This Privacy Policy explains how Lumi (“Lumi”, “we”, “us” or “our”) collects, uses, discloses and protects personal information when you use the Lumi Reading Diary mobile app and related services (together, the “Service”).
Lumi is a children’s reading-tracking tool provided to schools. We handle most information about students on behalf of, and at the direction of, the school that enrols them. We are committed to handling personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).
This document is provided in good faith and reflects the Service’s actual data practices. It is not legal advice; we recommend it be reviewed by the operator and, if a registered entity operates Lumi, that the entity’s legal name and ABN be inserted here.
1. Information we collect
Account information
When a teacher, school administrator or parent/carer creates an account, we collect:
- name and the role you hold (parent/carer, teacher or school administrator);
- a mobile phone number (required for parent/carer accounts, and used for sign-in and reminders) and, optionally, an email address;
- for parents/carers, the relationship to the child (e.g. Mum, Dad, Guardian);
- the school and class you are associated with, and the link or school code used to join;
- an optional profile photo and chosen in-app character.
Account passwords are managed by our authentication provider (Google Firebase Authentication). We do not see or store your raw password.
Student information
Schools and the parents/carers and teachers they authorise enter information about students so reading can be tracked. This may include:
- the student’s name, class and year level, and (optionally) a date of birth and profile photo;
- reading level and the history of reading-level changes;
- reading activity — dates, minutes read, books read, how the child felt about the session, and any notes;
- optional short voice recordings of the child recapping what they read (the “comprehension recording” feature), where a school has turned this feature on;
- optional photos attached to a reading log;
- messages exchanged between a teacher and a parent/carer about a reading log.
Device and technical information
- a push-notification token, so we can deliver reminders and updates to your device;
- app version and device type where needed to operate the Service;
- optional crash reports and limited product-usage analytics, only where an adult account holder has enabled the relevant control on that device;
- information you provide when you contact support or send feedback.
2. How we use information
We use personal information to:
- provide the Service — record and display reading activity, progress and achievements;
- enable communication between teachers and parents/carers about a child’s reading;
- send reading reminders, achievement and comment notifications, and school announcements;
- operate and secure the Service, and—where an adult has opted in—troubleshoot and improve the app using pseudonymous crash reports or product-usage analytics;
- verify school enrolment and manage access entitlements; and
- respond to support requests and meet legal obligations.
We do not sell personal information, we do not use it for third-party advertising, and we do not track you across other companies’ apps or websites.
3. Children’s information
Lumi is designed to be used about children by the adults responsible for them — schools, teachers and parents/carers — rather than by young children independently. The school is responsible for ensuring it has the appropriate authority and parental consent to enter student information into the Service and to enable optional features such as voice recordings. Parents/carers can see the reading information for the child or children linked to their account. If you believe a child’s information has been provided to us without proper authority, contact us and we will work with the school to address it.
4. When we disclose information
We disclose personal information only as needed to run the Service:
- Within the school community: a child’s reading information is visible to that child’s teachers and school administrators, and to the parents/carers linked to the child.
- Service providers: we use Google Firebase (authentication, database, file storage, messaging, crash reporting and analytics) to host and operate the Service. These providers process data on our behalf under their own security and privacy commitments.
- Book look-ups: to fetch book titles and cover images we may send a book’s ISBN or title to public book databases (such as Google Books and the Open Library). No student information is sent in these look-ups.
- Legal reasons: where required by law, or to protect the rights, safety and security of users, the public or Lumi.
5. Storage, security and location
Information is stored using Google Cloud / Firebase infrastructure, with our primary database and file storage hosted in Australia (the Sydney australia-southeast1 region). Information is encrypted in transit and at rest, and access is restricted by authentication and security rules so that users can only reach the data they are entitled to. Some of our providers’ supporting systems (for example, crash-reporting and analytics processing) may operate outside Australia; where that occurs we take reasonable steps to ensure your information is handled consistently with the APPs.
6. How long we keep information
We keep personal information for as long as the related account or school relationship is active, and as needed to provide the Service. Access to a student’s data is tied to the school’s enrolment and annual renewal. When information is no longer required, or on a valid deletion request, we delete it or de-identify it, unless we are required to retain it by law.
7. Accessing, correcting or deleting your information
You may request access to, or correction of, the personal information we hold about you. Parents/carers can view and update much of their own and their child’s information in the app, and schools can manage student records directly. A parent/carer or teacher can permanently delete their own Lumi account from Settings → Account. This removes the login, memberships, direct attribution, authored messages and voice recordings. Core school reading events may be retained only in de-identified form so deleting an adult’s login does not silently erase a child’s educational record. A minimal completion receipt is retained for security and audit purposes for 90 days and then deleted.
Authorised school staff can permanently delete a student record and its linked reading history, messages, recordings, notifications and roster references. Deleting a student does not delete the accounts of their parents/carers. Because Lumi holds student information on behalf of schools, a parent/carer who wants a child’s school record deleted should contact the school or email support@lumi-reading.com; legal or school record-keeping requirements may apply. You may also use that address to request access or correction, or if the in-app account deletion flow is unavailable.
8. Push notifications and analytics
You can turn off push notifications at any time in your device settings. Product-usage analytics and crash reporting are separate, optional controls that are off by default. An adult parent/carer or staff account holder may enable or withdraw either choice at any time in Settings → Account → Privacy & diagnostics. Choices are stored on that device.
Lumi does not attach a Firebase account UID, child identity, school, book title, recording, note or detailed reading result to Analytics. Feature events omit reading duration and count, feelings, badge types and streak values. If enabled, Analytics uses a pseudonymous app-instance identifier. If enabled, a crash report may contain a stack trace plus app, operating-system and device diagnostics, but Lumi does not attach the account UID. These services are provided by Google Firebase, may be processed outside Australia, and are used only to improve reliability and usability—not for advertising or tracking across other companies’ services. Turning a control off stops future collection; Lumi also clears legacy identifiers and locally queued reports where the SDK supports that action.
9. Changes to this policy
We may update this Privacy Policy from time to time. When we do, we will revise the “Last updated” date above and, where appropriate, notify you in the app.
10. Contact us and complaints
If you have a question about this policy, or wish to make a privacy complaint, contact us at support@lumi-reading.com. We will acknowledge your complaint and respond within a reasonable period. If you are not satisfied with our response, you may contact the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au.