Privacy Policy

Last updated: October 19, 2026

1. Who we are

Lumba (“we”, “us”, “our”) is a service for organizing and joining pickup volleyball games in the Philippines, available as a mobile app and this web app. Lumba is currently operated as a solo project by the developer listed in Section 14 (Contact).

We are a Personal Information Controller under the Philippines’ Data Privacy Act of 2012 (Republic Act No. 10173, “DPA”). We process your personal data in accordance with the DPA, its Implementing Rules and Regulations, and the issuances of the National Privacy Commission (NPC).

2. Who Lumba is for

Lumba is intended only for adults aged 18 and over. You must provide your date of birth when you sign up. Accounts found to belong to someone under 18 will be deleted. If you believe a minor has created an account, contact us (Section 14) and we will delete it promptly.

3. What we collect

3.1 Account and identity

• Email address: for sign-in and account recovery.
• Date of birth: to confirm you are 18 or older. Other players see only a general age bucket, never the date.
• Display name, username (handle), profile picture: shown to other players on rosters, chat, and your profile.
• Home city, playing positions, height (optional): shown on your profile for matchmaking.
• Skill tier, XP, points, reliability score, ratings, games played/hosted: maintained by the service so other players can see your experience level.

3.2 Identity verification (optional)

Government IDs, ID numbers and selfies are sensitive personal information under the DPA. We collect them only after you read what happens to them and tick a consent box, and we record when you did.

• Verify ID: if you choose to verify your identity, you give us a photo of the front of a government ID, its ID type and number, your name and birth date as printed on it, and a live selfie. A Lumba administrator compares the ID photo, the selfie and your profile picture, and decides. Approval sets a “verified” badge on your profile.
• Organizer applications: if you apply to host games, we collect a photo of a government ID and its number with the details on the form (legal name, birth date, phone, GCash number), to reduce fake-organizer risk.
• Reading the ID on your device: before anything is uploaded, your browser reads the print on the ID photo and compares it with the name, birth date and number you typed. Only the result (match, different or could not read, and whether the ID looks expired) is sent with your submission, together with photo quality measurements and two fingerprints of the photo used to spot the same photo on another account. The text read from your ID stays on your device and is never sent to us. This is automated screening with human review: an administrator always makes the decision, the checks never approve or reject anyone on their own, and they do not prove an ID is genuine. We do not use automated face recognition.
• ID numbers: your full ID number is not saved with your submission. We keep its last 4 characters and a keyed, scrambled code that cannot be reversed without our secret key, used only to flag the same ID on another account.
• Who sees it: only Lumba administrators who review ID checks. The photos sit in private storage with no public link, are opened through short-lived links, and every time an administrator opens one is recorded in our audit log. Other users never see your ID, your ID number or your selfie.

3.3 Content you create

• Games you host and games you join (RSVPs).
• Direct messages: visible only to you and the recipient, and automatically deleted 24 hours after sending.
• Clubs, teams, leagues, tournaments you create or join, and announcements you post in them.
• Voice rooms: live voice chat is transmitted in real time via our audio provider (LiveKit) and is not recorded or stored by us. Room titles and membership are stored.
• Player ratings, reports, and feedback you submit.

3.4 Social graph

Follows are visible to other signed-in users. Blocks are private. The blocked person is never notified and cannot see the block.

3.5 Location

• On the web, if you use “games near you” or “players nearby”, your browser asks for a one-time location fix used to sort results. On mobile, list sorting uses a one-time foreground fix and the map uses a foreground-only stream.
• Your precise device location is not stored on our servers and never shown to other users. We never use background location.

3.6 Technical data

• Push notification token (mobile): cleared on logout and account deletion.
• Crash and error reports (device model, OS, app/browser version) so we can fix bugs.
• Product analytics: we measure which features are used (e.g. “joined a game”) via PostHog, tied to your user ID, to improve the product. We do not sell this data or use it for third-party advertising.

3.7 Purchases and advertising

Lumba is free to play. The mobile app shows ads (Google AdMob) and offers one optional one-time purchase, Remove Ads. Purchases are processed by Apple or Google. We never see or store your card details; we receive only an entitlement flag via RevenueCat. On iOS, without App Tracking Transparency consent, ads are non-personalized. The web app currently shows no ads and sells nothing.

