Lulora Privacy Policy

The short version

Before the legal detail, the six things that matter most. Everything here is expanded below.

• Your phone number is your account. There is no password. You sign in with a one-time code we text you.
• Anyone who is holding a Lulora link can play the recording it points to. There is no sign-in and no check of who they are. If a link gets forwarded, the access goes with it. This is the single most important thing to understand about Lulora.
• You give us other people's names and phone numbers — the people you send to, invite, or add to your Crew. Those people never agreed to anything. We treat their information carefully, and they can write to us and have it removed.
• We do not sell your information, we do not advertise, and there is no analytics SDK, no tracking pixel, and no cookie in the product today.
• Your recordings live in private storage and are played through short-lived signed links. We keep them until they are deleted.
• When you open and play an Ember, the person who sent it is told. That is the point of the product, and it is also information about you going to someone else.

1. Notice at Collection

This section is the summary California and other US state privacy laws require you to see at or before the point of collection. Every item is expanded later in this policy.

• What we collect: your mobile phone number; your first and last name, and the display name formed from them; optionally your email address; optionally a profile photo; your voice recordings; the names, phone numbers and email addresses of people you send to, invite, or add to your Crew; the "Open when…" moment tag a sender chooses for an Ember; a Time Capsule's open date; Crew relationship details such as per-person mute settings and how many Embers you and that person have exchanged; lifecycle timestamps (sent, opened, listened, kept, thanked, with a thank count); private link and invitation codes and their expiry times; a ninety-day notification-center history containing each notification's kind, title, body, routing identifiers, occurrence time and read time, plus a send record that prevents duplicates; a push notification token for your device; safety choices such as blocked phone numbers and safety reports; phone numbers submitted to the waitlist form on our website; and technical request data such as IP address and browser user agent observed by our hosting providers.
• Why we collect it: to create and secure your account, to deliver your recordings to the people you choose, to show you what you have received, to tell you when something arrives, to keep the service working and safe, and to comply with law.
• Sensitive personal information: your voice recordings; the contents of the communications themselves; your account log-in credential; and the "Open when…" moment tag. See Section 3.
• Do we sell or share your personal information? No. We do not sell personal information and we do not share it for cross-context behavioral advertising, as those terms are defined under the California Consumer Privacy Act. We have not done so in the preceding twelve months. We do not sell or share the personal information of any consumer, including consumers we know to be under sixteen. We do disclose personal information to the service providers listed in Section 12, who process it only for us and under contract — that is a disclosure, not a sale or a share.
• How long we keep it: your recordings and account content are kept until they are deleted. Specific periods are in Section 13.
• Your rights: you can access, correct, delete, and obtain a portable copy of your personal information. Access and portability requests are fulfilled by hand today — write to privacy@luloraapp.com. See Section 17.

2. Categories of Personal Information We Collect

The categories below use the statutory list in the California Consumer Privacy Act, as amended by the CPRA. For each we state whether we collect it and what it actually is in Lulora.

• Identifiers — Collected. Your mobile phone number, which is your account identifier and your only sign-in credential. It is stored with its country code, and normalized to canonical E.164 form (a "+" followed by digits) wherever it appears in the system — your profile, your Crew, your block list, delivery records. The apps currently prefix +1, so enrollment is limited to US and Canadian numbers. Your first name and last name, and the display name formed by joining them, which is what other people see. Your email address, if you choose to add one. An internal account identifier — a randomly generated UUID issued by our authentication provider, not shown to you and not derived from your phone number, used to link your profile, recordings, Crew, kept Embers, and device tokens to your account. And a push notification registration token identifying your specific device installation.
• About that push token: when the app launches it registers with Apple's or Google's push service and receives a token. This happens whether or not you accepted notification alerts, because the token itself does not require display permission. Once you are signed in, the token is sent to us and associated with your account; while you are signed out it stays on your device.
• Customer records information (Cal. Civ. Code § 1798.80(e)) — Collected. Name, telephone number, and email address, both yours and those of the people you add to your Crew, send an Ember to, or invite to contribute a voice. Crew entries are also created automatically — sending an Ember, keeping one, or inviting a contributor adds that person to your Crew without a separate step.
• Protected classification characteristics — Not collected. We do not ask for or store date of birth, age, gender, race, religion, marital status, veteran status, or disability. There is no date-of-birth field anywhere in Lulora, and we never ask you to enter or attest an age.
• Commercial information — Collected in a limited form. If you buy PRO, we store the app-store platform, product, an opaque transaction or purchase identifier, whether the entitlement is active, and when it expires. Apple or Google keeps your payment method, billing address, price paid, tax and full receipt; Lulora never receives card, bank or financial-account details. See Section 20.
• Biometric information — Not collected. We do not collect fingerprints, face scans, iris scans, gait, or keystroke patterns, and we do not derive biometric identifiers or templates from anything you give us. We do collect a profile photograph, which may show your face, and voice recordings, which are the content of the app. We store these as ordinary media.
• Internet or other electronic network activity — Collected in a limited form. Within Lulora we stamp lifecycle events on the Ember record itself: when it was created and sent, when its private link was first opened, when the audio actually played, when it was kept, and when a thank-you was sent, along with a thank count. We also retain each notification-center item's occurrence time and whether and when you marked it read. These are written by our own server functions; there is no analytics or telemetry SDK in either app or on the website. Separately, our hosting providers generate ordinary server request logs. We do not track your activity on other websites or apps, and we hold no browsing history about you.
• Geolocation data — Not collected. Lulora requests no location permission on either platform — iOS declares only camera and microphone usage; Android declares only internet, microphone, notifications, and vibration — and we perform no IP-to-location lookup. Our infrastructure providers observe request IP addresses as a normal part of routing traffic; we neither store those addresses nor resolve them to a place. A Time Capsule's open date is chosen by the sender, and whether that date has arrived is decided on our servers by one fixed calendar rule applied identically to every user (the America/Chicago calendar day). We do not read your device's time zone, and a capsule cannot be opened early by changing settings on a phone.
• Audio, electronic, visual, or similar information — Collected. Your voice recordings, which are the substance of the product. Your profile photo, if you add one. The duration of each recording. We do not keep a separate audio-format field; the format is reflected in the file itself.
• Professional, employment, or education information — Not collected.
• Inferences drawn to create a profile — Not collected. We build no behavioral, psychographic, or predictive profiles, and we run no analytics, advertising, or tracking software on any platform. We do record the small set of behavioral events the product depends on — opened, listened, kept, thanked, and how many Embers you and each Crew member have exchanged. Those are shown to you and, as delivery status, to the person who sent you an Ember. They are not scored, segmented, or used to predict anything about you, and they are never shared for advertising. Note also that when you send an Ember you may choose an "Open when…" label such as "when you can't sleep" or "when you're anxious." That label is content you choose about the moment you have in mind. We store it and display it inside the app and on the private link the recipient opens — it is not included in the notifications or emails that announce an Ember. We do not derive it, and we do not use it to infer anything about you or the recipient.
• Sensitive personal information — Collected. See Section 3.

