Privacy Policy

Lumi ("we", "us") provides personalised bedtime stories via lumi.app. Contact us at privacy@lumi.app.

We collect: • Parent's email address (for login and story delivery) • Interest tags you choose for your child (e.g. "animals", "ocean") • Chosen story world, voice, and learning path • Billing reference via Stripe (we never store card numbers) • Story delivery records (which levels were delivered) We do NOT collect: • Your child's real full name (only an optional nickname) • Date of birth or precise age • Photos or likeness of any child • Location data • Behavioural tracking of any child • Browser fingerprinting

Lumi is a service for parents. Children do not have accounts and do not interact with our platform directly. All information is provided by the parent account holder on behalf of their child. We comply with the Children's Online Privacy Protection Act (COPPA). We do not knowingly collect personal information from children under 13. If you believe we have inadvertently collected such information, contact us at privacy@lumi.app and we will delete it promptly. Parents may at any time: • Review data we hold by requesting a data export (Account → Export my data) • Update or correct information in Account settings • Delete all data (Account → Delete account)

• To deliver personalised story audio and scripts to your email • To maintain your story library • To send transactional emails (story delivery, payment receipts) • To improve the product using anonymised analytics (PostHog) We never sell your data. We never use your data for advertising.

If you record your voice for narration (an optional feature), your recording is stored privately in our cloud storage (Supabase). It is used only to narrate your account's stories. It is never shared, sold, or used to train AI models. You can delete your recording at any time from Account → Voice settings.

We retain data while your account is active. When you delete your account, all data is permanently deleted within 24 hours — including story instances, your child's profile, voice recordings, and auth credentials.

• Supabase (database + auth) — EU/US data storage • Stripe (payments) — PCI-compliant, we never see card details • Resend (email delivery) • DeepInfra (text-to-speech processing) • PostHog (anonymised analytics — IPs masked, inputs masked)

Depending on where you live, you may have rights under GDPR, CCPA, or similar laws, including the right to access, correct, or delete your data. To exercise these rights, use the tools in your account or email privacy@lumi.app.

We'll email you if we make material changes. The current version is always at lumi.app/privacy.

Questions? privacy@lumi.app