Privacy Policy

01Who we are

This Privacy Policy explains how RuiCodex ("RuiCodex", "we", "us"), a company established in Belgium (European Union), processes personal data when you use the mobile game Lumen Loop (package com.ruicodex.lumenloop, the "Game") and this website (the "Site").

RuiCodex is the controller within the meaning of Article 4(7) of the EU General Data Protection Regulation 2016/679 ("GDPR") for the processing described here, except where a third party (such as Google) acts as an independent controller for its own processing, as explained below. Because RuiCodex is established in the EU, the GDPR applies to all processing described in this policy, wherever you live. Our lead supervisory authority is the Belgian Data Protection Authority.

Contact for all privacy matters: info@ruicodex.com. Please write "Privacy – Lumen Loop" in the subject line so that your request is routed correctly.

02Scope and definitions

This policy applies to the Game on all devices and to the Site. It does not apply to third-party websites, services or advertisements that you may reach through the Game; those are governed by their own policies.

"Personal data" means any information relating to an identified or identifiable natural person, as defined in the EU General Data Protection Regulation 2016/679 ("GDPR"), the UK GDPR, the Turkish Personal Data Protection Law No. 6698 ("KVKK") and comparable laws. "Processing" means any operation performed on personal data. Where this policy refers to "applicable law", it means the data protection law that applies to you based on where you live.

03What data we process

1. Data stored only on your device

The Game keeps your puzzle progress, stars, lumens, player level, missions, daily-reward calendar, selected beam theme, settings, the list of items you own, the categories of feedback you sent and a few counters used to time ads and review requests in a local database and in the app's private storage on your device. This data is not transmitted to us. It stays on your device until you reset it in the Game or uninstall the Game.

2. Advertising data (Google AdMob)

The Game is funded by advertising served through Google AdMob and uses Google's User Messaging Platform ("UMP") to collect consent where required. When an ad is requested or shown, Google may process: your device's advertising identifier (Android Advertising ID), your IP address and an approximate location derived from it, device and operating-system information (model, OS version, language, screen size), app information, the ads shown to you and your interactions with them (impressions, clicks, whether a reward video was completed), and your consent choices. Google uses this data to deliver, limit the frequency of, measure and prevent fraud in ads and, where you have consented or where permitted by law, to personalise ads.

Google acts as an independent controller for this processing. We only receive aggregated, non-identifying reports (such as the number of impressions and earnings). See How Google uses information from sites or apps that use its services and AdMob's data disclosure.

3. Consent information

If you are in the European Economic Area, the United Kingdom or Switzerland, a consent form is shown before the first ad. Your choices are stored on your device (as an IAB TCF consent string) and passed to Google with ad requests. The form is shown only when the Game is about to request its first ad — never on the start screen.

4. Gameplay analytics (our own server)

To understand which puzzles are too hard or too easy, where players get stuck and whether features work, the Game sends usage events to an analytics service (PostHog) that RuiCodex operates on its own server, located in the United States (see "International transfers"). Events include, for example: app opened or moved to the background, onboarding completed, a level started or solved (with its identifier, stars, moves, par, hints used, time taken and difficulty tier), hints and reward videos used, daily rewards, missions and weekly rewards claimed, player level reached, store visited and the outcome of a purchase attempt (product and result, never payment details), store review prompt requested (but not whether you rated or what you wrote), and the category of in-app feedback you submitted. Each event carries technical information: a random identifier generated by the analytics library on your device, the app version, device model, operating-system version, language and screen size.

Analytics events are not linked to your name, email address or advertising ID, and session recording (screen recording) is not used. As with any internet connection, your IP address reaches the server when events are sent; it is used to transmit the data, to protect the service against abuse and, where configured, to derive an approximate country for aggregate statistics. We do not use it to identify you.

5. Purchases (Google Play)

In-app purchases are processed entirely by Google Play under Google's terms and privacy policy. We never receive your card or payment details. Google Play gives the Game an order identifier, a purchase token, the product purchased and the purchase status, which the Game uses on your device to deliver the item, prevent the same order from being credited twice and restore one-time purchases. This purchase information is not sent to our servers; the anonymous analytics described above record only which product was attempted and whether the attempt succeeded, failed, was cancelled or is pending.

6. In-app feedback

The "Community feedback" form records the category you choose and your optional "what next?" vote, and sends these to our analytics service. The message text itself is not sent by the Game. If you write a message, your own email app opens with the text; if you decide to send it, we receive your email address, your message and any information you include. Feedback is completely separate from store ratings: we never ask you for a particular rating and we never reward ratings or reviews.

7. Support requests

If you contact us by email, we process your email address, the content of your message and anything you attach, in order to answer you.

8. Notifications

If you enable reminders, they are scheduled locally on your device. No push-notification server or token is used.

9. This website

The Site is hosted by GitHub Pages (GitHub, Inc.). GitHub may log technical data such as your IP address for security and operational purposes, under the GitHub Privacy Statement. The Site itself uses no cookies, no analytics and no tracking; only a local-storage entry remembers your light/dark choice in your browser.

10. Data we do not collect

We do not collect your name, email address (unless you write to us), phone number, contacts, photos, precise location, health data or financial data, and the Game has no chat, user profiles or leaderboards.

04Purposes and legal bases

Where we rely on legitimate interest, we have weighed our interest against your rights; the data involved is limited, not linked to your identity and you can object at any time (see "Your rights").