3. Sensitive Personal Information

Under the CPRA and comparable state laws, some of what Lulora handles is sensitive personal information. The full list is:

• Voice recordings — your own voice and, for Crew Embers, the voices of the contributors you invited. These are held in a private storage bucket and served only as short-lived signed links.
• The contents of the communications themselves, where Lulora is not the intended recipient — the voice message, and the SMS or email we send on the sender's behalf carrying their name and a private link.
• Your account log-in credential — your phone number, which is the sole account identifier and sole authentication factor, together with the one-time SMS code. Lulora has no passwords. The one-time code is delivered and verified by our SMS provider and is never stored by us.
• The "Open when…" moment tag a sender chooses for an Ember. This is an emotional- or mental-state label about the recipient — for example "…you're anxious," "…you can't sleep," "…you're overwhelmed." We store it on the Ember and display it wherever the Ember appears — to you, and to the recipient when they open it. It is not carried in the notification or email that announces an Ember, and it is not shown to people invited to add a voice to a Crew Ember.

We do not collect precise geolocation, and we do not use voice or face data for biometric identification.

We use and disclose sensitive personal information only for purposes permitted under California regulations: performing the service you requested, ensuring security and integrity, resisting malicious or fraudulent activity, providing the technical infrastructure that makes the service work, and complying with law. We do not use it to infer characteristics about you. Because our use is limited to those permitted purposes, the CCPA's "Limit the Use of My Sensitive Personal Information" right does not require us to offer a separate limitation control. You may still contact us at privacy@luloraapp.com with any request concerning this data.

4. Sources of Personal Information

• Directly from you: your phone number and name at sign-up; your email address and profile photo if you add them; every recording you make; the recipient and contributor details you type or select; your blocked-number choices and any safety report you file; and your comfort and accessibility settings.
• From your device, with your action: when you tap to pick someone from your address book, your operating system returns the single contact card you selected — that person's name, the phone numbers listed on the card, and their first email address. If the card has more than one number, the app asks which one to use, and only that number is kept. Lulora requests no contacts permission on either platform. See Section 7.
• From other Lulora users: if someone sends you an Ember, invites you to add your voice, or adds you to their Crew, they supply your name and phone number or email address to us. Sending an Ember asks for the recipient's name, mobile number and email address; a Crew invitation or Crew entry needs a name plus a phone number or an email address. See Section 8.
• Automatically, as a byproduct of using the service: the timestamps described in Section 2, and the request logs our hosting providers generate. There is no carrier delivery receipt — "Delivered" in your Sent list is derived from the open and keep stamps, not from your recipient's phone company.
• From the public website: if you enter a phone number into the waitlist form on luloraapp.com, we store that number in E.164 form along with the time you submitted it, the time you ticked the consent box, and the exact wording of the consent you agreed to. The box is unchecked by default. Anyone can type any number into that form; ownership is self-attested and we do not verify that the person submitting a number controls it. Waitlist entries can be written but not read back by the website. If a number was submitted without your permission, write to privacy@luloraapp.com and we will remove it.

5. How and Why We Use Personal Information

• To create, authenticate, and maintain your account. Your phone number identifies your account and receives your sign-in code.
• To deliver Embers. This is described in full in Section 6.
• To show you your own content: your Trove of kept Embers, your Sent list, your Crew book, and your upcoming Time Capsules, each of which can be cancelled before it opens.
• To tell you when something happens. Notifications appear in Lulora's notification center and, when you allow operating-system alerts, can also be sent as push notifications for an arriving Ember, a thank-you, a Crew ask, each voice added to a Crew Ember you are assembling, the moment all voices are in, the evening before a capsule you sent opens, and the morning a capsule opens for you. The app icon can show the number of unread notifications. The recording itself is never in the preview.
• To show senders that their message landed. When you open and play an Ember, we record that and show the sender that it was delivered, listened to, and thanked. See Section 10.
• To operate safety controls. When you block a phone number we store that number, and we keep any safety report you file. See Section 10.
• To render the app to your stated comfort needs. Your Comfort settings — including reduced motion, higher contrast, text size, sound, haptics, breathing session length and similar preferences — are stored only on your own device. They are never sent to us and never measured.
• To secure the service, debug failures, prevent abuse, and comply with legal obligations.

