Effective September 7, 2026 · Version 2.1
Privacy Policy
LumaVerse: Daily Bible Verse (package com.chartmann1590.verselight, developer Hartmann Studios) is designed so your email, likes, share history, reminder preferences, and private activity history are never visible to other users. This policy explains what we collect, why, and your controls — including advertising with Google AdMob. Get the app on Google Play · Love the app? Buy me a beer
App, developer & controller
This Privacy Policy applies to the Android app “LumaVerse: Daily Bible Verse” (package name com.chartmann1590.verselight), published on Google Play by developer Hartmann Studios (operated by Charles Hartmann). Hartmann Studios is the data controller for this app. For privacy requests or deletion help contact me@charleshartmann.com or via the support page. This is also the contact for EU/UK GDPR inquiries. Support the project: buymeacoffee.com/charleshartmann
Summary
- No sale of data. We never sell personal information.
- Ads: The app contains ads via Google AdMob (banner + interstitial). See Advertising below.
- Consent: Personalized ads require your consent (EEA/UK/CH via Google UMP/TCF). You can change it anytime in the app: Profile → Ads privacy options.
- Your data: Counts toward Data Safety: email, name, avatar, app activity (likes/comments), diagnostics, device IDs (Advertising ID).
Information we collect
| Category | Examples | Source |
|---|---|---|
| Account | Email, Google ID (if used), display name, avatar URL, auth metadata | You / Firebase Auth |
| App activity | Likes, shares, comments, reports, reminder hour, language choice | You |
| Public content | Comment text, display name + avatar (public by design) | You |
| Device & diagnostics | Crash logs, performance traces, OS version, app version, network timing | Firebase Crashlytics / Performance |
| Advertising | Advertising ID (GAID), ad interactions, coarse location (from IP), consent string (TCF) | Google AdMob / UMP |
We do not collect precise location, contacts, files, or payment info. Advertising ID is only used after UMP consent where required.
How we use information & legal bases (GDPR)
- Provide the app — authenticate, sync your private journey, display the daily verse: contract
- Community safety — on-device checks, server moderation, report queue, rate limits: legitimate interest + legal obligation
- Reminders — local scheduled notification at your chosen hour: consent (you toggle it)
- Improve stability — crash/performance diagnostics: legitimate interest
- Advertising — serve and measure banner/interstitial ads: consent where required, legitimate interest for non-personalized ads
- Account deletion — fulfill erasure requests: legal obligation
Advertising — Google AdMob
LumaVerse displays banner (persistent, adaptive anchored at bottom) and interstitial (full-screen between navigation/actions, max once per ~2 minutes, never on app start/exit or while composing). Both are served by Google AdMob (Google LLC).
What AdMob may process: Google Advertising ID, device model/OS, app package + version, IP-derived coarse location, ad view/click/timing, and your consent choice (TCF string) from the Google User Messaging Platform (UMP). This is used to serve, frequency-cap, and measure ads and to detect fraud.
Personalized vs non-personalized: Personalized ads are only shown if you grant consent via the consent form shown on first launch in regulated regions, or via your device Ads settings. You can withdraw or change consent anytime: open LumaVerse → Profile → Ads privacy options to re-open the UMP consent form, or go to Android Settings → Privacy → Ads → Delete/Reset Advertising ID or Delete advertising ID. Non-personalized ads may still appear without personalization.
Learn more: How Google uses ad data · Google Privacy Policy · AdMob privacy. Our app-ads.txt at /app-ads.txt authorizes google.com, pub-8382831211800454, DIRECT, f08c47fec0942fa0.
LumaVerse does not sell personal information and does not share your email/name with AdMob. Advertising data is processed under Google’s terms as a processor/service provider.
Public information
Comments, chosen display name, and avatar are public. Email, likes, share history, reminder choice, reporter identity, and auth provider are private. Do not include sensitive personal info in a comment. You may delete your own comments; reported content may be hidden pending review.
