Lumor Inc. (“Lumor”, “we”) makes the Lumor app, which creates an illustrated bedtime story for a named child. This policy explains what we collect, why, who processes it for us, and how to make us delete it.
It is written for the person who installs the app: a parent or guardian. Lumor is not intended to be used by a child directly, and we do not knowingly create accounts for children.
What we do not do
We state these first because they shape everything below.
- We do not sell or rent personal data, and we do not share it with data brokers.
- We show no advertising and use no advertising SDKs.
- We do not use the device’s advertising identifier (IDFA), and we do not build device fingerprints.
- We do not track you across other companies’ apps or websites.
- Stories are private to the account that created them. Nothing you make is published, listed or made searchable by us.
What we collect
- Your e-mail address, if you choose to save your stories — to sign you in and restore your library on a new device.
- The child’s first name, age, and the sentence describing how they look — to write the story and draw the character.
- What you ask the story to be about — for the same reason.
- The stories and illustrations produced for you — so you can read them again.
- An internal account identifier — to connect your stories, purchases and events to your account.
- App events, such as screens opened, buttons used, a story created, and the child’s age — to understand which parts of the app help and which do not.
- Crash reports and error diagnostics — to find and fix defects.
- Purchase and subscription status — to unlock what you paid for and restore it later.
- A push notification token, if you allow notifications — to tell you when a story is ready.
You can use Lumor without giving us an e-mail address. On first launch the app creates an anonymous account on your device, and the first story is free. An e-mail address is collected only if you ask us to keep your stories, or if you sign in with Apple or Google, in which case we receive the e-mail address that service releases to us.
We do not ask for, and do not want, a child’s surname, photograph, address, school, contact details or location.
Children’s information
The name, age and description you type are information about a child, and we treat them accordingly.
- They are provided by you, the adult account holder, and only at your initiative. Nothing in the app asks a child to enter anything about themselves.
- We use them to generate that child’s story and character and for nothing else. We do not use them to advertise, profile, or build audiences.
- They are deleted when you delete the child, the story, or the account.
- Where the law requires a parent’s consent for processing a child’s information, your use of the app to create a story constitutes that consent, and you can withdraw it at any time by deleting the data as described below.
If you believe a child has created an account without your permission, contact us and we will delete it.
Who processes data for us
We use these providers, and only for the purposes listed. They act on our instructions and may not use your data for their own purposes.
- Supabase — hosts our database, file storage and sign-in.
- OpenAI — generates the story text from what you typed.
- fal.ai — generates the illustrations.
- PostHog — receives the app events described above.
- Sentry — receives crash reports; we do not send it your account identifier.
- RevenueCat and Apple — process and restore purchases.
- Expo — delivers push notifications.
The child’s name, age and description are sent to OpenAI and fal.ai as part of the instruction to write and draw the story. We do not permit them to use that material to train their models.
Legal bases
Where the UK GDPR or EU GDPR applies:
- Performance of a contract — creating, storing and restoring your stories, and processing purchases.
- Legitimate interests — keeping the service working and secure, and understanding how it is used, balanced against your interests as described in “What we do not do”.
- Consent — push notifications, and processing a child’s information where consent is the required basis. Withdraw either at any time.
How long we keep it
Stories, characters and account data are kept until you delete them or delete your account. Deleting your account removes them from our systems, and from backups within 30 days.
Crash reports are kept for 90 days. App events are kept for 12 months.
Your rights
You may ask us to give you a copy of your data, correct it, delete it, or stop processing it. You may also complain to your data protection regulator; in the United Kingdom this is the Information Commissioner’s Office.
The fastest route is the app itself: Settings → Delete Account removes your account and everything in it. To exercise any other right, or if you cannot reach the app, write to us at the address below and we will answer within one month.
Links you create
If you create a link to one of your stories to send to someone, anyone holding that link can open that story. The link is not listed or searchable, and you can revoke it at any time in Settings → Manage shared links.
Where your data is held
We are based in the United States and our providers operate internationally. Where data leaves the United Kingdom or the European Economic Area, it is transferred under the safeguards required by law, such as the UK Addendum and the European Commission’s standard contractual clauses.
Changes
If we change what we collect or why, we will update this page and change the date at the top. Material changes will be announced in the app before they take effect.
Contact us
Lumor Inc. — privacy@lumor.art — https://www.lumor.art/contact