6. How an Ember Is Actually Delivered

When you send an Ember, we store the recording in private storage and always mint an unguessable private link. Delivery then takes one or more of the following routes, which can happen together rather than as alternatives.

• If the recipient's phone number matches an existing Lulora account, we place the Ember directly into their Lulora library, server-side, without the recipient doing anything, and whether or not they have notifications turned on. We also add you to that recipient's Crew book. We send a push notification announcing the arrival, unless the recipient has muted you or the Ember is a sealed capsule, which is announced on its open date instead.
• If you choose text delivery and our SMS sending is enabled, we send the link by text message through Twilio. Where our SMS sending is not enabled, Lulora instead hands the link and the recipient's number to the messaging app on your own phone, and you send it. In that case the message never passes through our systems at all.
• If an email address was supplied, we email the link through Resend.

Anyone holding the link can play the Ember without signing in. See Section 10.

One safety limitation deserves stating here: if a recipient has blocked you, in-app delivery is skipped, but a text message or email carrying the link can still arrive on their phone or in their inbox. See Section 10.

7. What Lulora Does Not Do

These are verified absences in the current product, not aspirations. We state them because they are unusual and because you should be able to hold us to them.

• No analytics SDK, no telemetry service, and no crash-reporting service is present in the iOS app, the Android app, or the website. The Android app includes Google's Firebase Cloud Messaging library solely to deliver push notifications; no Firebase Analytics, Crashlytics, or Performance Monitoring component is included. The iOS app uses Apple's push service directly.
• No advertising. There is no ad SDK, no advertising identifier (no IDFA, no Android Advertising ID), no attribution or install-attribution service, and no App Tracking Transparency prompt, because there is nothing to track you with. The only Google service we use is Firebase Cloud Messaging, for notifications.
• No cookies. The Lulora website sets no cookies of its own and shows no cookie banner. If you sign in on the web, your session token is kept in your browser's local storage so you stay signed in; clearing site data removes it.
• No tracking pixels, no tag manager, and no session-replay or heat-mapping tool.
• No third-party font or CDN calls at runtime. Fonts are downloaded when we build the site and served as static files from our own domain, so your browser makes no request to a font provider or CDN when you load a Lulora page.
• No device fingerprinting. We do not collect your Android ID, IMEI, serial number, or iOS vendor identifier. The only device identifier Lulora collects and stores is the push notification token; Google's messaging library maintains its own installation identifier as part of delivering notifications, which we never read or store.
• No address-book upload. See Section 8.
• No location collection of any kind, precise or coarse.
• The Tend wellbeing surfaces send nothing to our servers — the breathing exercises, Glow Trail and Cozy Pieces run entirely on your device, and your comfort and accessibility settings stay on your phone. The crisis-support card inside a Breather is the same: the 988, Crisis Text Line and findahelpline.com links are handed to your phone's dialler, messages app or browser, and we do not record that you opened the card or tapped a line. A Breather does contact our servers for one thing only: playing the Embers in it. Because those are real Embers from your Trove, we fetch them, mint a playback link, and mark them listened — which means the person who sent one will see that you listened, exactly as if you had played it from your Trove.
• The Android app declares only four permissions of its own — internet, microphone, notifications, and vibration — and only two of them, microphone and notifications, ever prompt you. A few low-level, non-user-facing permissions such as wake-lock and network-state are added automatically by Google's push-messaging library. The iOS app requests three device permissions: microphone, to record; camera, only if you choose to take a profile photo in-app; and notifications. It requests no photo-library, contacts, location, speech-recognition, tracking, or health permission.

We do not promise these absences forever. If we later add basic, privacy-respecting product analytics or crash reporting, we will update this policy and name the provider here before or when we do so.

8. Your Contacts

Lulora never reads your address book. Neither app requests contacts permission.

On iPhone, choosing a contact opens Apple's contact picker, which runs outside our app. On Android, it opens the system contact picker, and our app declares no read-contacts permission. In both cases your operating system hands back only the one card you tapped, at the moment you tap it.

So we never enumerate, scan, or hash your contacts, and we never upload your contact list. If you pick three people over three months, we have three cards. That is the whole of it.

What we do receive and keep is the details of the person you deliberately chose or typed in — their name, the phone number you confirm, and their email address if there is one. Those are uploaded and stored on our servers, because we need them to address and deliver your Ember. That is described in Section 9.

Two related things we should say plainly rather than let you infer. First, we check a recipient's or contributor's phone number and email address against existing Lulora accounts, to decide whether to deliver the Ember inside the app or only by private link. Second, we do build a per-person Crew roster — the people you have sent to or received from, with counts of how many Embers you have exchanged, and a mute setting for each. That roster is yours and is visible only to you, but it is a relationship record, and some of it is created automatically rather than by an explicit "add."

