Privacy Policy

1. Introduction

LumiFrame (“we,” “us,” or “our”) operates a digital photo-frame mobile application available on iOS and Android (the “App”). This Privacy Policy describes what information we collect, why we collect it, how we use and share it, and the choices available to you.

By creating an account or using the App you agree to the practices described in this Privacy Policy. If you do not agree, do not use the App.

2. Information We Collect

2.1 Information You Provide

• Account Information: Email address, display name, and profile photo when you register (directly or via Google, Microsoft, or Apple sign-in).
• User Content: Photos, videos, albums, captions, comments, reactions (including GIFs selected through the Giphy integration), and any other material you upload or create.
• Communications: Any messages you send to our support channels.
• Gift Purchases: If you buy a gift subscription on our website, see Section 2.7.

2.2 Information Collected Automatically

• Device Information: Device model, operating system version, unique device identifiers, battery status, and app version.
• Network Information: IP address and Wi-Fi network name. Wi-Fi network name is used solely for local cast-device discovery (e.g., Chromecast, AirPlay) and is not transmitted to our servers.
• Photo Metadata: If your photos contain embedded EXIF data (including GPS coordinates, camera model, and timestamps), that metadata is stored alongside the photo. We do not independently track your device’s live GPS location.
• Usage Data: App interactions, feature usage, session duration, and navigation paths.
• Crash and Performance Data: Crash reports, error logs, and performance metrics collected via Sentry.
• Software Update Information: App identifier, release and patch version, platform, device architecture, and an anonymous per-app client identifier used by Shorebird to check for and deliver corrective software patches. Shorebird and its infrastructure providers may also process network metadata such as IP address.

2.3 Advertising and Tracking

LumiFrame does not show ads on any tier and does not collect ad-interaction data to serve advertising. We do not use platform advertising identifiers for ad personalization in the live product.

2.4 Information from Third-Party Sign-In

When you authenticate with Google, Microsoft, or Apple, we receive only basic profile information (name, email, and profile photo) as authorized by you during the sign-in flow. We do not receive or store your password for those services.

2.5 Personalized Storytelling Signals

To create personalized Home observations, LumiFrame may derive structured signals from information already associated with your account, such as upload and engagement counts, dates, album or place labels you provided, approved display names, frame activity, and links to the memories supporting an observation. These signals are used to select and ground the observations shown to you. Automatic Home observations and weekly Reflections wording are compiled from facts without calling a text-generation model.

2.6 Recognizing People in Your Photos (Optional, Off Until You Turn It On)

Recognize People lets your Reflections books name the people in your photos. It is off until you turn it on, and nothing described in this section happens before you do. You can turn it off at any time in Reflections settings.

• What happens on your device: When Recognize People is on, the LumiFrame app on your phone or tablet finds faces in your photos and creates a numerical description of each face (a “face template”) so it can group photos of the same person. Face templates are created, compared, and stored only on that device. They are never uploaded to LumiFrame, never sent to any other company, and never used to identify anyone outside your own photos.
• What is saved to your account: When you name a person, we save the name you typed, an internal identifier for that person, and references to a few of your own photos with the position of that person’s face in each (a rectangle, not a face template). For a face you have not named yet, we save a reference to one of your photos and the position of the face in it, so your other devices can ask you about it too. This lets your other devices recognize the same person by examining those photos themselves. We also keep a record of when you turned Recognize People on or off and when you deleted names, so we can honor your choices on every device.
• Who can see it: Only you. Names and face positions are not shown to the people in your photos or to anyone you share albums with, are never sold, and are never used for advertising or to train any model.
• The people in your photos: The people who appear in your photos have not agreed to be recognized. Please name only people who would be comfortable with it, and delete a name if that person asks you to.
• Turning it off: Turning Recognize People off stops face detection and erases the face templates on that device right away, and on your other devices the next time each of them runs LumiFrame. The names you added stay on your account so that turning it back on finds the same people again, until you delete them. Faces you had not named are removed from your account.
• Deleting names: “Delete Names” in Reflections settings removes every name, the photo references and face positions saved for each person, and any links between a named person and your connections, from your account and from each of your devices. Weekly books that were already made keep the words they were written with.
• Devices on which you never answer: If a device already holds face templates from an earlier version of the app and you have not answered, that device stops creating new ones immediately and erases the ones it has after 30 days.
• Web: The LumiFrame website never detects or compares faces.

