Privacy Policy

At Luminar, we are committed to protecting your personal data and creative content so you can read, write, and connect with the community safely. This Privacy Policy explains what data we collect, where we store it, and how we use it.

1. Data controller

For the purposes of this policy, the data controller is the Luminar platform. You may contact us about privacy through support channels in your account settings or our official contact addresses.

2. Data we collect

When you use the service, the following categories of data may be processed:

• Account information: email address, display name / username, password (encrypted), optional profile and cover photo, bio; when signing in with Google or Apple, email and (if provided) name from those providers
• Creative content: book drafts, chapters, cover and chapter media, published works, gossips and comments, and related metadata
• Subscription / purchases: plan information (Plus/Pro), product IDs, subscription period, and entitlement / receipt summaries from RevenueCat / App Store / Google Play (card numbers are not stored by Luminar)
• Interaction data: reading progress, likes, follows, AI quota usage, support / contact forms, and report records
• Technical data: session identifiers, device and browser information, IP address (for security and debugging, retained for a limited time)

3. Where we store data

Your book drafts, chapter text, profile information, and in-platform interactions are stored securely in a PostgreSQL database. Cover, avatar, chapter, and showcase images, along with blog submissions, are kept in a private Cloudflare R2 bucket and delivered only through the Luminar API. Only Luminar systems required to operate the service can access this data; we do not sell or rent your data to third parties for marketing.

4. AI features — Ilhami and Tuval

When you use Luminar’s Ilhami (Text AI) and Tuval (Visual AI) features, the following inputs may be sent to OpenAI to generate responses: your prompt text, chat context, related book blurb / tags, and (when you choose character or reference images in Tuval) the reference images you upload.

This transfer also constitutes a cross-border transfer of personal data (to countries where OpenAI operates / US-based infrastructure). For the legal basis, purpose, and safeguards, see the cross-border transfer section (section 5) of our KVKK Personal Data Protection Notice.

These inputs are never used to train general AI models. Our OpenAI API use follows the provider’s commercial API data-use policies.

Saving Ilhami and Tuval outputs to the platform is entirely your choice. Content you save is stored like your other creative data in the platform database and (for images) on Cloudflare R2.

5. Children's privacy

Luminar does not knowingly collect personal data from anyone under the minimum age (13). If we learn that such an account was created or such data was processed, we delete or render the data inaccessible and may close the account. Parents or legal guardians may report a suspected case through our support channels.

6. Cookies

Luminar uses cookies only for secure session management (authentication). Session cookies let you access your account safely without signing in repeatedly. We do not use cookies for ad targeting, behavioral profiling, or third-party tracking.

For a detailed cookie list, browser storage keys, and third-party information, see our Cookie Policy.

7. How we use data

• Account creation, authentication, and session security
• Providing the writing, reading, and publishing experience
• Community features (comments, gossip, follows) and moderation
• Operating Ilhami and Tuval AI assistants
• Verifying subscription entitlements (Plus/Pro) and managing AI quotas
• Platform security, abuse prevention, and legal compliance

8. Third-party service providers

To deliver the service we work with a limited set of third parties: PostgreSQL (database), Cloudflare R2 (file storage), OpenAI (Ilhami / Tuval), RevenueCat with the App Store / Google Play (subscriptions and purchases), Google and Apple (OAuth sign-in), and email delivery (Resend). These providers access only the data needed to perform the service and are bound by contractual data-protection obligations.

No product analytics or advertising SDK is currently in use. If error monitoring (e.g. Sentry) is configured, only limited technical diagnostics data may be processed.

9. Retention and deletion

We retain your data while your account is active and as required by legal retention obligations. When you delete your account, your personal data is deleted or anonymized within a reasonable period; backup copies may remain in systems for a short technical period.

10. Your rights

You have the right to access, correct, delete, and restrict processing of your personal data. For rights under Turkish law (KVKK), see our Personal Data Protection Notice (KVKK).

11. Policy updates

This Privacy Policy may be updated from time to time. Material changes will be announced on the platform; the current text is always published on this page.