4. How we use your data

To operate your account; let you find, join, and host games; run clubs, teams, leagues, tournaments, chat, and voice rooms; match you with appropriate games; keep the service safe (reports, blocks, verification review, abuse detection); operate purchases and ad suppression; fix bugs; and comply with legal obligations. We do not sell your personal data and do not use it to train third-party AI models.

5. Legal bases (DPA)

Contract (delivering the service you signed up for), legitimate interests (safety, debugging), consent (verification selfie, organizer ID, location, push notifications, personalized ads, each withdrawable at any time), and legal obligation.

6. Who we share data with

Only the processors needed to run the service, under their standard data-processing terms:

Some processors are outside the Philippines (mainly the US/EU); we transfer only what each needs, relying on their contractual commitments to comparable protection as the DPA permits. We may also disclose data under a valid legal order or to protect someone’s life, health, or property.

Other users can see: your display name, handle, avatar, skill tier, verified badge, home city, positions, age bucket, follower counts, games hosted, ratings received, and messages you send them. They can never see: your email, date of birth, location, verification selfie, ID photo, ID number, purchase history, blocks, or reports.

7. Voice rooms (RA 4200 & RA 11313)

Voice rooms are live, group audio. Before your first time joining, we show a consent screen that explains the following.

• We do not record voice rooms. Audio is streamed live to the other people in the room and is never captured, archived, or stored by us, consistent with the Anti-Wiretapping Act (RA 4200). There is no recording feature in the app.
• Audio provider. Live audio is transported by LiveKit, Inc., our real-time voice processor. Audio streams may pass through LiveKit servers outside the Philippines (primarily the US/EU) for the moment you are connected; they are not persisted.
• We keep metadata, not audio (room title, membership, join/leave activity, and any reports), used only to run the feature and investigate abuse. Retention is in Section 8.
• Your controls. You can mute yourself at any time, block a user (blocked users can never share a room with you), and report a participant for harassment, gender-based harassment (RA 11313 Safe Spaces Act), hate speech, sexual content, minor-safety concerns (RA 7610), or spam. Room hosts can mute or remove participants. Reports go to a moderation queue for human review.
• Age. Lumba is for users 18 and older (Section 2), so voice rooms are adults-only.

8. How long we keep it

9. Your rights under the DPA

You have the rights to be informed, to access, to correct, to erase, to object, to data portability, to damages, and to file a complaint with the National Privacy Commission. You can edit your profile and delete your account permanently yourself, on the web (Settings → Account → Delete account) or in the mobile app (Profile → Delete account). Deletion is immediate and irreversible: it removes your account, RSVPs, DMs, follows, blocks, ID photos, selfies and ID check records, and anonymizes your chat and ratings. For anything else, email us (Section 15); we respond within the DPA’s required time (generally 15 working days).

10. Security

TLS everywhere; row-level security on every database table; Supabase-managed authentication (we never see passwords); private storage buckets with short-lived signed URLs for sensitive files (selfies, IDs), opened only by administrators and logged each time; ID numbers kept only as a keyed hash plus the last 4 characters; least-privilege server functions. No online service is 100% secure. If a breach is likely to put your rights at serious risk, we will notify the NPC and affected users within 72 hours of knowledge, as DPA IRR §38 requires.

11. Cookies and local storage

The web app uses strictly necessary browser storage (Supabase auth session in localStorage/cookies) to keep you signed in, plus analytics storage if PostHog is enabled. We do not use third-party advertising cookies on the web. The mobile app uses device-local storage (SecureStore/AsyncStorage) for your session and preferences.

12. International transfers

See Section 6. Transfers are limited to what each processor needs, under their standard contractual protections.

13. Changes to this Policy

If we make a material change we will update the date above and show an in-app notice; where the DPA requires it, we will ask for renewed consent.

14. Related documents

Please also read our Terms of Service.

15. Contact

For any privacy question, access, correction, or deletion request, or DPA complaint: srgtylr@gmail.com. (Personal inbox while Lumba is a solo project; a dedicated support address will be announced in-app when available.)