2.7 Gift Subscriptions

When someone buys a LumiFrame gift subscription on our website, we collect:

• From the buyer: the name they want the gift to come from, their email address (entered at checkout), the note they write, the gift they chose, the delivery date and time zone they picked, and, if they are signed in, their LumiFrame account.
• About the recipient: the name the buyer gives, and the recipient’s email address if the buyer asks us to email the gift. The recipient has not given us this information themselves.
• Payment: Gifts are sold through Link, Stripe’s checkout, which acts as the merchant of record. Stripe collects the payment details and billing location (to work out tax) and handles them under its own privacy policy. We receive a record of the payment (amount, currency, tax, and Stripe’s reference numbers) and the buyer’s email, but never the card number or other payment credentials.
• When the gift is claimed: which LumiFrame account claimed it and when, and the dates the gift period starts and ends.
• If the buyer attaches an album: which of their albums it is. When the gift is claimed we invite the claiming account to that album from the buyer’s account, the same as any album invitation, and again if that invitation expires unanswered; if the recipient accepts, the buyer and the album’s other members can see them as a member.

We use this information only to deliver the gift, let it be claimed, apply it to the claiming account, send the buyer a receipt and tell them when the gift is claimed, handle refunds and disputes, and prevent fraud. We do not add the recipient to any mailing list or send them anything other than the gift email unless they create an account. We do not sell any of it.

The gift code itself is kept only until every email that carries it has been sent; after that we keep only a one-way fingerprint of it, which is how a claim is matched.

3. How We Use Your Information

• Provide the App: Account info, user content, and device info to operate and maintain the service.
• Authentication & Security: Email, OAuth tokens, biometric verification data, and device keys to authenticate your identity and secure your account.
• Sync & Storage: User content and device identifiers to sync content across your devices.
• Sharing & Social: User content, display name, and profile photo to enable sharing and social features.
• Notifications: Device push tokens and user preferences to send push notifications about activity on your content.
• Gift Subscriptions: Buyer and recipient details described in Section 2.7, to deliver, claim, and apply a gift, send receipts, and handle refunds and fraud.
• Diagnostics: Crash data, device info, and usage data to diagnose crashes, errors, and performance issues.
• Software Updates: App version, platform, architecture, and an anonymous per-app client identifier to check for, download, validate, and measure delivery of corrective software patches.
• Analytics: Usage data and feature engagement metrics to analyze aggregate usage and improve the App.
• Recognizing People (only if you turn it on): Names you add and the photo references and face positions described in Section 2.6, to show the people you named in your Reflections books on each of your devices. Face templates never reach us.
• Personalized Narration: Structured activity facts, memory labels, dates, and account preferences to select grounded Home observations and compose weekly Reflections wording. This automatic wording is compiled from facts without a text-generation model; opening Home does not trigger a model request.
• Enforcement: Account info, device info, and usage data to enforce our Terms of Service and detect abuse.
• Legal Compliance: As required by applicable law.

4. Legal Bases for Processing (EEA/UK Users)

If you are located in the European Economic Area or the United Kingdom, our legal bases for processing your personal data are:

• Contract: Processing necessary to provide the App and fulfill our agreement with you (account management, content storage, sharing features, and delivering a gift you bought).
• Consent: Where you have given explicit consent, including for Recognize People (Section 2.6), optional push notifications, and device-level permissions. You may withdraw consent at any time through device or App settings; for Recognize People, turn it off in Reflections settings.
• Legitimate Interests: Processing necessary for our legitimate interests that are not overridden by your rights, including product improvement, security, fraud prevention, and emailing a gift to the person a buyer named as its recipient.
• Legal Obligation: Processing necessary to comply with applicable law.

5. How We Share Your Information

We do not sell your personal information. We do not use your photos or videos for advertising purposes.

We may share information in the following circumstances:

• With Other Users: Content you share to frames and albums is visible to users you invite. Your display name and profile photo are visible to users you interact with. If you buy a gift, the name and note you enter are shown to its recipient, and the buyer is told the recipient’s name and the gift’s end date when it is claimed.
• Service Providers: Third-party companies that process data on our behalf to help operate the App (see Section 6).
• Legal Requirements: When we believe in good faith that disclosure is required by applicable law, regulation, legal process, or enforceable governmental request.
• Safety: To protect the rights, property, or safety of LumiFrame, our users, or the public.
• Business Transfers: In connection with a merger, acquisition, bankruptcy, or sale of all or substantially all of our assets. You will be notified via in-app notice or email before your data is transferred.

