Privacy Policy

Who we are

Lumara Scroll Tracker (“Lumara”, “we”, “us”) is a web service at scroll.lumara.chat that helps you track the time you spend on short-form video. Contact: scroll@lumara.chat.

What we collect

• Account details: your name, email address, a hashed (not readable) password, your time zone, your interface language, and whether your email is confirmed.
• Usage you log: platform, date, duration, optional video counts and notes, and — for timed sessions only — start and end times. Your daily and per-app limits.
• Connected devices (optional): if you pair the browser extension or the Android companion app, the device name and type, app version, when it last synced, and the records it sends — platform, start and end times or daily totals, and an optional detected-video count. Devices only send data for supported short-video platforms; records for any other app or site are rejected and not stored. Device keys are stored only in hashed form.
• Messages you send us: name, email, topic and message from the contact form.
• Security records: sign-in attempts (email, IP address, time), single-use tokens for password resets and email confirmation, and a system log of security events and errors (which may include your account number and IP address). IP addresses in the log and in contact messages are shortened after 30 days (the last part is removed), so they no longer point to one connection.
• Account notices: short in-app notifications, for example when a device is paired or your password changes. They store the type of notice and, where relevant, a device or plan name.
• Paired-device keys: a paired app or extension signs in with a long random key. We store only a one-way hash of it and its last 4 characters, never the key itself.
• Payments (only if paid plans are switched on): the amount, currency, date, status and the payment provider’s reference for each payment. Card and bank details are entered with the payment provider and never reach us.
• Plan records: if paid plans are offered, which plan you’re on, its billing period and status. Card details are handled by the payment provider on its own secure page; we never see or store them.

We don’t connect to your social media accounts, never ask for their passwords, and never see your private messages or what you watch. Devices only send data after you pair them and grant the permissions they need — see permissions & tracking limitations.

How we use it

• To run the service: show your dashboard, reports, limits and insights.
• To send essential emails: email confirmation, password resets, password-change and account-deletion notices, and replies to your messages.
• To keep the service secure: rate-limiting sign-ins and preventing abuse.

Insights and recommendations are produced by simple rules running on our server. We don’t use your data to target advertising, and we don’t sell, rent or share it with third parties for their own purposes.

Optional AI suggestions. If this site enables optional AI suggestions powered by OpenAI. They are off unless you turn them on in Analytics. When you ask for suggestions, a summary of your numbers — minutes per platform for the last 7 and 30 days, time-of-day totals, your limits and goal status, and counted-video totals — is sent to OpenAI to generate them. Your name, email, notes, device names and exact timestamps are never sent. The suggestions are stored in your account for up to 7 days and deleted with your account. You can turn the feature off at any time. It is currently not enabled, so no data is sent to any AI service.

Legal basis

Where data-protection laws such as the GDPR apply, we process account and usage data to provide the service you signed up for (contract), security records for our legitimate interest in protecting the service, and contact messages to respond to you (legitimate interest).

Who can see your data

Only you can see your entries. Every request is checked against your signed-in account. Our administrators can see account details (name, email, sign-up date) and totals across all users, but the admin tools don’t display individual users’ entries. Our hosting provider stores the data on our behalf.

How long we keep it

See the data deletion policy for how to delete your data.

Cookies and local storage

We use one essential session cookie, a language-preference cookie if you choose a language, and store your light/dark theme choice in your browser. Nothing is used for tracking or advertising. Details: cookie policy.

Security

Connections are encrypted (HTTPS). Passwords are hashed with PHP’s password_hash(). Forms are protected against cross-site request forgery, sign-ins are rate-limited, and database queries use prepared statements. No system is perfectly secure, but we work to protect your data and will notify affected users of any breach where required by law.

Advertising and payments

There are currently no advertisements. If ads are shown, your tracking data is never used to target them or shared with advertisers. Online payments are not currently offered.

Your rights

You can see, correct, export (CSV) and delete your data yourself from your account. You can also ask us for a copy of your data, to correct it, to delete it, or to object to or restrict processing, by emailing scroll@lumara.chat. You may also complain to your local data-protection authority.

Privacy contact

For any privacy question or request — access, correction, deletion, export or objection — email scroll@lumara.chat or use the contact form with the topic “Privacy or data request”. We aim to reply within 30 days.

Children

The service isn’t intended for children under 13, or under the minimum age set by the law where you live. If you believe a child has created an account, contact us and we’ll delete it.

Changes

If we change this policy we’ll update the date above, and email you about significant changes.