Privacy Policy
Luukis is a drawing and play app for children, made by Rekakod ("we"). We built it to collect as little as possible. This policy explains what that means for the Luukis app (at app.luukis.com and, later, on iOS and Android) and this website.
The short version
- Children don't need an account to play. Drawings, photos and worlds stay on your device.
- A grown-up can optionally create an account with just an email address, to buy the full version once and use it on every device.
- There are no ads, no analytics and no advertising trackers in the app.
- We don't sell personal information. We share it only with the services that run Luukis, listed below.
- A grown-up can delete the account at any time, inside the app.
What stays on your device
When your child takes or picks a photo, Luukis cuts the drawing out on the device and saves only the cut-out drawing. The original photo is not kept by Luukis. Drawings and worlds are saved in your browser's storage (on the web) or in the app's storage (on phones and tablets). We cannot see or access them.
Luukis asks for camera and photo access only so your child can bring drawings into the app. You can refuse or turn this off at any time in your browser or device settings.
The grown-up account
The account is only for grown-ups, is reached through a grown-up check, and is only needed to buy or restore the full version. To make one, a grown-up enters their email address, and we email a 6-number sign-in code. There is no password. We store:
- the email address, and a random account ID we create;
- for each signed-in device, a one-way scrambled form of its sign-in key (we cannot read the key back);
- a scrambled form of the latest sign-in code, which is deleted when it is used or expires after 10 minutes.
We use this only to sign you in and to link your purchase to you. We don't use it for marketing and we don't send newsletters. Sign-in emails are sent through Cloudflare Email Service. We delete sign-in keys that have not been used for 180 days.
Buying the full version
Purchases are handled by RevenueCat and its payment provider Stripe, in a secure checkout window that opens in the app. We never see or store your card details. We send the checkout your account ID and email address so the purchase is linked to your account and your receipt can be emailed to you. RevenueCat and Stripe also receive the details needed to take payment and prevent fraud, such as your country, and keep purchase records as the law requires for accounting and tax. We receive only whether your account has the full version.
Backup & Sync (optional)
A grown-up can choose to back up worlds and drawings to their own Google Drive. If they do:
- Your files are saved in a hidden Luukis folder in your own Google Drive, and the app on each device talks to Google directly. Your drawings and worlds do not pass through our servers.
- So the app can keep syncing without asking you to sign in to Google again and again, our server keeps your Google account ID, your Google email address, and an encrypted key that only lets Luukis reach that hidden folder. It cannot read the rest of your Drive.
- Pressing Disconnect on the last device removes this and withdraws Luukis's access at Google. We also delete it after 180 days without use. You can remove Luukis's access at any time in your Google Account settings.
Google's own privacy policy applies to your Google account and to what is stored in your Drive.
What we receive when you use the app or this website
Our hosting provider (Cloudflare) processes basic technical information that every web request includes, such as your IP address and browser type. This is used to deliver the pages, keep them secure and limit abuse, and we keep short-term technical logs for the same purposes. We don't use it to identify or profile you. This website loads fonts from Google Fonts, which also receives your IP address.
If you email us, we receive your email address and whatever you choose to tell us, and use it only to reply.
Who processes data for us
- Cloudflare: hosting, our account database, sign-in emails and support email.
- RevenueCat and Stripe: purchases and payments.
- Google: only if you choose Backup & Sync (Google Drive), and Google Fonts on this website.
These services may process data in countries other than your own, including the United States. We don't sell your information.
Children
Luukis is designed for children, and a child can use the app without giving us any personal information. Accounts and purchases are for grown-ups, behind a grown-up check. We do not knowingly collect personal information from children. If you believe a child has sent us personal information, contact us and we will delete it.
Deleting your data
Your drawings and worlds live on your device, so you control them. On the web, clearing this site's data in your browser settings removes them. On phones and tablets, deleting the app removes them. You can also delete individual drawings and worlds inside the app.
To delete your account, open the grown-ups area, sign in and choose Delete account. This deletes your email address, your account ID and every signed-in device straight away. The full version is linked to the account, so deleting it means the full version cannot be restored afterwards. Payment providers keep purchase records for as long as the law requires.
You can also ask us to access, correct or delete your information by emailing us, and we'll answer as soon as we can.
Changes
If we change this policy, we will update the date above and, for important changes, tell you in the app.
Contact
Questions or requests: hello@luukis.com.