05Who receives data

• Google (Google Ireland Limited for users in the EEA, the UK and Switzerland; otherwise Google LLC) — AdMob advertising, the User Messaging Platform and Google Play billing and reviews, as an independent controller.
• Our analytics hosting provider — the provider of the server in the United States on which RuiCodex runs its own analytics service, acting as our processor under a data processing agreement (Article 28 GDPR).
• GitHub, Inc. — hosting of this Site.
• Our email provider — when you write to us, as our processor.
• Authorities and courts — only where we are legally required to disclose data, or where necessary to establish, exercise or defend legal claims.
• A successor — if the Game or RuiCodex's business is transferred, data may be transferred to the acquirer, who will be bound by this policy.

We do not sell personal data and do not share it with data brokers.

06International transfers

RuiCodex is established in the European Union. Some recipients process data outside the European Economic Area (EEA):

• Gameplay analytics are stored on a server located in the United States. These transfers are based on the European Commission's Standard Contractual Clauses (Article 46(2)(c) GDPR) with the hosting provider, supplemented by technical and organisational measures: encryption in transit, restricted access, and data minimisation (no names, email addresses or advertising IDs in analytics).
• Google and GitHub may process data in the United States and other countries. They rely on the EU–U.S. Data Privacy Framework where they are certified, and on Standard Contractual Clauses.
• If you use the Game from outside the EEA, your data is transferred to the EEA and the United States as described above. For users in Türkiye, cross-border transfers are carried out in accordance with Article 9 of the Turkish Personal Data Protection Law No. 6698 ("KVKK"); for users in the United Kingdom and Switzerland, in accordance with their respective transfer rules.

You can request information about these safeguards, and a copy of the relevant clauses, by writing to us.

07How long we keep data

Data is deleted earlier if you validly request erasure, unless we are legally required to keep it.

08Your choices and controls

• Ad consent: where required, change or withdraw consent at any time in the Game under Profile › Ad privacy choices.
• Advertising ID: on Android, reset or delete it under Settings › Google › Ads (menu names vary by device). Deleting it stops personalised ads based on it.
• Fewer ads: the optional "Remove Ads" item or the Luminary Pass turns off banner and interstitial ads. Reward videos are always optional.
• Game data: erase your progress under Settings › Data, or uninstall the Game.
• Analytics: you may object to analytics processing by writing to us; see also "Delete data".
• Notifications: turn reminders on or off in Settings or in your device settings.

09Your rights

Depending on where you live, you have some or all of the following rights:

• Under the GDPR (all users): access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20), objection at any time to processing based on legitimate interest (Art. 21), withdrawal of consent at any time without affecting prior processing (Art. 7(3)), and the right to lodge a complaint with a supervisory authority (Art. 77) — in Belgium the Data Protection Authority (Gegevensbeschermingsautoriteit / Autorité de protection des données, dataprotectionauthority.be), or the authority of the EU country where you live or work or where the alleged infringement occurred.
• Türkiye (KVKK, Art. 11): to learn whether your data is processed and to request information about it; to learn the purpose and whether data is used accordingly; to know the third parties to whom it is transferred; to request correction, deletion or destruction; to request notification of such actions to third parties; to object to a result against you arising exclusively from automated analysis; and to claim compensation for damage caused by unlawful processing.
• United Kingdom and Switzerland: the equivalent rights under the UK GDPR and the Swiss Federal Act on Data Protection, including complaints to the ICO or the FDPIC.
• California and other U.S. states: to know, access, correct and delete personal information; to opt out of the "sale" or "sharing" of personal information and of targeted advertising; and not to be discriminated against for exercising your rights. We do not sell personal information for money. Ads personalised by Google may be considered "sharing" or "targeted advertising" under some state laws; you can opt out by deleting or resetting your advertising ID and, where offered, through Profile › Ad privacy choices.
• Brazil (LGPD) and other jurisdictions: the rights granted by your local law.

How to exercise your rights: write to info@ruicodex.com. We answer within one month (Art. 12(3) GDPR; extendable by two further months for complex requests, in which case we will tell you) and free of charge, unless requests are manifestly unfounded or excessive. Because we do not ask for your identity, we may only be able to act on data we can reliably link to you (for example, emails you sent us). Game data is on your device and under your control; you can erase it yourself at any time. We may ask for information needed to verify your request. You may use an authorised representative where your law permits.

10Children

The Game is intended for players aged 13 and over and is not directed to children. Ads in the Game are restricted to the "G" (general audiences) content rating. If you are below the age at which you can consent to data processing in your country (13 in Belgium; up to 16 in some other EU countries, Art. 8 GDPR), you may only use the Game with the consent of a parent or guardian, who should also approve any purchase.

We do not knowingly collect personal data from children under 13 (or the relevant age in your country). If you believe a child has provided us with personal data, contact info@ruicodex.com and we will delete it.

11Security

We protect data with appropriate technical and organisational measures, including encryption in transit (HTTPS/TLS) for all network traffic of the Game, access restrictions on our analytics infrastructure, and data minimisation (no names, emails or advertising IDs in analytics). No method of transmission or storage is completely secure; we cannot guarantee absolute security, but we will notify you and the competent authorities of a personal data breach where the law requires (Articles 33–34 GDPR, with the Belgian Data Protection Authority as lead authority).

12Automated decisions

We do not make decisions that produce legal or similarly significant effects on you based solely on automated processing. The Game adjusts content (such as which offers or tips are shown) based on your progress on your own device; ad selection and personalisation are performed by Google.

13Changes to this policy

We may update this policy when the Game, the law or our practices change. The current version is always published on this page with its date. If changes are material, we will inform you in the Game or on this page before they take effect and, where required by law, ask for your consent again.

14Contact

RuiCodex · info@ruicodex.com

Subject line: "Privacy – Lumen Loop". For data deletion requests, see Delete data.