9. People Who Are Not Lulora Users

This section is unusually important for Lulora and we would rather state it directly than bury it.

When you use Lulora, you give us personal information about other people who have not signed up, have not seen this policy, and have not agreed to anything: the name, phone number, and sometimes email address of anyone you send an Ember to, anyone you add to your Crew, and anyone you invite to add their voice to a Crew Ember.

Much of this is created without an explicit "add" step:

• Sending an Ember creates a Crew entry for the recipient in your Crew book, whenever you supplied a phone number. If they are already in your Crew, their existing details are left as they are.
• If the recipient already has a Lulora account and has not blocked you, sending also writes you into their Crew book — their name for you, your display name and phone number, created server-side without them adding you — and places the Ember directly in their Trove.
• Keeping an Ember you received creates a Crew entry for the sender, when the sender's profile carries a phone number. It never overwrites an entry that already exists.
• Inviting people to contribute voices creates a Crew entry for each person you invited by phone number, holding their name, number, and email if you gave one. Someone invited only by email address is not added to your Crew.

We process this information because it is necessary to deliver a message a user asked us to deliver. If you are a Lulora user, you are responsible for having a legitimate personal reason to give us someone else's contact details, and for not using Lulora to send unwanted messages. Said more plainly: please only add people you would be comfortable calling. Their details are their own.

If you are not a Lulora user and your information is in Lulora:

• You can ask us what we hold about you, and you can ask us to delete it. Write to privacy@luloraapp.com from, or identifying, the phone number or email address in question. We will locate entries associated with that number or address, remove them, and tell you what we did. US state privacy laws and PIPEDA give you these rights whether or not you have an account with us.
• You can ask us to suppress your number so that Lulora does not deliver further messages to it.
• If you received a link and want the recording deleted, tell us. We will delete the recording and the link.

If you contributed a voice recording to someone else's Crew Ember: your recording is stored within that author's Lulora account, because it became part of the gift they assembled, and only they can hear it in the product. Once you submit it, it no longer appears on any surface available to you — your ask list shows only invitations you have not yet answered, and revisiting your invitation link shows only a confirmation that your voice is in. You cannot currently replay, download, edit, or delete it yourself. Write to privacy@luloraapp.com and we will delete it on request, or ask the person who gathered the voices.

10. Who Can See What — The Honest Map

This is the part we would rather be blunt about than reassuring.

Anyone holding an Ember link can play it, with no account. When you send an Ember, we create a private web link containing a random code. When you invite someone to add a voice, we create a separate private link the same way. That code is the only credential. There is no sign-in, no password, and no check of who is holding it. Whoever has the link has the access, including anyone it is forwarded to. If the recipient forwards the text, screenshots it, or leaves their phone unlocked, that person can play the recording. They do not need a Lulora account, and we cannot tell them apart from the intended recipient. Signing in is offered only if someone wants to keep an Ember permanently — it is never required to listen.

What an Ember link shows. Anyone opening an Ember link sees your first name, your profile photo, and the "Open when…" label you chose, and can play the recording — plus, for a Crew Ember, each contributor's first name and voice. The recipient's name is not shown on the playback link. The separate Crew "add your voice" invitation link does show the recipient's first name to the people invited to contribute, because they need to know who the gift is for.

Opening a link is itself recorded. Simply loading the page marks the Ember as opened, with no action required from the visitor, and starting playback marks it as listened. Both surface to the sender — in their Sent list the open stamp reads "Delivered" and, once audio actually starts, "Listened," with a thank-you outranking both. If someone else opens your link, the sender will be told their Ember was heard. Loading a link that is still sealed, or already expired, records neither stamp.

The link is a URL, so its code is part of the web address. It will appear in the browsing history of whatever device opened it, and in the request logs of the provider that serves the page and the provider that answers it.

Links do not last forever. An Ember link expires automatically after a limited period set when it is created. A voice-invitation link expires fourteen days after it is created, and closes immediately once the gift is sent. A link to a sealed Time Capsule or Crew Capsule is never expired before its open date and stays valid for at least seven days after it. Expiry is not erasure: expired link records are deleted by a nightly job about thirty days after they expire, and links to capsules that have not yet opened are skipped by that job.

Recipients cannot see your other Embers, your Crew, or anything else. Access is scoped per relationship and enforced in the database, not just in the app.

• Your name is shown to everyone you send to, and appears in the text message, email, and signed-in notification center announcing your Ember. It also appears in the phone's operating-system preview when you send an Ember or a Thank.
• Your profile photo is earned, not public. It is shown to people who have an established relationship with you in Lulora — someone who listened to an Ember from you and still keeps it, and people in your Crew. The photo files are access-controlled and served through short-lived signed links rather than being openly readable.
• Your phone number becomes readable to a Lulora user who has listened to and kept an Ember from you. We state this plainly because it is a real disclosure: sending someone an Ember and having them keep it means they can learn the number you send from.
• Your email address is never readable by another user. It is technically restricted so that only you can read it back.
• Your engagement is visible to the person who sent to you, as described above. This is a deliberate product feature — it is how a sender knows their voice was heard — but it is behavioral information about you disclosed to another person, and you should open and play accordingly.
• Your interaction counts with each Crew member are visible to you, and reflect how much you and that person have exchanged.

