Privacy Policy

1. Who we are

Lumi ("Lumi", "the app") is provided by [Company legal name], [Registered address] ("we", "us", "our"). We are responsible, as the data controller, for the personal data processed through the app and our servers.

Contact: [Contact email: [email protected]]

[If required: our representative in the EU (Art. 27 GDPR) and in the UK: name and address.]

2. The short version

• Lumi has no accounts. We never ask for your email, phone number, contacts, photos or location.
• When you talk to Lumi, or use features such as Lumi's diary or bedtime stories, what they need goes to our server and to our AI provider, WaveSpeed AI, only so that a reply can be generated. Our server does not store it, and our logs do not contain message text. [Confirm WaveSpeed's data-retention and no-training terms]
• Lumi answers in text, with a little babble that your iPhone makes on its own. No voice is generated on our server or by anyone else.
• Your pet, your chat history and everything Lumi remembers about you are stored on your iPhone. If you use iCloud, a backup is also kept in your own private iCloud storage, which we can't access. You can delete them at any time.
• Our server keeps a small amount of data: a random device identifier, the app version and language, your wallet (your stars and things, and a record of how you earned and spent them), daily usage counts, anonymous usage statistics (you can turn these off), crash and performance reports, your Lumi+ and purchase records, and, only if you turn them on or send them, your Friends profile and any reports.
• No ads, no third-party analytics, no tracking, and we do not sell your data.

3. What data we process

3.1 Data stored on your device

• Your pet: its name, colour, growth stage and needs.
• A copy of your wallet (your stars, outfits, room decor, food and other things), and changes made offline that haven't reached our server yet. The wallet itself is kept on our server (section 3.4).
• How your pet's room is arranged, and the state of your purchases.
• Your wallet's restore key (section 3.4), kept in the iOS Keychain.
• The name you ask Lumi to call you.
• Your birthday (month and day), used for the age check and to celebrate your birthday. The age check (section 10) uses your full date of birth, but the year is not saved.
• "Memories": short facts Lumi has learned about you (up to 60, or up to 200 with Lumi+), shown in Lumi's diary.
• Lumi's diary entries.
• Your self-care check-ins (a mood from 1 to 5 and an optional note) and your water and bedtime habits.
• Lumi's vocabulary: the words it has learned from what you say.
• The bedtime stories Lumi has told you.
• Your friends list: your friends' codes and their pets' public profiles (section 3.4).
• Your recent conversation history (up to the last 200 messages).
• App settings.
• An access token for our server, kept in the iOS Keychain.

This data stays in the app's private storage on your iPhone, which only Lumi's home-screen widget can also read. We cannot see it. If you have iCloud Backup or computer backups turned on, iOS may include it in those backups. You and, for iCloud, Apple control those backups.

iCloud backup. If you're signed in to iCloud, Lumi saves a compressed copy of your game in your own private iCloud key-value storage at Apple, so that you can restore your pet on a new iPhone. The copy contains the data listed above except the server access token, and keeps only the last 30 chat messages. We cannot access it. "Start over with a new egg" erases it, but deleting the app does not. Your wallet's restore key is kept separately in the same iCloud storage, and "Start over with a new egg" does not erase it, so your stars and things stay with you (section 3.4). If you aren't signed in to iCloud, nothing is backed up.

3.2 Microphone and speech

• Lumi uses the microphone only while you hold the talk button, both in conversation mode and in Repeat mode.
• Your speech is converted to text on your iPhone by Apple's speech recognition. On devices or in languages where on-device recognition isn't available, iOS may send the audio to Apple's speech recognition service, and Apple processes it under its own privacy policy. We never receive your audio. When you send a message to Lumi, we receive only the text.
• In Repeat mode, Lumi plays your recording back in a funny voice on your device. The recording is not saved and is not sent anywhere.
• Lumi answers in text, in a speech bubble, together with "Lumi-speak": a cute babble that your iPhone makes on its own, offline. Bedtime stories are shown as text, with the current line highlighted, together with Lumi-speak. No voice is generated on our server or by any other company.

3.3 Data sent to generate replies and other content (not stored on our server)

The app contacts our server when you talk to Lumi, when Lumi greets you after you've been away, and when it updates its memories. Each time, it sends:

• your message, or for a memory update, up to the last 20 messages of the conversation;
• up to 12 recent messages for context;
• up to 30 of Lumi's memories about you;
• your name and your pet's name, stage, mood, needs and favourite foods;
• with a message, up to 20 words Lumi has recently learned from you;
• the app's language and your device's local time (including the time-zone offset), whether today is your birthday (sent only on that day), and, for a greeting, how many hours you were away.