On-device safety & translation
Safety: Draft comments are evaluated locally (on-device classifier + optional Gemini Nano) before posting — the draft is not sent to a moderation API. Only posted comments go to Firebase/Cloudflare for server verification.
Translation: If you choose a language other than English, Google ML Kit downloads a translation model (~30 MB) to your device. UI and comments are translated locally, not via a cloud translation service. Machine translations may be inaccurate; original Scripture reference is preserved.
Diagnostics and performance
Firebase Crashlytics & Performance process crash reports, device/OS, app version, and network timing to fix issues and improve responsiveness. Not used for advertising. Crashlytics collection is always on in current builds.
Service providers (sub-processors)
- Google Firebase — Auth, Firestore, Crashlytics, Performance, Hosting (USA/EU). Firebase Privacy
- Google Play services / AdMob / UMP — Ads serving, consent (TCF), Advertising ID. Google Privacy
- Google ML Kit — on-device translation models
- Cloudflare Workers & D1 — comment/report processing, moderation queue, rate limiting
Providers act under their privacy terms and only to operate the service. We do not allow them to use your data for unrelated marketing.
Data sharing
We do not share personal data with other users or advertisers except: (1) public content you post, (2) service providers above strictly to operate the app, and (3) if required by law. No sale, no cross-context behavioral sharing beyond AdMob’s ad serving as described.
Retention and deletion
In-app deletion: Profile → Delete my account and private data → Confirm. This removes Firebase Auth account, profile, likes, private activity, and authored comments (via backend batch delete). You may be asked to re-authenticate.
Without the app: Visit delete-account.html or email me@charleshartmann.com with subject “LumaVerse account deletion” from your account email. Verified requests are completed within 30 days. Deletion is available both in-app and via web (Google Play requirement).
What is removed: Auth account, users/{uid}, publicProfiles/{uid}, likes, activity, comments you authored, and D1 authored comments. Retained only if needed: abuse/moderation audit and report records (reporter ID, snapshot) to prevent fraud and enforce safety — not displayed publicly, kept only as long as necessary.
Retention: Account data until you delete or 24 months of inactivity; public comments until you delete; diagnostics aggregated ~90 days; ad consent string per UMP/TTL.
Your rights
EEA/UK/Switzerland (GDPR): access, correction, erasure, restriction, portability, objection, and withdraw consent (via Profile → Ads privacy options or email). You may lodge a complaint with your supervisory authority.
US (including California): LumaVerse does not sell or share personal information for cross-context behavioral advertising beyond AdMob’s processing above. You may request access/deletion via the deletion flow or email. Non-personalized ads remain available after opt-out.
To exercise rights, email the controller address above. We verify ownership by your account email.
Security & transfers
We use least-privilege Firestore rules, token verification (Firebase ID tokens), rate limits, HTTPS in transit, and backup exclusions. No system is perfectly secure. Data may be processed in the US/EU via Firebase/Cloudflare/AdMob infrastructure with standard contractual safeguards for international transfers.
Children
LumaVerse is for a general audience and is not directed to children under 13. We do not knowingly collect personal information from children. Ads are not configured for child-directed treatment; where Google identifies a user as under the age of consent, personalized ads are not served without valid consent, and we tag ad requests accordingly. If you believe a child’s data was provided, contact us for deletion.
Cookies & tracking
The Android app does not use web cookies. The website (this hosting) uses no tracking cookies. AdMob in the app may use the Advertising ID and app-local storage for frequency capping and consent (not web cookies).
Changes
Material changes will be posted here with a new effective date and, where appropriate, in-app notice. Continued use after changes indicates acceptance.
Contact
Privacy questions, rights requests, or deletion help: me@charleshartmann.com · support.html · Account deletion page · Google Play
☕ Buy me a beer — support LumaVerse
This policy is provided for transparency and does not constitute legal advice. For Ad choices: Android Settings → Privacy → Ads. For app-ads.txt see /app-ads.txt.