Privacy Policy

Who We Are

LUMINI is a personal journalling and self-reflection application ("the App") operated by Furnitique Ltd. ("we", "us", or "our"), a company incorporated in Bulgaria.

This Privacy Policy explains how we collect, use, store, and protect your personal information when you use LUMINI on iOS or Android devices.

If you have any questions about this policy, please contact us at support@getlumini.app.

Information We Collect

We collect information in two ways: information you provide directly, and information generated automatically when you use the App.

Information you provide:

• Account information: your first name and email address, collected when you create an account.
• Journal entries: text you write in the journal, including mood logs and free-form reflections.
• Dream records: entries you save in the Dream Archive.
• Goals and tasks: goals, intentions, and tiny tasks you create within the App.
• Tarot and AI interactions: questions you ask and card draws you save.
• Onboarding preferences: your stated intentions and notification preferences set during setup.

Information collected automatically:

• Usage data: timestamps of when entries are created or updated, feature usage patterns, and session activity. This is used solely to provide and improve the service.
• Device information: your device type and operating system version, collected by our infrastructure when you connect to our servers.
• Purchase information: when you subscribe to a paid plan, Apple or Google processes your payment. We receive only a confirmation token — we never see your payment card details or billing address.

How We Use Your Information

We use your information only for the following purposes:

• To provide the App: storing your entries, syncing data across sessions, and enabling all App features.
• To power AI features: when you use AI-assisted features (such as tarot interpretations, journalling prompts, or the Autopilot feature), the relevant content is sent to our AI proxy service, which calls OpenAI's API on your behalf. This content is used only to generate the response for you in that moment.
• To authenticate you: verifying your identity when you sign in.
• To manage your subscription: confirming your access to paid features.
• To send service communications: transactional emails such as password resets and email confirmations. We do not send marketing emails without your explicit consent.
• To improve the App: understanding aggregate usage patterns to fix bugs and improve features. This analysis is based on anonymised or aggregated data where possible.

We do not:

• Sell your personal data to any third party.
• Use your journal entries, dreams, or personal reflections for advertising purposes.
• Use your data to train AI or machine learning models.
• Share your personal data with any third party for their own marketing purposes.

Legal Basis for Processing (EEA & UK Users)

If you are located in the European Economic Area (EEA) or the United Kingdom, we process your personal data under the following legal bases under the General Data Protection Regulation (GDPR) or UK GDPR:

• Contract performance: processing your account data, journal entries, and subscription status is necessary to provide you with the App as agreed in our Terms of Service.
• Legitimate interests: processing aggregate usage data to improve the App, provided this does not override your rights and interests.
• Legal obligation: retaining certain records as required by applicable law.

We do not rely on consent as a legal basis for processing your core account or content data, because you need this processing to use the App.

Third Parties We Work With

We work with a small number of trusted third-party service providers. Each acts as a data processor on our behalf and is contractually required to protect your data.

Supabase (database & authentication)
All your account data, journal entries, and App content are stored in Supabase, a cloud database platform. Supabase stores data on servers located in EU West (Ireland), on AWS (eu-west-1). Supabase is GDPR-compliant and we have entered into a Data Processing Agreement with them. Learn more at supabase.com/privacy.

OpenAI (AI features)
When you use AI-powered features in LUMINI, the relevant content is sent to OpenAI's API via our own secure proxy. OpenAI processes this content only to generate a response and does not use it to train its models under our API agreement. Learn more at openai.com/policies.

Apple Inc. (iOS subscriptions & payments)
If you subscribe to LUMINI on iOS, your payment is processed entirely by Apple through In-App Purchase. We receive only a purchase receipt to confirm your subscription status. Apple's privacy policy applies to that transaction.

Google LLC (Android subscriptions & payments)
If you subscribe to LUMINI on Android, your payment is processed entirely by Google through Google Play Billing. We receive only a purchase token to confirm your subscription status. Google's privacy policy applies to that transaction.

Google Fonts
The App loads fonts from Google Fonts, which means Google's servers receive your device's IP address when the App starts. This is standard practice for font delivery. Google's privacy policy governs this interaction.

Business Transfers

If we are involved in a merger, acquisition, financing, reorganisation, or sale of all or a portion of our assets, your personal data may be transferred as part of that transaction. We will notify you via an in-app notice or email before your personal data is transferred and becomes subject to a different privacy policy.

In the event of such a transfer, we will require the acquiring party to honour this Privacy Policy or provide you with at least as much protection as described here. If you do not agree to the new terms, you will have the right to delete your account before the transfer takes effect.