Notifications carry content outside the app. An arriving Ember uses "Ember from [name]" and a Thank uses "Thank from [name]" in the alert shown by Apple or Google. Other push types keep the neutral copy — "Lulora", "A new moment is waiting for you." No push carries the "Open when…" moment, the recording, or its contents. Provider payloads also carry the unread notification count for the app-icon badge, the explicit identifiers needed to open the right item, an opaque notification-event identifier, and the target account's internal random identifier; the apps discard a push whose target does not match the account currently signed in. We instruct Apple and Google to discard a chime they cannot deliver within fifteen minutes; the signed-in notification center remains available afterward. These alerts can appear on a locked screen depending on the reader's own device settings. The email inviting someone to add a voice names you and the person the gift is for, in both the subject line and the body — or says the gift is "for someone they love" if you left the recipient's name blank — and carries the link. Neither that email nor the push chime includes the "Open when…" line.

What blocking does and does not do. Blocking a phone number stores that number on your account, normalized and visible only to you, and stops Embers from that number reaching you inside Lulora: they no longer land in your Trove, you get no notification for them, and you cannot save one to your Trove. Blocking does not stop that number's text message or email from arriving on your phone or in your inbox, and a link that was already sent can still be opened and played from the web. If you need a number stopped entirely, write to privacy@luloraapp.com and we will suppress it on our side.

Safety reports. If you report an Ember or a sender, we record which Ember or person you reported and the reason you selected. If you choose "Something else," we ask for an explanation of up to 60 characters and store it with the report for safety review.

11. Text Messages and Email

Lulora's sign-in and much of its delivery run over SMS, so it deserves its own section. There are three kinds of message we may send, and no others.

• Sign-in codes. When you sign in, we text you a one-time code through Twilio. These cannot be turned off, because they are the only way to access an account.
• Ember and invitation delivery. When you choose to send an Ember link by text or email, we send that one message to the number or address you supplied: a text through Twilio, an email through Resend. Where our own SMS sending is not enabled, Lulora instead hands the link and the number to the messaging app on your own phone and you send it — in that case no message passes through Lulora's systems at all, and it travels over your carrier's network as any other text of yours would.
• One waitlist text, if you submitted your number on our website and consented to be contacted about launch.

We do not send marketing campaigns. Message and data rates may apply, as set by your carrier; Lulora does not charge you for messages. You can reply STOP to a waitlist message to stop receiving them. To stop delivery texts and emails, tell us at privacy@luloraapp.com and we will suppress your number or address so Lulora does not deliver to it again.

12. Information Stored on Your Own Device

• Unsent drafts. If you record an Ember and keep it back rather than sending it, the audio and the recipient's name, phone digits, and email are saved on your device only. Draft recordings are never uploaded to us.
• On iPhone, drafts are stored under iOS file protection, but they are deliberately included in your iCloud and iTunes/Finder backups. This is intentional, because a draft is the only copy of that recording and excluding it from backup would mean losing it when you change phones. The consequence to know about is that an unsent draft — including the recipient's phone number and the recording itself — is contained in your Apple backup, governed by Apple's terms and by whatever protections you have applied to that backup.
• On Android, drafts are stored in the app's private storage in unencrypted form and are excluded from Android cloud backup, because the app disables backup entirely.
• Offline copies. Your Trove, Sent list, Crew book, and profile name are cached locally so the app opens to your content instead of a spinner. On iPhone these caches are stored with file protection and excluded from iCloud backup. On both platforms the cache carries your account identifier inside it so that one account's content cannot appear in another's. Signing out erases these caches.
• Comfort and accessibility settings, and a copy of your push notification token, are stored in your device's ordinary app preferences rather than in a secure enclave. Those preferences are never sent to us, though they are included in your own operating system's device backup, a platform mechanism we neither control nor read.
• If you sign in from a web browser, your browser stores your Lulora session locally so you stay signed in.
• Sign-out is global. Signing out of Lulora on one device ends your session on all of your devices.

13. Service Providers and Who Else Receives Data

We use the following companies to run Lulora. Each processes personal information only to provide services to us, under contract, and not for its own purposes. These are service providers and contractors in the CCPA sense, not sales.

• Supabase — our core infrastructure provider, supplying the database, file storage, authentication, and server functions. Everything server-side lives here: your phone number, name, email, profile photo, all voice recordings, your Crew and recipient contact data, push tokens, blocked numbers, safety reports, and all engagement timestamps. Our data is hosted on Amazon Web Services infrastructure in the US West (Oregon) region, us-west-2, in the United States.
• Twilio — delivers your SMS sign-in codes and, where enabled, the text message containing an Ember link. Twilio receives the destination phone number and, for delivery texts, the message body containing the sender's display name and the link. Twilio necessarily also learns when and how often you sign in. Twilio never receives your voice recording, and never stores your one-time code with us.
• Resend — delivers our transactional email. Resend receives the destination email address and the message body, which may contain the sender's or author's display name, the recipient's name, the link, and for a sealed capsule its open date. Our emails do not carry the "Open when…" line. Resend never receives your voice recording.
• Apple Push Notification service — delivers notifications to iPhones. Apple receives your device push token, our app identifier, the notification title and body, explicit routing identifiers, the target account's internal random identifier, an opaque notification-event identifier, and the unread notification count used for the app-icon badge. For an arriving Ember or a Thank, the title includes the relevant person's display name. Apple does not receive the "Open when…" moment, an unlistened-Ember count, or the recording.
• Google Firebase Cloud Messaging — delivers notifications to Android devices, receiving the equivalent notification title and body, explicit routing identifiers, target-account identifier, opaque notification-event identifier, and unread notification count. For an arriving Ember or a Thank, the title includes the relevant person's display name. Google does not receive the "Open when…" moment, an unlistened-Ember count, or the recording. We use Firebase for messaging only. We do not use Firebase Analytics, Crashlytics, or Firebase Performance Monitoring.
• Apple App Store and Google Play — sell and restore Lulora PRO. The store receives the purchase request, your store account and payment information, and returns an opaque transaction or purchase identifier, product, state and expiry that Lulora uses to grant access. An Apple purchase applies only on iOS and a Google purchase only on Android.
• Hostinger — hosts luloraapp.com. Ordinary web-server logs apply, containing IP address, user agent, requested URL including the link code, and timestamp. We do not publish a Hostinger data-center region, because we have not pinned one.

