Lumette Privacy Policy
Lumette is a product-transparency app for parents. This policy explains what information the Lumette mobile app collects, what stays on your device, what we do with information we hold, and the choices you have. Lumette is offered to users in the United States.
1. Information we collect and store on our servers
| Category | Examples | Why |
|---|---|---|
| Account profile | An Apple or Google account identifier and any email address, display name, and profile photo URL supplied by that sign-in provider. Approved preview testers may instead receive an anonymous Firebase identifier. | Authenticate your account and sync data across devices |
| Activity | Account-linked barcode lookup, missing-product submission, and change-report records created while answering a scan; products and brands you watch | Answering scans, maintaining your watchlist, and sending the change alerts you asked for |
| Location area | ZIP codes you choose to track (up to 10), whether your water source is municipal or well, and the public water system you select when multiple systems serve a ZIP | Showing the correct water-quality data for your area. We never collect precise (GPS) location. |
| Preferences | Notification settings, product-category interests selected during setup, and members you choose to block | Apply your choices and hide content you do not want to see |
| Device token | A push-notification token for your device | Delivering alerts (formula changes, acquisitions, water updates) |
| Contributions | Reviews you post (shown to other paid members with your display name), product photos you submit, missing-product submissions, and change reports | Community features you choose to use |
| Purchase state | Subscription entitlement status from RevenueCat (we never see your card number) | Operating the subscription |
| Optional diagnostics and usage | If you turn on “Share diagnostics & analytics” in Settings: installation-level screen and feature interactions, app/device and OS information, crash logs, and non-fatal diagnostic details. Exact barcodes, ZIP codes, and public-water-system identifiers are excluded from telemetry. | Fixing bugs, measuring reliability, and improving the app |
| Service and security records | Account-linked request, error, rate-limit, deletion, and moderation audit records generated while operating the service | Providing support, preventing abuse, securing accounts, and completing requested actions |
2. Information that stays on your device only
The app keeps local copies of the following on your phone for offline use and faster loading:
- Your chronological scan-history list, plus cached copies of products you've viewed, watchlists, reviews, and water preferences. The chronological scan-history list stays on this device and is not synchronized to Lumette's database;
- An onboarding-completion marker and, if profile sync is interrupted, the setup choices waiting to sync.
Account-owned local data is cleared when you sign out. Deleting the app also deletes app-local data. Your device's own OS backup may include it under your device settings. Items described in Section 1 may also be synchronized to our servers.
3. Children's privacy
Lumette is built for parents and is not directed to children. The Service is limited by our Terms to adults, and we do not knowingly collect personal information from anyone under 13. The current app does not ask for a child's name, age, allergy, or health information. If you believe a child has provided us personal information, contact us at support@getlumette.com and we will delete it.
4. How information is used
We use the information in Section 1 to operate the app: looking up products you scan, maintaining your watchlists and history, sending the alerts you enabled, showing water data for your tracked ZIP codes, managing your subscription, moderating community contributions, and diagnosing crashes. We collect optional app-interaction analytics and client crash diagnostics only after you turn that setting on. We do not use your information for third-party advertising, and we do not build advertising profiles.
5. When information leaves the app
Service providers (processors)
- Google Firebase (Google LLC) — authentication, database, push notifications and, only when you opt in, analytics and client crash reporting. Our servers run on Google Cloud in the United States.
- RevenueCat — subscription management. Receives a user identifier and purchase receipts from Apple/Google.
- Expo — checks for and delivers app updates and receives the technical request information needed to do so.
- OpenAI (when enabled) — receives an ingredient name and selected public-source facts to draft ingredient copy, or a brand name plus limited product, category, and market hints to locate sources for company facts. These jobs do not send your name, email, Firebase account identifier, exact barcode, ZIP code, selected public water system, review text, or push token. Company claims are published only after Lumette independently re-fetches and confirms the cited page; ingredient copy remains subject to Lumette's source and publication controls.
We require service providers to process information only to provide their services to Lumette and to protect it consistently with this policy and applicable law.
Public data services (lookups we make on your behalf)
To answer your scans, the app queries public databases — Open Food Facts / Open Beauty Facts / Open Products Facts (product barcodes), Wikidata (brand names), PubChem (ingredient names), U.S. EPA services (water-system identifiers for your ZIP), Clearbit (brand-to-domain matching), and Logo.dev (brand logos). These requests carry the minimum needed for the lookup (for example, a barcode, brand name, ingredient name, or ZIP), not your Lumette name, email, or user ID.
Everyone else
We do not sell personal information, we do not share it for cross-context behavioral advertising, and we disclose it otherwise only if required by law, to protect rights and safety, or as part of a corporate transaction (in which case this policy continues to apply to information collected under it).
6. Member-visible content
Reviews you post are visible to other paid members along with your display name. Product photos you submit may, after moderation, be shown to paid members attached to the product. Don't include personal information in either.
7. Retention and deletion
We keep account information while your account exists. You can delete your account in the app (Profile → Settings → Delete Account), which permanently deletes your server profile, watchlists, water tracking, reviews, moderation reports, blocked-member preferences, records, pending submissions, and account-owned photos from our servers, and clears the device-local scan history on the device where you request deletion. Product photos you submitted are also removed if they were published on a product page. De-identified factual product information created from an approved submission may remain in the product catalog. App-store and subscription processor transaction records, and aggregated analytics or security records, may remain where required for accounting, fraud prevention, dispute handling, or legal compliance, subject to the provider's retention controls. Subscription billing is managed by Apple/Google and must be cancelled in your store account settings; deleting your account does not automatically cancel a subscription. You may also request deletion by emailing support@getlumette.com.
8. Your choices
- Diagnostics and analytics — optional and off by default. Turn “Share diagnostics & analytics” on or off at any time in Profile → Settings. Turning it off stops future uploads from this device.
- Notifications — every alert type can be turned off in the app or at the OS level.
- ZIP codes — add or remove tracked ZIPs at any time.
- Camera — used only when you open the scanner; you can revoke permission in device settings (scanning won't work without it).
- Reviews and photos — you can delete your own reviews in the app. To remove a pending submitted photo, delete your account or contact support.
- Community blocking — reporting a member can hide that member's reviews. Review or clear your blocked-members list in Settings.
9. California residents
If you are a California resident, the CCPA/CPRA gives you rights to know, correct, and delete personal information, and to opt out of "sale" or "sharing." We do not sell or share personal information as those terms are defined in the CPRA, and we do not use sensitive personal information beyond what is necessary to provide the service. The categories we collect are listed in Section 1 (identifiers, commercial information, internet activity, user content, diagnostics, and coarse geolocation at ZIP level). To exercise any right, use the in-app deletion flow or email support@getlumette.com; we will verify requests via your account email and will not discriminate against you for exercising your rights. Authorized agents may submit requests with proof of authorization.
10. Security
Data in transit is encrypted (TLS), server data is stored on Google Cloud with per-user access rules enforced at the database layer, and paid access is enforced by server-owned entitlement records. Payment-card data is handled by Apple or Google and is not provided to Lumette. No system is perfectly secure; notify us of any suspected vulnerability at support@getlumette.com.
11. Changes
We'll update this policy as the app evolves, change the effective date above, and — for material changes — notify you in the app before the changes take effect.
12. Contact
VNRI LLC
Wyoming, United States
support@getlumette.com