Some features send other content:

• "Lumi writes first": up to 30 of Lumi's memories about you, up to 20 words Lumi has recently learned from you, your name, your pet's details listed above and your local time. Our server writes up to 3 short messages, which your iPhone schedules as local notifications.
• Lumi's diary: the day's counts (how many times you fed, washed, played with, talked to and petted Lumi, and your check-in mood if you gave one), up to 5 short highlights (up to 120 characters each) from your own messages that day, your name, your pet's details and your local time. Our server writes that day's diary page. The notes you add to check-ins are not sent.
• Bedtime stories: your name, your pet's details, up to 30 of Lumi's memories about you and your local time. Our server writes a story.
• Lumis meet (with a friend): our server uses both pets' public profiles, which it already stores for Friends (section 3.4), to write a short dialogue.

Lumi's replies, diary pages, stories, dialogues and messages, and the new short facts it picks out about you, are written by an AI model that our AI provider, WaveSpeed AI, runs for us (section 6). Our server adds its own instructions to the content above, sends it to WaveSpeed and gets the text back. It then checks the text and sends the result to your device to be saved there. The content is sent to WaveSpeed only to generate that result.

On our server, this content is held in memory only while the request is handled. It is not saved in our database or written to our logs. How long WaveSpeed keeps it, and whether WaveSpeed may use it for anything else: [Confirm WaveSpeed's data-retention and no-training terms].

3.4 Data stored on our server

• Device record: a random identifier that our server creates the first time the app connects, the platform (iOS), the app version, the app language, the date the record was created, and which wallet the device is linked to.
• Wallet: your stars and things are kept on our server, so that they can't be faked and can come back on a new iPhone. A wallet is not an account: it has no name, email address or Apple ID, only a random identifier. Each device record is linked to one wallet. The wallet holds your star balance; the things you own (outfits, room decor, food and how many of each, colours, the feeder with its portions, and streak charms); your login streak as our server counts it, your best streak and the last day you logged in; how many surprise boxes you have opened since your last rare-or-better prize, which the box odds take into account; game-day records (the current and the previous game day, when the current day started and your last time-zone offset); how many times each kind of reward was earned on each game day, to apply daily caps; and when the wallet was created, when stars from an older version of the app were moved into it, and the week you last got the Lumi+ charm.
• Wallet ledger: a record of every earn, spend and use operation: the operation ID, its kind, its source (such as "quest" or "item"), a reference (such as a quest or item ID, or a day key), the change in stars, the result (accepted or rejected, with the reason, and for a surprise box, the prize), the game day and the time. The app sends operations ("quest done", "hat bought"), never amounts. Our server checks each operation against the game's rules and decides the result. Rejected operations are deleted after 90 days.
• Restore key: the app creates a random wallet key and keeps it in the iOS Keychain and in your private iCloud key-value storage. Our server stores only its SHA-256 hash, never the key itself. On a new iPhone signed in to the same iCloud account, the app sends the key, and our server links the new device to your wallet. Your stars and things come back without an account.
• Daily usage counters: how many times each feature with a daily limit was used each day: conversation messages, greetings, memory updates, bedtime stories, "Lumi writes first" messages, diary pages, Lumis-meet dialogues, reports, diagnostics uploads, gifts, friend requests, gift-code redemptions and restore-key link attempts. We use them to apply the daily limits.
• Subscription record (only if you subscribe to Lumi+): the expiry date of your subscription, Apple's original transaction ID and the installations the subscription is active on (at most 3). To confirm a purchase, the app sends our server the transaction record signed by Apple, and we check Apple's signature. We do not receive your name, Apple ID, email address or payment details.
• Purchases (only if you buy something): for star packs, "+50 talks", Lumi+ gift months and one-time unlocks, we keep Apple's transaction ID, the product, the time and what was credited. For a gift code, we keep the code and when, and by which installation, it was created and redeemed. If you buy talks, we also keep your balance of bought talks. Stars and things you buy are credited to your wallet. If Apple refunds or revokes a purchase, we record when it was revoked and remove what it gave from your wallet. As with subscriptions, we check Apple's signature and do not receive your name, Apple ID, email address or payment details.
• Friends (only if you turn it on; it is off by default): when you turn on "Share my Lumi with friends", we store your pet's public profile: its name, colour, growth stage, outfit, personality trait, room layout, number of achievements and number of words learned. We also store your friend code and your friend links (who is friends with whom, and since when). Your friends see your pet's profile and when it was last updated. There are no messages or other free text between users. The only text you choose is your pet's name, which we check with a word filter. Gifts between friends (the catalog item, the sender's pet name, and when the gift was sent and claimed) are kept for 90 days. A gift is paid for from the sender's wallet when it is sent. Turning sharing off deletes your public profile from our server, so your friends no longer see your pet. Your friend code and friend links stay until you remove those friends.
• Anonymous usage statistics: the app sends simple usage events, such as app opened, onboarding step finished, pet hatched, message sent (by voice, by text or in Repeat mode), care actions, game played (with a score range, not the score), paywall shown, purchase started or completed, quest or achievement completed, and new growth stage. They never contain message text or memories. Our server keeps only how many times each event happened each day for your device identifier and discards everything else. You can turn this off in Settings › Analytics ("Share anonymous usage stats"), and events that haven't been sent yet are then deleted. Nothing is sent before you pass the age check and your pet hatches (or is restored from iCloud).
• Experiment groups: when we test a variation of a feature, our server assigns your installation to a group based on its identifier and records which group it is in and since when.
• Diagnostics: crash and hang reports and daily performance metrics from Apple's MetricKit (for example, call stacks, exception codes, launch time, responsiveness, memory and battery use, and the app and iOS versions). They contain no message text. Like usage statistics, they are sent only after the age check and hatching. The Analytics switch does not turn them off.
• App Attest: to tell the real app from scripts, requests from the app carry a signature made with Apple's App Attest. We store the key identifier, its public key, a counter and the date the key was registered, together with your device record. The one-time challenges used to register a key expire after 5 minutes. Our server rejects wallet and AI requests that don't come from the genuine app. This is a security measure, not tracking. Messages that suggest self-harm are always answered (section 11).
• Reports (only if you send one): the Lumi reply you report, the message of yours that came before it, the reason you choose, any comment you add, the time, and your device identifier.

