Lumi Privacy Policy

DRAFT, NOT LEGAL ADVICE. This document was prepared from the app's actual data flows as a starting point. Have a qualified lawyer review and adapt it before you publish or submit to the App Store / Play Store. The remaining [PLACEHOLDER]s are operator-specific (legal name, address, DPO) and must be filled before publishing.

Effective date: 2026-06-04

Last updated: 2026-10-22

Lumi ("Lumi", "the app", "we", "us") is a habit tracker with a companion character. This policy explains what personal data we process, why, on what legal basis, and the choices and rights you have.

1. Who is responsible (controller)

The controller for the processing described here is:

• Operator: [OPERATOR LEGAL NAME]
• Address: [Straße und Hausnummer], [PLZ] [Ort], Deutschland
• Contact: support@lumihabits.app
• Data protection contact: support@lumihabits.app

If you are in the EU/EEA or the UK, this policy is written to align with the GDPR / UK GDPR. References to "personal data" and "processing" use those laws' meanings.

2. What data we process

We try to collect only what the app needs to work.

a) Account data

• Email address and an authentication credential when you sign up with email and password, OR your Google account identifier and email when you sign in with Google. Authentication is handled by Google Firebase Authentication; we do not store your raw password.
• Display name (optional, used in the app and on share cards).

b) Habit and progress data

• Habits you create (name, category, schedule, icon, optional description), completion logs, current and longest streaks, earned currency ("Lumen" / experience points), and level.

c) Mood data

• Mood check-ins you choose to log (mood type, intensity, optional free-text notes, timestamp). This is data about your wellbeing; we treat it with care and never sell it.

d) Companion, garden, and collection data

• Your chosen companion, its name and customization, your in-app meadow/garden items and placements, and which achievement cards you have unlocked.

e) Referral data

• Your referral code, the fact that you were invited by another user (if applicable), and how many people redeemed your code.

f) Legacy AI companion chat data

• The AI chat feature was removed on 2026-07-16. Current app versions use deterministic on-device companion questions and do not send those answers to an AI provider. Accounts that used an older version may still have recent chat messages stored in their account until they delete the account or request deletion. Confirm the deployed backend and legacy-data retention before publishing this draft.

g) Notifications

• If you enable notifications, a push token (from the Expo push service) so we can deliver reminders.

h) Device and diagnostic data

• Crash and error reports via Sentry to keep the app stable. These are tied to your Firebase user id only; we do not attach your name or email to them. They may include technical context (device/OS, app version, error details).

i) Usage statistics

• A few product events, so we can see whether the app works for people: that the app was opened (at most once a day), that onboarding was finished, that a habit was completed, that the garden was opened and that a garden item was bought (which item). Each event carries your Firebase user id, the time, the platform (iOS or Android) and the app version. No name, no email, no habit names, no mood entries and no free text. They are sent to PostHog's EU servers (Frankfurt) and are used only in aggregate, for example to see how many people come back after a week.

We do not use third-party advertising, we do not build advertising profiles, and we do not knowingly collect precise location data.

3. Why we process it, and the legal basis (GDPR Art. 6)

We do not use your data for automated decision-making with legal or similarly significant effects.

Editor note (remove before publication): under the German TDDDG (§ 25), storing or reading information on your device for usage statistics may need your consent. Before a public release, the app gets an opt-in for usage statistics in Settings, and this section is updated. Lawyer review pending.

4. Companion prompts and legacy AI processing

Current companion questions and follow-up messages are selected from local, prewritten rules. They are not generated by an AI provider. Mood entries and button choices are processed as part of the app features described in Section 2.

Before 2026-07-16, the retired chat feature sent user messages and limited app context to OpenRouter, which could route requests to an underlying model provider. No new transfer should occur from the current app path. Before publishing this policy, verify the deployed backend and remove or retain this historical disclosure according to the actual retention and availability of old app versions.

5. Service providers (processors) and recipients

We share data only with providers that help us run Lumi, under contracts that require them to protect it:

We do not sell your personal data.

6. International transfers

Some current providers (for example Google, Sentry, Expo and Vercel) may process data on servers outside your country, including in the United States. Where data leaves the EU/EEA or UK, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses and/or an adequacy decision. You can request more detail at the contact above.

7. How long we keep data

• Account, habit, mood, companion, garden, and any retained legacy chat data: for as long as your account exists, then deleted within 30 days of account deletion, except where we must keep limited records to meet legal obligations.
• Diagnostic/crash data: a rolling retention window set in Sentry (90 days).
• Usage statistics: 12 months in PostHog, then deleted.
• Backups may persist for a short additional period before rotation.

8. Security

We use industry-standard measures including encrypted transport (HTTPS/TLS), authenticated access, and server-side database rules that restrict each user's data to their own account. No method of transmission or storage is perfectly secure, but we work to protect your data and to notify you and authorities of breaches where the law requires.

9. Your rights

Depending on where you live, you have the right to:

• Access the personal data we hold about you;
• Rectify inaccurate data;
• Erase your data ("right to be forgotten");
• Restrict or object to certain processing;
• Data portability (receive your data in a portable format);
• Withdraw consent at any time (for example, turn off notifications), without affecting prior lawful processing;
• Lodge a complaint with your local data protection supervisory authority.

To exercise any right, email support@lumihabits.app. We will respond within the timeframe the law requires (under GDPR, normally within one month).

10. Deleting or exporting your data

• Deletion: You can delete your account and all associated data at any time inside the app under Settings → Delete account. This permanently removes your account, habits, completion logs, mood entries, companion and garden data, any retained legacy chat history, and your sign-in, and cannot be undone. You can also request deletion by emailing support@lumihabits.app.
• Export: Request a copy of your data at support@lumihabits.app and we will provide it in a portable format within the timeframe the law requires.

11. Children

Lumi is not directed to children. You must be at least 16 years old (or the minimum digital-consent age in your country, and at least 13) to use it. If we learn we have collected data from a child below that age without the required parental consent, we will delete it.

12. Our website (lumihabits.app)

The website is hosted by Vercel Inc. (USA). When you open a page, the hosting servers process technical data your browser sends with every request: IP address, date and time, the page requested, and browser and device type. This is needed to deliver the page and keep it secure (legitimate interest, GDPR Art. 6(1)(f)); Vercel keeps these logs for a limited time under its standard retention rules.

The website sets no cookies, runs no analytics or tracking, and loads its fonts and images from its own server, not from third parties. On an invite link (/i/<code>), the code is read from the address by your browser and only shown to you; the page sends it nowhere.

13. Changes to this policy

We may update this policy. We will post the new version with an updated date and, for material changes, provide a more prominent notice in the app.

14. Contact

Questions or requests: support@lumihabits.app [Vor- und Nachname], [Straße und Hausnummer], [PLZ] [Ort], Deutschland