Lumo · Multiplayer card game

Privacy Policy

Last updated: 28 October 2026

This Privacy Policy explains how Lumo (“the Service”, “we”, “us”), available at lumo.openvwx.de and as a Discord Activity, collects and uses personal data when you play, and when you sign in with Discord.

1. Who we are

The Service is operated by the owner of the Discord application linked to this site (openvwx / Lumo). For privacy requests, contact the operator through the Discord application’s support channel or the contact details published in the Discord Developer Portal.

2. Data we collect

Depending on how you use the Service, we process:

• Discord account data, only if you choose “Sign in with Discord” or open the Discord Activity. Via OAuth (scope identify) or the Discord Embedded App SDK we receive your Discord user ID, username, display name (global name), and avatar.
• Sign-in session: after a website login, the server exchanges the one-time Discord code and returns a signed session containing your Discord user ID, display name, avatar, and an expiry. That session is stored in your browser. We do not keep your Discord access or refresh token on the server. Inside a Discord Activity, the access token Discord gives the Activity is used for that visit to confirm who you are.
• Career statistics for players who authenticated with Discord: display name, avatar, matches played, wins, rounds won, and points. Guests who never sign in with Discord are not written into this record.
• Gameplay data while a table is open: room code, display names, seat and score, chat messages in the lobby and at the table, and whether a seat is currently connected. A private-table password is stored only as a hash, not as the password you typed.
• Presence: a short-lived note of who is on the website, so the lobby can show how many people are here.
• Data you store in the browser: a guest id, the name you type, your language choice, and, if you signed in, the session described above.
• Technical data: standard server logs that may include IP address, user agent, and request timestamps (as provided by the hosting environment).

We do not ask for your Discord password. Authentication is handled by Discord.

3. Why we process data

• To let you open a table, play, and chat with the people at that table.
• To keep career statistics for players who signed in with Discord.
• To show how many people are currently on the website.
• To operate, secure, and debug the Service.
• To comply with Discord’s Developer Terms and applicable law.

Legal bases under the GDPR (where it applies): performance of a contract (providing the game you request), and legitimate interests in securing and operating the Service. Where Discord’s authorization screen asks you to approve the identify scope, that step is the consent Discord collects for that sign-in.

4. Where data is stored and who we share it with

• Game and statistics files are stored on our hosting provider (shared web hosting in Germany / the EU, depending on the current host configuration).
• Discord processes authentication and Activity traffic under Discord’s own privacy policy. When you play as a Discord Activity, traffic may be proxied via Discord (discordsays.com).
• Other players in the same lobby or at the same table can see your display name and your in-game actions, including chat, as part of normal play. Signed-in players are shown with the name and avatar from Discord.
• We do not sell your personal data.

5. Retention

• Career statistics are kept while the Service runs, until you ask us to delete them or we remove inactive records.
• Table files, including chat, are removed after a table has been idle (about six hours) or when it is empty.
• The “who is here” note expires within seconds after you leave the page.
• The website session in your browser expires after 30 days, or sooner if you log out.
• Server logs are retained only as long as the host keeps them for security and operations.

6. Cookies and local storage

The website login uses the browser’s local storage for the signed session, your guest id, your chosen name, and your language. A short-lived session storage entry is used only while Discord sends you back from the sign-in screen. Inside a Discord Activity, authentication uses the token Discord provides for that visit. These stores are essential for the Service to function. We do not use them for advertising.

7. Your rights

Depending on your location, you may have the right to access, correct, delete, or restrict processing of your data, and to lodge a complaint with a supervisory authority.

To request access or deletion of your Lumo account data, contact the operator (see section 1) and include your Discord username or user ID. Logging out ends the session in this browser. It does not by itself erase career statistics already stored for that Discord account.

8. Children

The Service is intended for people who meet Discord’s minimum age requirements in their region. We do not knowingly collect data from children below that age.

9. Changes

We may update this policy. The “Last updated” date at the top will change when we do. Continued use of the Service after an update means you accept the updated policy.

10. Discord policies

Use of Discord is also governed by Discord’s Terms and Discord’s Privacy Policy.