Privacy Policy

This privacy policy describes how S4F LLC (“we”, the “publisher”) collects, uses, and protects your personal data when you use the Luma TCG app and website (“the Service”).

S4F LLC — 5830 E 2nd St, Ste 7000 #36802, Casper, WY 82609, USA. Contact: contact@lumatcg.com.

Data we collect

We only collect the data necessary to operate the Service:

• •Account: email address and authentication information when you create your account; if you sign in with Google or Apple, the identifier and email address that service sends us.
• •Profile: username, display name, profile picture, and preferences you provide.
• •Collection: cards, quantities, wishlists, and portfolio data you add.
• •User-generated content: marketplace listings, private messages, stories, comments, and posts. On the website, the contact and blog comment forms collect the name, email address and message you enter, and the waitlist collects your email address; for messages and comments, the sending IP address is kept only as a non-reversible fingerprint (hash), to fight abuse.
• •Photos: images you take or upload (card scanner, centering estimate, profile picture, stories, message attachments, listing photos).
• •Purchases: “Luma Pro” subscription history. On iOS and Android, payment is processed by the store. On the web, it is processed by our payment provider Stripe, via RevenueCat — we never see or store your card number.
• •Diagnostics: crash and error reports, technical data (device model and operating system, app version, screens visited before the error) and performance measurements on a sample of sessions, to fix bugs. These reports are not linked to your account (only a technical installation identifier may appear in them).
• •Usage, only with your consent: (1) an internal usage log, linked to your account or to your anonymous guest session (and connected to your account if you create one after using the app as a guest). It records in particular the screens you view and for how long, scans, additions to your collection, views of the Pro offer, sign-ups, logins and purchases, as well as your social and collection actions (posts, comments, messages, listings, shares, wishlists, price alerts), without their content: no text, photo or recipient; a listing only carries its price and the card’s condition. The platform and app version are added. This log is stored with our hosting provider (Supabase); (2) with the same consent, the same events feed the PostHog usage analytics and, on the web, the Google Analytics audience measurement described below. Without your consent (refusal, withdrawal or no choice recorded), nothing is written to this log and nothing is sent to PostHog or Google Analytics.

How we use your data

• •Provide and maintain your account and the Service’s features.
• •Recognize the cards you scan and estimate the value of your collection. Unless you object (Settings → “Help improve the scanner”), the photo of each card you scan or grade is kept in a private space, together with the recognition result, to improve the accuracy of our scanner.
• •Operate the marketplace, trades, messaging, and social features.
• •Manage your subscription and “Luma Pro” entitlements.
• •Ensure security, prevent fraud, and fix malfunctions.
• •Send you notifications you have enabled.

Sharing with third parties (processors)

We never sell your data. We use providers that process it on our behalf to operate the Service:

• •Supabase (servers in the European Union, in Ireland): database, authentication, server functions and storage of private files.
• •Cloudflare: hosting of the website and the web app, content delivery network (CDN), image storage (profile, listing and message photos) and anti-bot protection (Turnstile).
• •RevenueCat: management of subscriptions and Luma Pro access rights.
• •Payment processing: in-app purchases via the app stores on mobile, and Stripe Payments Europe for subscriptions and gifts paid by card on the web app.
• •Sentry (servers in the European Union, in Germany): crash reports and technical diagnostics.
• •Usage and audience measurement, only with your consent: PostHog (servers in the European Union) for the app, on mobile and on the web, and Google Analytics 4, provided by Google Ireland Limited, for the website and the web app. See the “Cookies and audience measurement” section.
• •Optical character recognition (OCR) of the cards you scan: Google Cloud Vision (Google). The cropped image of the card is sent to it to read its text; the app recreates this image before sending it, so it carries no EXIF metadata such as geolocation.
• •Delivery of push notifications (Expo, then Apple or Google) and sending of account and service emails, such as sign-in codes (Resend).

Cookies and audience measurement

No non-essential cookie or tracker is set before you consent: until you accept, no measurement data is sent to an audience measurement service and no measurement cookie is written (ePrivacy Art. 5(3)).

We set one strictly necessary cookie, “luma-consent”, which stores your choice for 180 days so you are not asked again on every page. It holds nothing but that choice and does not require your consent.

If you accept, we use Google Analytics 4, provided by Google Ireland Limited, to measure site audience. It sets the “_ga” and “_ga_<id>” cookies, kept for 13 months at most, and your IP address is anonymised. This data may be transferred outside the European Economic Area, relying on the European Commission’s standard contractual clauses and the EU–US Data Privacy Framework to which Google adheres. The legal basis for this processing is your consent (GDPR Art. 6(1)(a)).

You can change your mind at any time, as easily as you gave your consent (GDPR Art. 7(3)): from Settings → “Usage analytics” in the app, or from the “Manage cookies” link in the site footer. As soon as you withdraw, nothing more is sent to PostHog or Google Analytics, session recording stops, nothing more is written to the usage log (including anything still waiting to be sent) and the Google Analytics cookies are deleted. Withdrawal does not erase what has already been collected: that data follows the periods in the “Data retention” section, and you can ask us to erase it at any time.

With your consent, PostHog (servers in the European Union) receives the screens you view, the actions you take, their duration, scanner results and a pseudonymous account identifier. No session recordings (“replays”) are made; those made before 2 November 2026 are erased after 30 days. It does not keep your IP address. In the web app, it derives an approximate location (country, city) from it; in the mobile app this is turned off. We send no email addresses, messages, card photos or OCR text in events. Your choice is stored on your device (or in your browser) for 180 days; with no choice recorded, nothing is measured. You can withdraw it from Settings → “Usage analytics”. Availability switches are also read from PostHog, including before any choice, with a technical identifier shared by the whole app, without any account identifier or measurement event. They let us temporarily suspend certain app features.

Legal basis (GDPR)

For users in the European Economic Area, we process your data on the following bases: performance of the contract (providing the Service), your consent (usage and audience measurement: the usage log, PostHog and Google Analytics; notifications; optional features) and our legitimate interest (security and abuse prevention, error diagnostics, improving the scanner, which you can object to in the settings).

Data retention

We keep your data for as long as your account is active. When you delete your account, we erase your personal data within 30 days, unless we are legally required to keep it. Some data is kept for a shorter time: the usage log is erased after 180 days, and PostHog session recordings after 30 days.

Your rights

You have the right to access, rectify, erase, port, and object to the processing of your data. To exercise these rights, email us at contact@lumatcg.com.

You can request deletion of your account and data at any time via our account-deletion page.

International transfers

S4F LLC is established in the United States and some of our providers host or process data there. These transfers outside the European Economic Area rely on appropriate safeguards — in particular the European Commission’s Standard Contractual Clauses and, where applicable, the EU-U.S. Data Privacy Framework. Contact us to learn more about these safeguards.

Representative in the European Union

In accordance with Article 27 GDPR, our representative in the European Union is Imed Benalia. You may contact them at contact@lumatcg.com for any question regarding the protection of your data.

Children

The Service is not intended for children under 13 (or the minimum age required in your country). We do not knowingly collect their data. If you believe a child has provided us with data, contact us so we can delete it.

Security

We implement reasonable technical and organizational measures (encryption in transit, access control) to protect your data. As no system is infallible, we cannot guarantee absolute security.

Changes

We may update this policy. In the event of a material change, we will notify you in the app or by email. The last-updated date appears at the top of this page.

Contact us

For any questions about this policy or your data: contact@lumatcg.com.