Privacy policy

1. Who we are and how to contact us

LumaPlay is the name of the app, website and customer account service described in this policy. We are responsible for deciding how the personal information described here is used.

For privacy questions or requests, email info@lumaplay.app. Please do not send passwords, payment card details or verification codes by email.

2. Information we use

• Account details: email address, optional display name, account type, selected plan, account status, trial dates and licence dates.
• Device and activation details: device name, app installation identifier (stored as a hash), login type, activation-code status, and registration, last-seen or removal dates. Where applicable, a server URL may be associated with the device.
• Xtream Codes account details: the username entered in the app and subscription expiry information when the app supplies them. If you use an account-managed server URL, we store that URL and your preference for fixing it in the app.
• Provider account security: provider account passwords are represented by a salted password hash for sign-in; we do not keep that password in readable form. This is separate from the credentials you use to sign in to a media server.
• Billing records: plan, invoice and Checkout session identifiers, amount, status, issue and payment dates, and invoice links or documents. Stripe handles hosted checkout and payment processing. LumaPlay does not receive or store your full card number or card security code.
• Account security and trial-abuse prevention: one-way or keyed hashes derived from email addresses and IP addresses, sign-in attempt records, and administrative security audit entries. These help protect accounts, limit repeated trial abuse and investigate suspicious access.
• Support requests: the name, email address, selected category and message you submit, plus your account email. We also keep a short-lived record of request times to limit spam; the support message itself is delivered by email and is not saved in the account database.
• Technical connection data: our hosting and security providers may process IP address, request metadata, browser or device information, and diagnostic data when you visit the site or use the account service. Cloudflare Turnstile processes information needed to check that support requests are submitted by a person.

The LumaPlay customer account service does not ask for or store the password you use to access Plex or an Xtream Codes server. The app handles the credentials needed to connect to the media service you select on your device. You choose and connect to that service yourself.

3. Why we use information

We use information to create and manage accounts, verify email addresses, sign you in, register and remove devices, issue activation codes, enforce plan limits, provide account support, offer secure checkout, create and reconcile invoices and payments, deliver app downloads, protect the service against fraud and abuse, and meet legal obligations.

Depending on the activity, we rely on performing our agreement with you or taking steps you request before entering it, our legitimate interests in operating and securing the service, and legal obligations such as financial record keeping. Where we rely on consent, you can withdraw it.

We do not sell personal information or use account details to build third-party advertising profiles.

4. Who we share information with

We share only what is needed with service providers that help operate LumaPlay:

• Cloudflare: website and account-service hosting, database and file storage, and network security.
• Resend: delivery of account verification, sign-in and support-request emails.
• Stripe: hosted checkout, invoice creation, payment processing, and billing status updates.

These providers process information under their own service terms and privacy information. We may also disclose information where required by law, to protect people or the service, or as part of a business transfer. We do not send your account password to Plex, Xtream Codes providers, or our account panel.

Our service providers may process information in countries outside the UK. Where data-protection law requires safeguards for an international transfer, the relevant provider and transfer arrangement must meet those requirements.

5. How long we keep information

We keep account and device records while needed to provide your account, manage access and respond to support requests. If an account closes, we delete or de-identify information that is no longer needed, except where it must be retained for legal, accounting, fraud-prevention or security purposes.

Invoice and payment records may be kept for the period required by financial and tax rules. Short-lived email verification links expire after 15 minutes. Support-request rate-limit records are deleted after 30 days. Sign-in and trial-abuse signals are retained for the time needed to secure the service and enforce trial eligibility; routine failed provider sign-in attempt records are cleaned up after one day. We keep only the information needed for each purpose.

6. Cookies and local storage

The customer area uses a necessary, secure session cookie to keep you signed in. It is marked HttpOnly, Secure on HTTPS, and SameSite=Lax. You can clear it in your browser, but signing out or clearing it will end that browser session. Our hosting and security provider may also use technical mechanisms required to deliver and protect the site.

7. Security

We use measures such as HTTPS, access controls, hashed session and activation tokens, and salted password hashing to reduce the risk of unauthorised access. No internet service can guarantee absolute security. Please use a unique password for your LumaPlay provider account and tell us promptly if you suspect unauthorised access.

8. Your privacy rights

Depending on the law that applies to you, you may be able to request access to your personal information, correction, deletion, restriction or objection to certain uses, or a copy in a portable format. You may also complain to your local data-protection authority. In the UK, this is the Information Commissioner’s Office (ICO).

Contact info@lumaplay.app to make a request. We may ask for information needed to confirm your identity. Some records may need to be retained where the law permits or requires this.

9. Changes to this policy

We may update this policy when our service or data practices change. We will publish the latest version here and update the effective date. If a change materially affects how we use your information, we will take reasonable steps to bring it to your attention.