Privacy Policy

This Privacy Policy explains how BuLumina ("we", "us", "the Service") collects, uses, stores, and protects information when you use our web application, chat service, and any related features.

We designed BuLumina with a data-minimal philosophy. We don't track you across the web, we don't run analytics profiles, and we don't sell anything about you to anyone.

By using BuLumina, you agree to this Privacy Policy. If you don't agree, please don't use the Service.

We only collect what we need to run the Service:

• Account data — your email address and username, provided at registration.
• Authentication data — a hashed password (never your plain password) and a signed session token.
• Balance & transactions — your BuMoney balance and a record of every transaction (spending, admin adjustments, bonuses).
• Usage metadata — token counts and message timestamps used to calculate BuMoney charges. This is stored in an aggregated form associated with your account.
• Technical data — IP address and user-agent, collected only for security purposes (rate limiting, abuse prevention). Not used for tracking.

We explicitly do not:

• Store your chat conversations on our servers.
• Track you across other websites or services.
• Sell, rent, or trade your data to third parties.
• Use third-party advertising or analytics trackers.
• Collect your real name, address, phone number, or payment info.
• Store your IP address beyond the security purpose described above.
• Access your device's files, camera, or microphone.

Your data is used strictly to operate the Service:

• Authenticate you and keep your session active.
• Track your BuMoney balance and charge you per message.
• Allow administrators to approve accounts and adjust balances.
• Prevent abuse (spam, flooding, malicious activity).
• Respond to your support requests and legal inquiries.

We never use your data for marketing, profiling, or anything that isn't essential to running BuLumina.

Chat conversations are stored on our servers. Unlike some services, we retain a copy of every message you send and every response the AI generates. This is done for the following reasons:

• To calculate BuMoney charges accurately per message.
• To investigate abuse, spam, or policy violations.
• To comply with legal obligations and lawful requests.
• To improve the Service's reliability and safety.

Your chat history is not displayed in your own user interface after a session ends. To view your past conversations, contact the operator. Administrators may retain, export, or disclose chat data when required for the purposes above.

By using the Service, you acknowledge and consent to this storage and monitoring.

We do not share your personal data with third parties, except in the following limited circumstances:

• Legal obligation — if required by law, court order, or a valid legal request from a competent authority.
• Safety — to prevent imminent harm to yourself, another person, or the public.
• Service operation — your message content is sent to the AI model to generate a response (as described above).

Beyond these cases, no one outside our team ever sees your data.

We keep your data for the following periods:

• Account info (email, username) — until you delete your account.
• Chat messages & AI responses — retained indefinitely for safety, moderation, and legal compliance, unless deleted by an administrator.
• Balance & transactions — retained indefinitely for accounting purposes.
• Aggregated usage stats — anonymized, retained indefinitely.
• Security logs (IP, user-agent) — retained for a short period, then purged.

When you delete your account, most data is removed — but we may retain chat logs and metadata where required by law, for safety investigations, or to enforce our Terms.

We take security seriously. Our measures include:

• Bcrypt password hashing (industry-standard, salted).
• Signed JWT session tokens with HTTP-only cookies.
• Rate limiting on all authentication endpoints.
• Input validation and SQL injection prevention.
• Cross-site scripting (XSS) and CSRF protections.
• Admin panel accessible only from localhost.
• Content Security Policy (CSP) headers.

However: no system is 100% secure. While we make serious efforts to protect your data, we cannot guarantee absolute security. You use the Service at your own risk.

You have the following rights regarding your data:

• Access — see what data we have about you.
• Correction — update or fix inaccurate data.
• Deletion — request permanent deletion of your account and data.
• Portability — request a copy of your data in a common format.
• Objection — object to specific processing activities.

To exercise any of these rights, contact us on Discord. We aim to respond within a reasonable timeframe.

We reserve the right — and in many jurisdictions, the legal obligation — to report certain categories of content to the relevant authorities. This includes, without limitation:

• Child sexual abuse material (CSAM)
• Credible threats of violence or terrorism
• Content related to human trafficking or exploitation
• Other content that violates applicable criminal law

When we make such a report, we will disclose the relevant account details, chat logs, IP addresses, timestamps, and other data to law enforcement or the appropriate authority — without prior notice to you.

Users who generate or request such content will be permanently banned, and their account data will be preserved for authorities even if the account is deleted.

We use exactly one essential cookie:

• bulumina_token — a signed JWT that keeps you logged in. HTTP-only, same-site, expires after 24 hours. Not used for tracking.

We do not use advertising, analytics, or third-party cookies. We don't need a cookie banner because we don't do anything that would require one.

BuLumina is not intended for use by children under the age of legal majority in their jurisdiction. We do not knowingly collect data from children.

If you believe a minor has registered for the Service, please contact us immediately so we can disable the account and remove any associated data.

BuLumina is operated from Türkiye. If you access the Service from outside Türkiye, you understand that your data will be processed in Türkiye, where data protection laws may differ from those in your jurisdiction.

By using the Service, you consent to this transfer and processing.

We may update this Privacy Policy from time to time. When we do, the version number at the top of this page will be incremented.

Material changes will be announced on our Discord server. Continued use of the Service after changes are posted constitutes acceptance of the updated policy.

For any privacy-related questions, data access requests, or deletion requests, please reach out via:

• Discord: discord.gg/FgNCsEeNbD
• Direct contact with the operator — available on Discord

We take every privacy inquiry seriously and will respond as quickly as we reasonably can.