Luga is a learning app for children ages 6 to 12. We take privacy seriously, especially for children. This policy explains in plain language what data we collect, why, and what your rights are.
Who are we?
Luga is a product of Creative Wiz / NGD Holding BV. Data controller under GDPR: Creative Wiz, contact via hello@creativewiz.tech.
What data do we collect?
Username — chosen by the child, no real name required.
Age group — 6-8, 9-10, or 11-12. We do not store an exact birthdate.
Avatar choice — a number referring to a pre-drawn character.
Parent/guardian email — only if a parent enters this for password recovery or account management. Optional.
Password — hashed with argon2id. We cannot read it.
What we do NOT collect
No real name or surname
No phone number
No address details
No location data (GPS)
No access to contacts, photos, microphone, or camera
No advertising IDs
No tracking cookies or pixels
Why do we collect this data?
Maintain account — so progress is preserved between sessions.
Adapt lessons to age — a 6-year-old gets different exercises than an 11-year-old.
Show streaks and points — to support motivation.
Leaderboard — anonymous, only username + level visible to other players.
With whom do we share data?
With no one. No advertising networks, no analytics agencies, no social media. We do not sell or rent data.
Our servers are located in the Netherlands (Hostinger VPS in Amsterdam). No data leaves the EU.
How long do we keep data?
Active accounts: as long as you use the app.
Soft-deleted account: 30-day recovery window, then permanently deleted.
Backups: maximum 20 retained, oldest are automatically overwritten.
Children, GDPR-K, and COPPA
Under GDPR, children under 16 in the Netherlands need parental consent to create an account on online services. By having your child create an account, you provide consent for the processing described in this document.
For US users: although Luga is not specifically directed at children under 13 in the US, we follow COPPA-equivalent practices: we collect minimal data, never share with third parties, and provide parental controls.
As a parent/guardian, you can always:
Review the account (request a report via email).
Delete the account (in app: Profile → Delete account, or email us).
Request changes via email.
No advertising, no in-app purchases
Luga never asks for money in the app. No third-party ads. Any future premium subscription is purchased only by adults, outside the children's environment.
Security
All communication encrypted via TLS 1.3 (HTTPS).
Passwords hashed with argon2id.
Server-side secrets encrypted via SOPS+age.
Regular backups, separated from production database.