Privacy Policy

1. Introduction

WaveLux ("we", "us", "our") provides a real-time fluid physics simulation and interactive games app available on Android and iOS at wavelux.gamemagic.org. This Privacy Policy explains what personal data we collect, why we collect it, how it is stored, and your rights under GDPR and other applicable laws. By using WaveLux you agree to the practices described here.

2. Data We Collect

• Account data (if you create an account): email address, hashed password, registration timestamp.
• Device & usage data: App version, device model, OS version, crash reports, and anonymised interaction logs used to fix bugs and improve the experience.
• Analytics: Anonymised page/screen views via Google Analytics (IP anonymisation enabled). No personal identifiers are retained.
• In-app purchase data: Purchase verification tokens issued by Apple/Google. We never receive or store your card details — all payments are handled entirely by the platform stores.
• Support communications: Messages submitted via the contact form or email.
• Camera / Photo library (optional, with explicit permission): Only accessed when you choose to use the Image Effects feature on a photo. Images are processed entirely on-device and are never uploaded to our servers.

3. How We Use Your Data

• Provide, maintain, and improve the WaveLux app and website.
• Authenticate your account and keep sessions secure.
• Verify in-app purchases and unlock premium content.
• Diagnose crashes and performance issues.
• Respond to support requests.
• Detect and prevent fraud and abuse.
• Comply with legal obligations.

We do not sell your personal data to any third party, ever.

4. Data Storage & Security

• All data is encrypted in transit (TLS 1.2+) and at rest (AES-256).
• Servers are hosted in the EU on hardened cloud infrastructure.
• Access to production databases is restricted by role-based authentication.
• Passwords are hashed with bcrypt and are never stored in plain text.
• Image effects are processed entirely on-device — photos are never sent to our servers.

5. Third-Party Services

• Google Play / Apple App Store — in-app purchase processing. Each platform's own privacy policy governs payment data.
• Google Analytics (Firebase) — anonymised usage statistics. IP anonymisation is enabled.
• Crash reporting — optional crash logs to help us diagnose bugs. No personal data is included.

Each service has its own privacy policy. We only share the minimum data required for the service to function.

6. Permissions

WaveLux requests device permissions only when you actively choose to use a feature that requires them:

• Camera / Photo library — only for the Image Effects feature. Processed on-device, never uploaded.
• Audio — used for the ambient soundscape engine. No audio is recorded or transmitted.

You can revoke any permission at any time in your device settings.

7. Cookies

• Session cookies: Required for login and security on the web interface. Cannot be disabled.
• Preference cookies: Remember your language and UI settings.
• Analytics cookies: Anonymised usage patterns via Google Analytics.

We do not use advertising cookies or cross-site tracking.

8. Data Retention

• Account data: Retained while your account is active. Deleted within 30 days of account deletion request.
• Crash & diagnostic logs: 90 days (aggregated and anonymised).
• Support messages: 3 years.
• Analytics data: 26 months (aggregated and anonymised).
• Purchase records: 7 years (legal / tax requirement, held by the platform stores).

9. Your Rights (GDPR)

Under GDPR and other applicable laws you have the right to:

• Access a copy of your personal data.
• Rectification of inaccurate data.
• Erasure ("right to be forgotten") — delete your account and all associated data.
• Portability — export your data in a machine-readable format.
• Object to marketing or analytics processing.
• Restriction of processing in certain circumstances.

To exercise any right, email [email protected]. We respond within 30 days.

10. Children's Privacy

WaveLux is designed for general audiences and is suitable for users aged 4 and above as a physics and creative play app. We do not knowingly collect personal data directly from children under 13 without verifiable parental consent. The app does not contain social features, user-generated content sharing, or any mechanism that would expose children's data to other users. If you believe a child under 13 has provided personal data, please contact us and we will delete it promptly.

11. Changes to This Policy

We may update this policy. Material changes will be announced via email to registered users and by updating the "Last updated" date above. Continued use after changes constitutes acceptance.

12. Contact