3.5 Technical data

• IP address: our server uses it to deliver responses and to limit request rates against abuse. Our server code keeps it only in memory and does not write it to the database. [Confirm whether the hosting provider's load balancer or ingress keeps access logs with IP addresses and, if so, for how long.]
• Server logs: time, the type of request (for some Friends requests, the request address includes a friend code), response status and timing, and a shortened, hashed form of the device identifier. Logs never contain message text.
• Time: our server's responses carry the server time, and the app uses it to count game days. Wallet requests carry your device's local time (with the time-zone offset) and your pet's growth stage. Our server uses them to work out your game day and the limits for your pet's stage. It keeps the game-day records listed under "Wallet" (section 3.4), but not your local time or the stage you send.

3.6 What we don't do

• We show no ads and include no third-party analytics, advertising or tracking SDKs. The app contains no third-party code. Usage statistics and diagnostics (section 3.4) go only to our own server.
• We do not track you across other companies' apps or websites.
• We do not sell your personal data or share it for advertising.
• We do not use your conversations to train AI models, and we don't store them. [Confirm WaveSpeed's data-retention and no-training terms]

4. Why we use data and our legal bases

If the EU or UK GDPR applies to you, we rely on the following legal bases:

Microphone and speech recognition access depend on your permission in iOS, and you can turn them off at any time (section 9.1). Lumi makes no decisions about you that have legal or similarly significant effects.