6. Third-Party Services

The App integrates with the following third-party services. Each service processes data under its own privacy policy.

• Supabase: Authentication, Postgres database, realtime subscriptions, and Edge Functions. Supabase Privacy
• Sentry: Error tracking, crash reporting, and performance monitoring. Sentry Privacy
• Shorebird: Delivery of corrective Dart-code patches between normal App Store and Google Play releases. Shorebird receives release and device-compatibility metadata plus an anonymous per-app client identifier; it does not receive LumiFrame account details or user photos and videos through the update check. Shorebird Privacy
• Cloudflare (R2 & Workers): Media object storage, content delivery, and media gateway. Cloudflare Privacy
• Giphy: GIF search and selection within comments. Giphy Privacy
• OpenAI (moderation): Checks comments, and community posts and their titles, for abuse before they are published. OpenAI receives only the text of what you wrote, not your name, email, or photos. OpenAI Privacy
• PostHog: Product analytics. PostHog receives app usage events (such as app opens, screens viewed, and features used), device and app version information, IP address, and your LumiFrame account identifier once you sign in. We use it to understand aggregate usage, not for advertising. PostHog Privacy
• Firebase (Google): Firebase Cloud Messaging delivers push notifications and receives your device’s push token and each notification’s title, text, and in-app link. Firebase App Check receives a device attestation from Apple or Google to confirm requests come from the genuine App. Some older accounts also have a sign-in record in Firebase Authentication, which we delete when you delete your account. Firebase Privacy
• Google Photos, Dropbox, and Microsoft OneDrive (only if you connect them): When you connect one of these accounts, we use the access you grant to browse, show, or import the photos and videos you choose. Each provider receives those requests under its own privacy policy. Google Privacy, Dropbox Privacy, Microsoft Privacy
• Google Cloud Vertex AI (Gemini models): Where a feature you enable uses Gemini, we provide only the inputs needed for that requested feature. Automatic Home observations and weekly Reflections wording are compiled from facts without calling Gemini or another text-generation model. Vertex AI Data Governance
• Apple / Google (In-App Purchases): Subscription billing and payment processing. We do not receive or store your payment card details.
• RevenueCat: Manages in-app subscriptions on our behalf. RevenueCat receives your LumiFrame account identifier, your App Store or Google Play purchase and subscription records, and basic device and app information, and tells us which plan is active. It does not receive your payment card details. RevenueCat Privacy
• Stripe (Link): Sells gift subscriptions bought on our website as merchant of record and processes the payment. Stripe receives the buyer’s payment details, email, and billing location, and the gift details needed to show the purchase (the plan, the recipient’s name and email, and the buyer’s note). We do not receive or store card details. Stripe Privacy
• Resend: Delivery of transactional email, including gift emails and receipts. Resend Privacy

7. Advertising and Tracking

LumiFrame does not show ads on any tier and does not use advertising identifiers.

8. Data Security

We use commercially reasonable technical and organizational measures to protect your information, including:

• All data transmitted between the App and our servers is encrypted using HTTPS/TLS.
• Sensitive credentials (device authentication tokens, third-party OAuth tokens) are stored on-device using the platform’s secure keychain (iOS Keychain / Android EncryptedSharedPreferences) and are not backed up or synced across devices.
• Biometric authentication (Face ID, Touch ID, fingerprint) is available for App lock. Biometric data never leaves your device; we verify a cryptographic signature produced by the device’s secure enclave, not the biometric itself.
• Authenticated API access and Postgres row-level security policies protect account data and user content.
• User content is served over HTTPS via Cloudflare’s global CDN.

No method of electronic transmission or storage is 100% secure. While we strive to protect your information, we cannot guarantee absolute security and accept no liability for unauthorized access resulting from circumstances beyond our reasonable control.

9. Data Retention and Deletion

• Active Accounts: We retain your data for as long as your account exists and as necessary to provide the App.
• Account Deletion: You may permanently delete your account at any time from App settings. Deletion is processed immediately and includes removal of your profile, all uploaded media from Cloudflare R2, social data, device registrations, and related account records.
• Anonymization: Where your content has been shared with other users (e.g., comments on others’ posts), references to your account are anonymized to “Deleted User” to preserve the integrity of other users’ content.
• Recognizing People: Face templates exist only on your devices and only while Recognize People is on; they are erased when you turn it off, when you sign out of LumiFrame on that device, when you delete the app, or when you delete your account. Names are kept until you delete them or your account. A photo reference is removed when you delete that photo.
• Gift Subscriptions: Gift purchase records, including the buyer and recipient details in Section 2.7, are kept for as long as we need them for accounting, tax, refunds, and disputes. A recipient or buyer may ask us to delete their name and email from a gift record sooner by writing to [email protected]; we will do so unless we must keep it to meet a legal obligation. Deleting the account that claimed a gift removes the link between that account and the gift.
• Backups: Residual copies may persist in automated infrastructure backups for a limited period (typically up to 30 days) before being overwritten.
• Legal Holds: We may retain data longer where required by applicable law or to resolve ongoing disputes.

