01Who collects it
The data controller is LumiPuhu, run by an individual developer rather than a company. One address for everything: info@lumipuhu.com.
02What we collect
Only what the app needs to do its job. All of it is either entered by you or produced while you use the app; we buy or gather nothing from anywhere else.
| What | Example | Where it comes from |
|---|---|---|
| Account | E-mail address, name, preferred language and time zone | When the account is created |
| Child profile | The child's name or nickname, age group, chosen avatar | Entered by the parent |
| What happens in the app | Feelings logged, behaviours marked, journal entries, drawings, breathing and game sessions, stars earned and rewards spent | Parent and child, using it together |
| Therapy records | A therapist's notes, the tasks they set, sessions and measurement results | Only if you have granted a therapist access |
| Parent PIN | Four digits that open the parent panel | Chosen by the parent; stored hashed |
| Technical logs | Request time, IP address, error records | Kept automatically by the server |
What we do not collect is part of the list too: no location, no contacts, no photo library, no microphone, no advertising identifier and no payment details. The app is free and has no in-app purchases.
03Children's data
LumiPuhu is built to be used with a parent. A child has no account, no password and no separate way in; every record sits under the parent's account and the parent can see all of it.
That is a deliberate design choice: promising a child a box that "stays secret from your parent" would be a promise the software could not keep.
There are no ads, no outbound links, no chat and no area visible to other users anywhere in the child's experience. What a child writes and draws is visible only to their own family — and to a therapist, if the parent has explicitly granted access.
04Why we collect it
- To be the app at all: without the child's records there is no tracking screen, no star jar, no journal and no report.
- For the link between parent and therapist: when a parent grants access, so the therapist can set tasks and follow progress.
- To keep the account safe: limiting sign-in attempts, managing sessions, finding errors.
- To answer you: support correspondence.
Nothing is processed for advertising, profiling, automated decision-making or marketing.
06Third-party code in the app
The iOS app contains no ad network, no analytics tool, no crash-reporting service and no social SDK. The phone makes requests to our own server (app.lumipuhu.com) and nowhere else. It therefore cannot track you across apps and websites, and never touches your advertising identifier.
This site works the same way: the fonts are served from our own domain, no cookies are set, and no third-party request is made.
07Keeping and deleting
Records stay as long as the account does — the point of a progress chart is the change it shows over months.
Deletion is always available. Write to info@lumipuhu.com and ask for any of:
- one child's profile and all of their records to be deleted,
- your whole account to be deleted,
- a copy of your data.
We complete such a request within 30 days at the latest. Deletion cannot be undone; copies inside backups fall out with the backup cycle. Where a therapist's notes about you are subject to a professional or legal retention period, they may be kept for that period — and we will tell you in writing which record stayed and why.
08Security
- All traffic is encrypted with HTTPS; the app never opens an unencrypted connection.
- Passwords are stored irreversibly (bcrypt) — nobody, ourselves included, can read yours.
- The parent panel is behind a four-digit PIN that locks after repeated wrong attempts.
- Sign-in attempts are rate limited: no address can be guessed at indefinitely.
- Every family's data is a separate tenant, so one family's record cannot fall into another family's query.
- A therapist sees only the child a parent granted access to, and only through that grant.
No system is flawless. If you notice a security problem, please write to info@lumipuhu.com — reports are taken seriously and answered.
09Your rights
Article 11 of Law 6698 gives you the right to learn whether your data is processed, to request information about it, to have it corrected or deleted and that to be passed on to third parties it was shared with, to object to processing, and to claim compensation for damage. The full list and how to apply are in the Privacy Notice. You may write to us in English or Turkish.
10Changes to this policy
As the app changes, so does this page; the "last updated" date above moves with it. If a change affects you directly — if we start collecting a new kind of data, for instance — we will also tell you in the app or by e-mail.
11Contact
Any question, request or complaint: info@lumipuhu.com. For how-to questions, see the support page.