5. How long we keep data

6. Who we share data with

• Our hosting provider, [Hosting provider name], which runs our servers and database in [Server hosting region] on our behalf and under our instructions.
• Our AI provider, WaveSpeed AI, which runs the AI model for us through its API (WaveSpeed's OpenAI-compatible LLM API). Our server sends WaveSpeed the content described in section 3.3, only to generate Lumi's reply, diary page, story, dialogue or messages, or to update Lumi's memories, and gets the text back. WaveSpeed processes this content on our behalf, as our processor. Requests reach WaveSpeed from our server, not from your iPhone, so WaveSpeed does not receive your IP address. Processing location: [WaveSpeed processing location/country]. Retention and use: [Confirm WaveSpeed's data-retention and no-training terms]. [Counsel to confirm the data processing agreement with WaveSpeed.]
• Apple. Apple processes App Store payments and subscriptions under its own privacy policy, and we receive only the signed transaction records described in section 3.4. Apple's App Attest service helps us confirm that requests come from the genuine app. Apple may also process your audio if iOS uses Apple's speech recognition service (section 3.2), the iCloud backup of your game (section 3.1), and your device backups if you use iCloud Backup. Lumi's reminders, including "Lumi writes first" messages, are local notifications scheduled on your iPhone, and no push service is used for them. The text of "Lumi writes first" messages is written by our server (section 3.3).
• Your friends in Lumi (only if you turn on Friends): they see your pet's public profile, when it was last updated, and the gifts you send them, with your pet's name.
• Authorities or other parties when the law requires it, or when it is necessary to protect the rights, safety or property of our users, the public or us.
• A successor business if we are involved in a merger, acquisition or sale of assets. We will tell you before your data becomes subject to a different privacy policy.

The AI model that powers Lumi is Google Gemma 4 (31B), an open-weight model. We don't run it on our own servers: WaveSpeed AI runs it for us, as described above. We don't send your conversations to any other AI company. [Counsel to confirm whether the app must ask for your permission before your content is sent to WaveSpeed (Apple guideline 5.1.2(i), GDPR). If so, describe that step here.]

7. International transfers

Our servers are located in [Server hosting region]. If you use Lumi from another country, the data described in sections 3.3–3.5 will be transferred there. Where data protection law requires it (for example, for transfers from the EEA, the UK or Switzerland to a country without an adequacy decision), we use appropriate safeguards such as the European Commission's Standard Contractual Clauses [to confirm]. You can contact us for a copy of these safeguards.

The content sent to WaveSpeed AI (section 3.3) is processed in [WaveSpeed processing location/country].

• Users in the EEA, the UK or Switzerland: for this transfer we rely on [an adequacy decision / the European Commission's Standard Contractual Clauses]. [Counsel to confirm]
• Users in Russia: we notify Roskomnadzor of this cross-border transfer of personal data, as Federal Law No. 152-FZ requires. [Counsel to confirm]

8. Security

• All traffic between the app and our server, and between our server and WaveSpeed AI, is encrypted with HTTPS (TLS).
• Each installation authenticates with its own signed token, and our server applies rate limits to prevent abuse.
• Requests from the app carry an Apple App Attest signature, so that our server can check they come from the genuine Lumi app.
• We keep server-side data to a minimum. Conversation content is not stored on our server, and logs contain no message text and identify your device only by a shortened, hashed identifier.
• Our server stores only a SHA-256 hash of your wallet's restore key, not the key itself.
• Data on your iPhone is protected by iOS app sandboxing and device encryption. The access token is stored in the Keychain and is not transferred to other devices.
• Access to our servers and database is limited to people who need it to run Lumi [confirm].

No system is completely secure. If a personal data breach affects you, we will notify you and the authorities where the law requires us to.

9. Your rights and choices

9.1 On your device (takes effect immediately)

• Delete a memory: open Lumi's diary, tap the memory, then tap "Forget this".
• Start over: go to Settings → "Start over with a new egg" and confirm. This deletes your pet, its memories, your chat history, diary and check-ins from this iPhone, and erases the iCloud backup of your game. Your stars and things are kept in your wallet for your new Lumi, and the restore key stays in your Keychain and iCloud. It does not cancel a subscription. If you turned on Friends, it also deletes your public profile from our server (when the app can reach it). It does not delete your device record, your wallet or your friend links on our server (see 9.2).
• Usage statistics: turn off Settings › Analytics › "Share anonymous usage stats". Events that haven't been sent yet are deleted from your iPhone.
• Friends: in More (…) › Friends, turn off "Share my Lumi with friends" to delete your public profile from our server. You can also remove friends there.
• Microphone, speech recognition, notifications: you can turn these off at any time in iOS Settings, and you can turn reminders off in Lumi's Settings. You can still type to Lumi.
• Deleting the app removes Lumi's game data from your iPhone. It does not delete the iCloud backup of your game (section 3.1) or your wallet on our server. The restore key may stay in your Keychain and iCloud, so if you install Lumi again, your stars and things come back. Copies in existing device backups remain until those backups are replaced or deleted.