10. Your Privacy Rights

10.1 All Users

Regardless of where you live, you may:

• Access and update your account information in App settings.
• Download a copy of your account data at any time from Settings → Account → Privacy & Legal → Download my data. The file is machine-readable JSON and links each of your photos and videos to its original.
• Delete individual photos, videos, albums, or comments at any time.
• Delete your entire account and all associated data from App settings.
• Manage push-notification preferences in App or device settings.
• Manage device-level privacy permissions in your system settings.
• Turn Recognize People on or off, and delete every name you added, in Reflections settings.
• Use Home “Why this?” controls to show less of a type of observation or prevent a person, place, or memory from appearing in future observations where that control is available.

10.2 California Residents (CCPA/CPRA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act, as amended by the California Privacy Rights Act:

• Right to Know: You may request the categories and specific pieces of personal information we have collected about you. You can also download a copy yourself in the App (Section 10.1).
• Right to Delete: You may request deletion of your personal information, subject to certain exceptions.
• Right to Correct: You may request correction of inaccurate personal information.
• Right to Opt-Out of Sale/Sharing: We do not sell personal information. We do not “share” personal information for cross-context behavioral advertising.
• Non-Discrimination: We will not discriminate against you for exercising your privacy rights.

Categories of personal information collected in the preceding 12 months: Identifiers (name, email, device IDs); commercial information (gift purchases); internet activity (usage data); audiovisual information (photos, videos); geolocation (photo EXIF metadata only); inferences drawn from the above. We do not collect biometric information on our servers: face templates for Recognize People are created and kept only on your devices (Section 2.6).

To exercise your CCPA/CPRA rights, email [email protected].

10.3 EEA and UK Residents (GDPR / UK GDPR)

If you are in the European Economic Area or United Kingdom, you have the following rights:

• Access: Request a copy of the personal data we hold about you.
• Rectification: Request correction of inaccurate data.
• Erasure (“Right to Be Forgotten”): Request deletion of your personal data.
• Restriction of Processing: Request that we restrict how we use your data in certain circumstances.
• Data Portability: Receive your data in a structured, commonly used, and machine-readable format. Download it yourself from Settings → Account → Privacy & Legal → Download my data, or ask us and we will fulfill the request within 30 days.
• Object: Object to processing based on legitimate interests or for direct marketing.
• Withdraw Consent: Where processing is based on consent, withdraw it at any time without affecting the lawfulness of prior processing.
• Lodge a Complaint: You have the right to lodge a complaint with your local data-protection supervisory authority.

To exercise these rights, contact [email protected]. We will respond within 30 days.

10.4 Canadian Residents (PIPEDA)

Canadian users may request access to, correction of, or deletion of their personal information by contacting us at [email protected].

11. Children’s Privacy

LumiFrame is not directed at children under the age of 13 (or the applicable minimum age in your jurisdiction, for example 16 in certain EU member states). We do not knowingly collect personal information from children under this age.

If you are a parent or guardian and believe your child has provided us with personal information, please contact us immediately at [email protected] and we will delete that information promptly.

12. International Data Transfers

Your information is processed and stored on servers operated by our service providers, which may be located in the United States and other countries outside your jurisdiction. These transfers are necessary to provide the App.

Where data is transferred from the EEA/UK to countries not deemed to provide an adequate level of protection, we rely on the safeguards provided by our service providers, including Google’s and Cloudflare’s data-processing agreements and Standard Contractual Clauses approved by the European Commission.

13. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. When we make material changes, we will:

• Update the “Last Updated” date at the top of this page.
• Provide notice through an in-app notification or, where practicable, by email.

Your continued use of the App after the updated Privacy Policy takes effect constitutes your acceptance of the changes. If you do not agree, you should stop using the App and delete your account.

14. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices:

Privacy inquiries: [email protected]
General support: [email protected]
Website: https://lumiframeapp.com