Legal

Privacy Policy

Last updated: 6 November 2026

This policy explains what personal data Lumara Scroll Tracker collects, why, and the choices you have.

Who we are

Lumara Scroll Tracker (“Lumara”, “we”, “us”) is a web service at scroll.lumara.chat that helps you track the time you spend on short-form video. Contact: scroll@lumara.chat.

What we collect

• Account details: your name, email address, a hashed (not readable) password, your time zone, and whether your email is confirmed.
• Usage you log: platform, date, duration, optional video counts and notes, and — for timed sessions only — start and end times. Your daily and per-app limits.
• Connected devices (optional): if you pair the browser extension or the Android companion app, the device name and type, app version, when it last synced, and the records it sends — platform, start and end times or daily totals, and an optional detected-video count. Devices only send data for supported short-video platforms; records for any other app or site are rejected and not stored. Device keys are stored only in hashed form.
• Messages you send us: name, email, topic and message from the contact form.
• Security records: sign-in attempts (email, IP address, time) and single-use tokens for password resets and email confirmation.

We don’t connect to your social media accounts and never see what you watch. We don’t collect payment details.

How we use it

• To run the service: show your dashboard, reports, limits and insights.
• To send essential emails: email confirmation, password resets, password-change and account-deletion notices, and replies to your messages.
• To keep the service secure: rate-limiting sign-ins and preventing abuse.

Insights are produced by simple rules running on our server. No external AI service receives your data. We don’t use your data for advertising, and we don’t sell, rent or share it with third parties for their own purposes.

Legal basis

Where data-protection laws such as the GDPR apply, we process account and usage data to provide the service you signed up for (contract), security records for our legitimate interest in protecting the service, and contact messages to respond to you (legitimate interest).

Who can see your data

Only you can see your entries. Every request is checked against your signed-in account. Our administrators can see account details (name, email, sign-up date) and totals across all users, but the admin tools don’t display individual users’ entries. Our hosting provider stores the data on our behalf.

How long we keep it

• Account and usage data: until you delete it or your account.
• Sign-in attempts: up to 30 days. Reset tokens: up to 1 hour. Confirmation tokens: up to 48 hours.
• Contact messages: until handled and no longer needed, and removed when you delete your account.
• Hosting backups roll off within the provider’s normal backup cycle. See our data deletion policy.

Cookies and local storage

We use one essential session cookie and store your light/dark theme choice in your browser. Nothing is used for tracking or advertising. Details: cookie policy.

Security

Connections are encrypted (HTTPS). Passwords are hashed with PHP’s password_hash(). Forms are protected against cross-site request forgery, sign-ins are rate-limited, and database queries use prepared statements. No system is perfectly secure, but we work to protect your data and will notify affected users of any breach where required by law.

Your rights

You can see, correct, export (CSV) and delete your data yourself from your account. You can also ask us for a copy of your data, to correct it, to delete it, or to object to or restrict processing, by emailing scroll@lumara.chat. You may also complain to your local data-protection authority.

Children

The service isn’t intended for children under 13, or under the minimum age set by the law where you live. If you believe a child has created an account, contact us and we’ll delete it.

Changes

If we change this policy we’ll update the date above, and email you about significant changes.