Legal Requests & Law Enforcement

We may disclose your personal data if we believe in good faith that doing so is necessary to:

• Comply with a legal obligation, court order, subpoena, or lawful request from a government or law enforcement authority.
• Protect and defend our legal rights or property.
• Prevent or investigate potential wrongdoing in connection with the App.
• Protect the personal safety of users of the App or the public.

Where permitted by law, we will attempt to notify you before disclosing your data in response to such a request. We will disclose only the minimum amount of information necessary to comply with the legal obligation.

International Data Transfers

LUMINI is operated from Bulgaria. If you are located in the EEA, UK, or Australia, your personal data may be transferred to and processed in countries outside your jurisdiction, including the United States, where our service providers (Supabase, OpenAI) are based.

When we transfer data from the EEA or UK to the United States, we rely on Standard Contractual Clauses (SCCs) approved by the European Commission, and on our Data Processing Agreements with each provider, to ensure your data receives an adequate level of protection.

For Australian users, we take reasonable steps to ensure overseas recipients handle personal information in a manner consistent with the Australian Privacy Principles.

How Long We Keep Your Data

We keep your personal data for as long as your account is active. If you start a free trial but do not subscribe, we keep your data so you can return and pick up where you left off. If your account stays inactive for 24 months (no sign-in and no active subscription), we will delete your personal data. You can delete it sooner at any time from Settings.

When you delete your account:

• Your journal entries, dream records, goals, tasks, and profile data are permanently deleted within 30 days.
• Your authentication record is deleted from Supabase Auth.
• Anonymised, aggregated usage statistics (which cannot be linked back to you) may be retained indefinitely for product improvement purposes.
• We may retain certain records for longer if required by law (for example, financial records related to subscription transactions).

Your Rights

Depending on where you live, you have the following rights over your personal data. To exercise any of these, contact us at support@getlumini.app.

EEA/UK users: You also have the right to lodge a complaint with your local data protection authority (e.g., the ICO in the UK, or your national DPA in the EU).

California users (CCPA): LUMINI has not sold or disclosed any personal information to third parties for commercial purposes in the preceding 12 months, and we will not do so in the future. Under the CCPA, you have the right to know what personal information we collect and how it is used, to request deletion of your data, and to opt out of any future sale of your personal information. We will not discriminate against you for exercising any of these rights.

Australian users: You may complain to the Office of the Australian Information Commissioner (OAIC) if you believe we have breached the Australian Privacy Principles.

How we verify your identity: When you submit a data access, correction, or deletion request, we need to verify that you are the account holder before we can act on it. We will do this by matching information you provide against what we have on file (such as your registered email address). We will only use the information you provide for verification purposes, and will delete any additional information collected for verification as soon as the process is complete. If we cannot verify your identity from the information we already hold, we may ask for additional confirmation.

Authorised agents: You may designate an authorised agent to submit privacy requests on your behalf. We may require the agent to provide proof of written authorisation from you, and may verify your identity directly before processing the request.

Do-Not-Track & App Tracking Transparency

Some mobile operating systems include a Do-Not-Track ("DNT") preference or a similar opt-out signal. On iOS, this is Apple's App Tracking Transparency (ATT) framework; on Android, it is the "Opt out of Ads Personalisation" setting.

LUMINI does not track you across third-party apps or websites for advertising purposes, and we do not use your data for ad targeting. Because we do not engage in cross-app tracking, ATT or DNT signals do not change how we handle your data — your information is handled as described in this policy regardless of your device tracking settings.

There is currently no uniform standard for responding to DNT signals from web browsers. If such a standard is adopted that we are required to follow, we will update this section accordingly.

Children's Privacy

LUMINI is not directed at anyone under the age of 16. We do not knowingly collect personal information from people under 16. If you believe someone under 16 has provided us with personal information, please contact us and we will delete it promptly.

Security

We take reasonable technical and organisational measures to protect your personal data, including:

• All data is transmitted over encrypted connections (TLS/HTTPS).
• Authentication is handled by Supabase Auth, which uses industry-standard security practices including bcrypt password hashing.
• Access to the database is restricted to authorised services only.

No method of transmission or storage is 100% secure. In the event of a data breach that is likely to result in a risk to your rights, we will notify you and the relevant authorities as required by law.

Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will notify you via an in-app notice or email at least 14 days before the changes take effect. The "last updated" date at the top of this page will always reflect the most recent version.

Your continued use of the App after changes take effect constitutes acceptance of the updated policy.

Contact Us

If you have any questions, requests, or concerns about this Privacy Policy or how we handle your data, please reach out.