Our hosting providers' request logs are generated by their infrastructure, not by our code. Lulora does not read, collect, or store them, and we do not set their retention schedules.

Voice recordings themselves are stored only with Supabase. They are not transmitted to Twilio, Resend, Apple, or Google; only the link is.

When you text an Ember link yourself from your own phone, that message is handed to your device's own messaging app and travels over your carrier's network. We are not a party to it.

Beyond these providers, we may disclose personal information: to comply with a law, subpoena, court order, or lawful government request; to enforce our Terms; to protect the rights, safety, or property of Lulora, our users, or the public; and to a successor entity in a merger, acquisition, financing, or sale of assets, in which case we will require the recipient to honor this policy or give you notice and a choice as required by law.

We do not sell personal information, and we do not share it for cross-context behavioral advertising or targeted advertising, in the last twelve months or at any other time.

14. Retention and Deletion

Nothing in Lulora deletes your recordings on a clock. We keep them until they are deleted.

• Voice recordings and Embers: kept until you delete your account, or until you ask us to remove a specific recording. There is no automatic expiry on the recording itself.
• One honest limit on the word "remove." Today, removing an Ember from your Sent list hides it from your view, and removing a kept Ember takes it out of your Trove. In both cases the underlying recording remains in our storage. If you want a particular recording actually erased, delete your account or write to privacy@luloraapp.com and ask, and we will erase it.
• Account profile — phone number, name, email, photo: kept for the life of your account.
• Crew entries: kept until you remove the person or delete your account.
• Blocked numbers: kept until you unblock the number, because retaining it is what makes the block work.
• Private link records: they expire on their own as described in Section 10, and expired records are automatically purged about thirty days after expiry.
• Notification-center history — kind, title, body, explicit routing identifiers, occurrence time, read time, and server-only sender name and normalized phone used for display and blocking — and the paired send record that prevents duplicates: automatically deleted after ninety days. If that sender deletes their account, we purge their notification snapshots during account cleanup rather than waiting for the ninety-day limit.
• Push device tokens: deleted when Apple or Google tells us the token is no longer valid, or when you delete your account.
• Plan, quota and purchase-entitlement metadata: kept for the life of your Lulora account and deleted with it. Because the purchase is permanently bound to that account, deleting this metadata permanently forfeits paid access, including Lifetime; it cannot be restored to a later Lulora account. Deleting the account does not cancel a subscription or erase the transaction or owned status from Apple or Google; cancellation remains in the applicable store. Duplicate webhook identifiers are retained for up to ninety days so the same store event cannot be applied twice.
• Waitlist phone numbers: kept until launch outreach is complete or until you ask us to remove yours.
• Hosting and platform request logs: retained by Supabase and Hostinger under their own schedules, which we do not set.

You can delete your account from within the app, under Account → Your data. Doing so deletes your profile, your Embers and their audio files, your profile photo, your Crew entries, your kept Embers, your device tokens, your block list, your free-use history, and account-bound purchase entitlement metadata. It also removes your Embers from the Troves of everyone who kept one, and removes any voices you contributed to other people's Crew Embers — so a gift assembled from five voices becomes four. Anyone who kept an Ember from you is told that some Embers are no longer available because the sender closed their account; they are not told who. Deletion permanently forfeits paid access, including Lifetime, which cannot be restored to a future Lulora account. Account deletion does not cancel an Apple or Google subscription.

Three things deliberately survive deletion, and you should know them before you start. Safety reports filed about a number are kept, and so are blocks other people placed on it — otherwise deleting an account would be a way to evade a block. And your phone number cannot be used to open a new Lulora account for one year. We keep a one-way scrambled fingerprint of the number to enforce that, never the number itself, and it is erased automatically after the year is up.

One further limit deserves stating honestly. Your name and number can remain in another person's Crew book after you delete your account, because that contact record belongs to their account — the same way closing an account with a phone carrier does not empty other people's address books. Voice contributions are different: Lulora deletes the contributed audio and row, so the recipient's Crew Ember loses that voice as described above. Email privacy@luloraapp.com and we will remove remaining Crew-book contact information about you. Backups and system logs may retain residual copies for a limited period until they age out on their normal cycle.

15. Security

We describe our actual measures rather than making marketing claims about them.