9.2 Data on our server

To request a copy of your server-side data, or its correction or deletion, email [Contact email: [email protected]] with the subject "Privacy request". Because Lumi has no accounts, we may need information to find the record that belongs to your installation. If you subscribed, the Order ID from your Apple receipt email lets us find your subscription record. If you didn't subscribe, include the support code from Settings › About Lumi › Support code (tap "Copy full code"). We will not ask for more information than we need, and we will use it only to handle your request.

The app has no button yet for deleting your data from our server. To have your device record and your wallet deleted, email us at [Contact email: [email protected]] as described above. Deleting your wallet also deletes your stars and things, including those you bought with real money, and we cannot bring them back. It does not cancel a Lumi+ subscription; cancel that through Apple. [In-app deletion of server data: To decide]

9.3 If the GDPR or UK GDPR applies to you

You have the right to access your personal data, correct it, have it deleted, restrict or object to its processing (including processing based on legitimate interests), and receive it in a portable format. Where we rely on consent, you can withdraw it at any time. We reply within one month, which the law allows us to extend in some cases. You also have the right to complain to your local data protection authority.

9.4 If you live in California (CCPA/CPRA)

To the extent the CCPA applies to us:

• Categories of personal information we collected in the last 12 months: identifiers (a random device identifier, a random wallet identifier and the hash of your wallet's restore key, your friend code if you use Friends, and an App Attest key identifier; IP address, processed in memory only); commercial information (Lumi+ subscription status, purchase records with Apple's transaction IDs, gift codes, your balance of bought talks, and your wallet: stars, things and the ledger of how they were earned and spent); the contents of reports you send; your pet's public profile, if you share it with friends; and internet or other electronic network activity (daily usage counters, anonymous usage statistics, experiment groups, diagnostics, server logs). Sources: you and your device, and Apple for purchase records. Purposes: those listed in section 4. Retention: section 5.
• We disclose personal information only to service providers (our hosting provider and our AI provider, WaveSpeed AI) for business purposes. If you turn on Friends, your pet's public profile is shown to the friends you connect with, at your direction.
• We do not sell or share personal information, as those terms are defined in the CCPA, including personal information of consumers under 16. We do not use sensitive personal information to infer characteristics about you.
• You have the right to know, access, correct and delete your personal information, and the right not to be discriminated against for exercising these rights. You can make a request yourself, or through an authorized agent, using the contact details in section 9.2. We respond within 45 days, which the law allows us to extend in some cases.

9.5 Other places

Depending on where you live, you may have similar rights under local law, such as the privacy laws of other US states. Contact us and we will respond as the applicable law requires.

10. Children

Lumi is intended for people aged 13 and older, and the app asks for your date of birth before you start. Usage statistics and diagnostics are not sent until it is passed. Lumi is not directed to children under 13, and we do not knowingly collect personal information from them. If you are under the age at which your country allows you to use online services without a parent's consent, please use Lumi only with a parent's or guardian's involvement.

If you are a parent or guardian and believe a child under 13 has used Lumi and sent us personal information, for example in a report, please contact us at [Contact email: [email protected]]. We will delete it. Anything stored on the device can be erased right away in Settings (section 9.1).

11. About Lumi's AI

• Lumi is an AI character, not a person. The app says so during onboarding, in Settings and on the conversation screen.
• Lumi's replies, diary pages, bedtime stories, "Lumi writes first" messages and Lumis-meet dialogues are generated automatically by Google Gemma 4 (31B), an open-weight large language model that our AI provider, WaveSpeed AI, runs for us (section 6). They are not written by people, and nobody on our team reads your conversations.
• Instructions for the model are assembled only on our server. Replies pass through safety rules and an output filter.
• If a message suggests self-harm or suicide, Lumi does not send it to the AI model. Instead it replies with a supportive pre-written message that includes helpline information.
• Lumi's memories are created by the AI model from your recent messages (section 3.3) and stored only on your device. You can review and delete them at any time.
• AI replies can be wrong or inappropriate. You can report any reply by long-pressing Lumi's speech bubble.

12. Changes to this policy

We may update this policy as Lumi changes or the law changes. We will change the effective date above. If a change is significant, we will tell you in the app or on our website before it takes effect.

13. Contact

[Company legal name]
[Registered address]
[Contact email: [email protected]]