suitability and do not change the 13+ eligibility rule.
13. Automated decisions
We do not make decisions based solely on automated processing that produce legal or similarly significant effects on you. Automated anti-cheat or fraud signals may flag activity for restriction or review.
14. Changes to this Policy
We may update this Policy when our Services, providers, or legal duties change. We will update the date and, where required, provide notice or request a new choice before materially different optional processing begins.