• Data is transmitted over encrypted connections (TLS) between your device, our website, and our infrastructure.
• Data at rest is encrypted by our infrastructure provider at the storage layer.
• Voice recordings are held in private storage. They are not publicly readable. Playback is served through signed links that are generated per request and expire after one hour.
• Profile photos are access-controlled and served through signed links.
• Our database enforces row-level access rules so that, by default, no user can read another user's records. Access is denied by default and granted narrowly, per relationship. Your email address is excluded from what any other user can read.
• We have no passwords to leak. Sign-in is a one-time SMS code. On iPhone your session is held in the system Keychain; on Android it is held by the platform authentication library. Sessions can be revoked across all your devices by signing out.
• On-device caches on iPhone use iOS file protection.
• Access to production data by our personnel is limited to those who need it to operate and support the service.

No system is perfectly secure, and we will not tell you otherwise. The most likely way a Lulora recording reaches someone it was not meant for is a forwarded link, not a broken server. Please treat Ember links the way you would treat the message itself.

16. Data Breach

If we determine that a breach of security has compromised your unencrypted personal information, we will notify you and, where required, the applicable state attorney general or regulator, in the most expedient time possible and without unreasonable delay, consistent with the legitimate needs of law enforcement and any measures necessary to determine the scope of the breach and restore integrity. Notice will describe what happened, what information was involved, what we are doing about it, and what you can do.

For users in Canada, we will report to the Office of the Privacy Commissioner of Canada and notify affected individuals where a breach of security safeguards creates a real risk of significant harm, and we will maintain records of breaches as PIPEDA requires.

You can report a suspected security problem to privacy@luloraapp.com. We will acknowledge and investigate.

17. Your US Privacy Rights and How to Exercise Them

If you live in California, Colorado, Connecticut, Delaware, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah, Virginia, Washington, or another state with a comprehensive consumer privacy law, you have the rights below. We extend them to all US users regardless of state.

• Right to know and access. You can ask what categories and specific pieces of personal information we have collected about you, the categories of sources, the business purposes for collecting it, and the categories of third parties to whom we disclosed it.
• Right to delete. You can ask us to delete personal information we collected from you, subject to the narrow exceptions the law allows, such as completing a transaction you requested, security and integrity, or legal compliance.
• Right to correct. You can ask us to correct inaccurate personal information. Your name, email address, and photo are directly editable in the app.
• Right to portability. In the app, under Account → Your data, "Download my Embers" saves the recordings you have made as ordinary audio files you can keep anywhere. That export covers Embers you recorded — not ones other people sent you, because those are someone else's recording of someone else's voice, and a copy sitting in your Trove does not make it yours to take. For anything the export does not cover, including a copy of the rest of your personal information, write to privacy@luloraapp.com and we will assemble it by hand.
• Right to opt out of sale, sharing, targeted advertising, and profiling. We do not sell or share personal information, do not process it for targeted advertising, and do not profile you in furtherance of decisions producing legal or similarly significant effects. There is accordingly nothing to opt out of. If this ever changes, we will provide a clear opt-out mechanism, honor recognized universal opt-out signals as the law requires, and update this policy first.
• Right to limit use of sensitive personal information. See Section 3.
• Right to non-discrimination and non-retaliation. We will not deny you service, charge you a different price, or give you a lower quality of service because you exercised a privacy right. We offer no financial incentives for your data.

How to make a request: two things you can do yourself, in the app under Account → Your data — "Download my Embers" for a copy of your recordings, and "Delete account" for the deletion described in Section 14. For anything else, email privacy@luloraapp.com and tell us what you want.

How we verify you: because a Lulora account is identified by a phone number, we verify a request by confirming control of that number through a one-time code, and we may ask you to confirm details already in your account. We will not ask for a government ID or a Social Security number. If we cannot verify you to the degree of certainty the request requires, we will tell you why and, where possible, will treat a deletion request as an opt-out request instead.

Timing: we confirm receipt within ten business days and respond substantively within forty-five calendar days. If we need more time we will tell you within that period and take no more than an additional forty-five days.

Authorized agents: you may use an authorized agent, including under a valid power of attorney. Absent a power of attorney, we will require written permission signed by you and may still verify your identity directly.

Appeals: if we decline your request, you may appeal by replying to our response or writing to privacy@luloraapp.com with the word "Appeal." We will respond within forty-five days — sixty days in Colorado and certain other states — with our decision and the reasons for it. If we deny the appeal we will tell you how to contact your state attorney general. California residents may also complain to the California Privacy Protection Agency.

California "Shine the Light": we do not disclose personal information to third parties for their own direct marketing purposes.

18. Canada — PIPEDA

For users in Canada, we handle personal information in accordance with the Personal Information Protection and Electronic Documents Act and its ten fair information principles.

• Accountability. Hamtech LLC is accountable for personal information under its control, including information transferred to the service providers listed in Section 13. Our Privacy Officer can be reached at privacy@luloraapp.com.
• Identifying purposes. The purposes for which we collect personal information are identified in Sections 1 and 5. We will identify any new purpose before using information for it.
• Consent. You consent to the collection described here by creating an account and using Lulora. Because Lulora carries voice recordings and private messages, we treat that content as warranting express consent, given through your act of recording and choosing a recipient. You may withdraw consent at any time, subject to legal and contractual restrictions and on reasonable notice, by deleting your account. The consequence of withdrawal is that we can no longer deliver or store your Embers.
• Moments. When you create an account, we ask you to agree — on its own screen, separately from anything else — to how the "Open when…" moment works: an Ember sent to you may carry a moment, and we store it with the Ember and show it only to you. Moments are part of what a Lulora Ember is — an Ember and its moment travel together, like the recording itself — so this agreement is part of using Lulora. As with your recordings, you can withdraw it at any time by deleting your account, which removes your Embers and their moments with them.
• Limiting collection. We collect only what is necessary for the purposes identified. Sign-up asks for exactly two things: a phone number and a name. Email and photo are optional and added later, if you want them.
• Limiting use, disclosure, and retention. We use and disclose personal information only for the purposes for which it was collected, except with your consent or as required by law, and we retain it as described in Section 14.
• Accuracy. You can update your name, email, and photo in the app at any time, and can ask us to correct anything else.
• Safeguards. See Section 15.
• Openness. This policy is our statement of practices and is publicly available at luloraapp.com/privacy.
• Individual access. You may request access to your personal information and to information about its use and disclosure, and may challenge its accuracy. We respond within thirty days as PIPEDA requires, or explain why we need an extension.
• Challenging compliance. Address any concern to privacy@luloraapp.com. We will investigate and respond. If you are not satisfied, you may complain to the Office of the Privacy Commissioner of Canada at priv.gc.ca or 1-800-282-1376. Residents of Quebec, British Columbia, Alberta, and Ontario may have additional rights under provincial legislation.

Cross-border transfer: personal information of Canadian users is stored and processed in the United States and is therefore subject to lawful access by US courts, law enforcement, and government authorities. By using Lulora you acknowledge this transfer.

19. Children

Lulora is intended for people aged 13 and older. It is not directed to children under 13, and children under 13 are not permitted to create an account or use the service. By creating an account you represent that you are at least 13 years old.

We do not ask for your date of birth and we do not operate an age gate, so we do not knowingly collect personal information from anyone under 13. We also cannot control who is holding the phone that receives an Ember link: a person who receives a link opens it in a browser and never installs Lulora, so we have no way to know the age of a link recipient. If you are sending to a young person, that judgment is yours.

We do not knowingly sell or share the personal information of anyone under 16, and as stated above we do not sell or share personal information at all.

If we obtain actual knowledge that we have collected personal information from a child under 13, we will delete that account, the associated recordings, and the associated contact information promptly.

A parent or guardian who believes their child under 13 has created a Lulora account, or whose child's phone number or name has been entered into Lulora by another person, may write to privacy@luloraapp.com. Identify the phone number involved. We will verify the request, delete the information, remove the number from any pending deliveries, and confirm to you what we did. You may also ask us to suppress the number so that Lulora does not deliver to it again.

20. Subscriptions and Payment Information

Lulora offers monthly and yearly PRO subscriptions and a one-time Lifetime plan through Apple's In-App Purchase on iOS and Google Play Billing on Android. Apple or Google, not Lulora, processes the payment and holds the payment method. We collect no payment card number, bank information or billing address.

The store gives Lulora the minimum data needed to provide the purchase: an opaque original transaction identifier or purchase token, the product and platform, purchase environment, current state, expiration or revocation time, and renewal notifications. We permanently bind that confirmation to the signed-in Lulora account on that platform, use it only to grant or remove PRO, prevent duplicate claims, support restoration to that same account, and resolve purchase support requests, and delete the account-bound copy when the Lulora account is deleted. Deleting it permanently forfeits paid access, including Lifetime; Apple or Google may still retain the transaction or show Lifetime as owned, but Lulora cannot restore it to a later Lulora account. After deletion, Lulora retains only a permanent, accountless, non-reversible keyed fingerprint of the purchase chain solely to enforce that forfeiture and prevent transfer. It contains no Lulora account ID, product, original transaction identifier, purchase token, or store payload.

Purchases are platform-specific. Apple confirms iOS access and Google confirms Android access; Lulora does not combine them into one cross-platform entitlement. The app displays store-localized prices before purchase and provides restore and subscription-management controls.

21. Where Lulora Is Offered

Lulora is offered to users in the United States and Canada. Our infrastructure is located in the United States, and personal information is stored and processed there.

Lulora is not directed to, or offered to, residents of the European Economic Area, the United Kingdom, or Switzerland, and this policy does not describe rights under the EU or UK General Data Protection Regulation. If you are located in one of those jurisdictions, please do not use Lulora. If you believe we hold your personal information and you are located there, write to privacy@luloraapp.com and we will address it.

22. Changes to This Policy

We may update this policy. When we do, we will change the effective date at the top and post the revised policy at luloraapp.com/privacy. Older versions are available on request.

Small corrections — a fixed typo, a clearer sentence — we will simply make.

If a change materially affects how we handle personal information we have already collected — a new category of collection, a new purpose, a new category of recipient, or any change to the statements in Section 1 or Section 7 — we will provide notice before the change takes effect, by in-app notice, push notification, or a message to the phone number or email address associated with your account, and we will obtain your consent where the law requires it.

We review this policy at least annually, as California requires of businesses subject to the CCPA, and update the twelve-month disclosures in it accordingly.

23. Contact Us

• Privacy questions and rights requests: privacy@luloraapp.com
• General support: privacy@luloraapp.com
• Postal: Hamtech LLC, Seattle, Washington, United States

If you are not a Lulora user and your information is in Lulora because someone else provided it, use the same addresses. You do not need an account to make a request, and we will not require you to create one.

We answer. A real person reads these.

This policy is governed by the laws of Washington, without regard to its conflict-of-laws rules, except where the law of your state or province of residence governs your privacy rights.