Privacy Policy

Meridian Labs LLC (“we,” “us,” or “our”) operates the Lumia mobile application and the Lumia website at withlumia.app (together, the “App”). This Privacy Policy explains what information we collect, how we use it, and the choices you have.

By using Lumia, you agree to the collection and use of information as described below.

1. Information We Collect

Information You Provide

• Account information. When you create an account, we collect your name and email address. Accounts are created through third-party sign-in providers (Google or Apple), and we receive basic profile information from those providers. We do not collect or store passwords.
• Birth data. To generate your personalized content, we collect your birth date, time, and location (city, latitude, longitude, timezone). This data is encrypted at rest on our servers using field-level encryption.
• Profile information. You may provide additional profile details including a username, bio, avatar image, gender, interests, and life needs.
• Journal entries. Your private journal entries are stored with encryption at rest on our servers. Entries you choose to share in the community feed are visible to other users. Please note: certain AI-powered features (such as emotion detection, categorization, and summaries) involve server-side processing of your journal content — see Section 2 for details.
• Community content. Posts, comments, likes, and other interactions you share in the community feed are visible to other users and stored on our servers.
• Reflection data. Your reflection selections and history are stored to provide you with a personalized experience.
• Images. Photos you upload (profile pictures, journal images) are stored on Google Cloud Storage.
• Support requests. If you contact support, we collect the information you include in your message, including any file attachments.
• Invitations. If you invite others to join Lumia, we collect the email addresses you provide for the purpose of sending invitations.

Information We Collect Automatically

• Device information. We collect device data including operating system version, device model, app version, and device identifiers for push notification delivery.
• Timezone. We collect your device's timezone to deliver time-appropriate content and notifications.
• Usage analytics. We use analytics tools to understand how people use the App. This includes data like screen views, session duration, feature usage, and crash reports. This data is aggregated and cannot be used to identify you personally. On the web, analytics run only if you accept analytics cookies — see Section 5.
• Interaction data. We collect data about your engagement with content (views, likes, comments, follows) to personalize your experience and improve our recommendation systems.
• IP address. Your IP address is collected in server logs for security and abuse prevention. It is not used for tracking or advertising.

Information We Do Not Collect

• We do not collect your precise real-time GPS location. Birth location is entered manually and used only for content personalization.
• We do not access your contacts, camera, or microphone unless you explicitly grant permission for a specific feature (such as uploading a journal image).
• We do not use advertising trackers or share data with ad networks.

2. How We Use Your Information

We use the information we collect to:

• Provide core features. Generate personalized insights, reflections, and journal experiences based on your profile and birth data.
• AI-powered features. Process your data through artificial intelligence services to generate personalized content, including daily messages, reflection interpretations, journal analysis (emotion detection, categorization, summaries), and conversational responses. This processing is performed by the AI providers listed under “Third-Party Services” below, acting as our data processors; we currently use Google's Gemini, and we may add or change providers, in which case we will update that list. Data sent to AI services is processed transiently, is not retained by the provider beyond the duration of the request, and is not used for advertising or to train the provider's models. Generating readings is what the App is for, so this processing is necessary to provide the service rather than something you opt into separately.
• Personalize your feed. Use algorithmic ranking, including machine learning models, to surface relevant content in your discovery feed. We may run experiments (A/B tests) to improve these systems.
• Social features. Enable following, commenting, liking, and content sharing between users.
• Push notifications. Send notifications about social activity, personalized content, and service updates via Apple Push Notification service (APNS).
• Email communications. Send account-related messages, support responses, invitation emails, and the daily reading email — which is part of the service, is on by default, and carries an unsubscribe link in every message. Promotional email is sent only to people who have asked for it, and is a separate preference.
• Improve the App. Analyze aggregated usage patterns to improve features and fix issues.
• Security and integrity. Detect and prevent abuse, fraud, or misuse of the App, including rate limiting and content moderation.

3. How We Protect Your Information

• Encryption at rest. Sensitive personal data — including your birth information (date, time, location) and email address — is encrypted at rest using field-level encryption with keys managed through Google Cloud Key Management Service (KMS).
• Encryption in transit. All data transmitted between your device and our servers is encrypted using HTTPS/TLS. We also offer an additional transit encryption layer for sensitive operations.
• Access controls. We limit internal access to personal data to authorized personnel who need it to operate the service.
• AI data handling. Data sent to AI services for processing is transmitted securely and is not used by those services to train their models. We redact personally identifiable information before sending data to AI services where possible.
• Blind indexing. Encrypted fields such as email are indexed using blind hashes, meaning the actual values are not stored in searchable form.

4. Third-Party Services

We use the following categories of third-party services to operate the App:

These providers act as data processors on our behalf and are contractually bound to protect your data. We do not sell your personal information to any third party.

5. Cookies and Similar Technologies

The Lumia website uses a small number of cookies. The iOS app does not use cookies.

Functional Cookies

These are set by us, are necessary for the site to work, and are never used for tracking or advertising. They are set whether or not you accept analytics cookies.

Your light or dark theme preference is kept in your browser's local storage rather than in a cookie, and is never sent to us.

Analytics Cookies

We use Google Analytics 4 to measure how the website is used. It sets cookies beginning with _ga, which are retained for up to two years.

These cookies are set only after you accept. Until then, Google Consent Mode keeps analytics storage denied and no analytics cookie is written. If you decline, they are never set and analytics measurement stays off.

Managing Your Choices

You are asked when you first visit, and you can change your mind at any time — open cookie preferences. You can also delete cookies through your browser settings at any point.

6. Information Sharing

We do not sell your personal information. We do not share it with advertisers.

We may share information only in the following cases:

• Service providers. As described in Section 4, third-party services process data on our behalf to operate the App.
• Community content. Content you share publicly in the community feed is visible to other users of the App.
• Legal requirements. We may disclose information if required by law, court order, or government request.
• Safety. We may share information when we believe it is necessary to prevent harm, investigate violations of our Terms, or protect the rights and safety of our users.
• Business transfers. If Meridian Labs is acquired or merges with another company, your information may be transferred as part of that transaction. We will notify you before your data becomes subject to a different privacy policy and give you the option to delete your account.

7. Your Rights and Choices

• Access your data. You can request a copy of the personal data we hold about you by contacting us.
• Delete your account. You can request account deletion through the App's settings — see how to delete your Lumia account. Upon request, your personal data will be permanently removed within 30 days, except where we are legally required to retain it.
• Export your journal. You can export your journal entries at any time from the App.
• Opt out of analytics. On the web, analytics are off until you accept them, and you can change your choice at any time — open cookie preferences. In the iOS app, you can disable anonymous analytics collection in the app's settings.
• Manage notifications. You can control push notification and email preferences within the App or through your device settings. Email preferences are separate: the daily reading email is on by default and can be turned off in Settings or through the unsubscribe link in any of those emails, while promotional email — news and offers — is only sent if you have asked for it.
• Profile visibility. You can set your profile to private to limit what other users can see.
• Content control. You can delete your posts, comments, and other content at any time.

For Users in the European Economic Area (EEA)

If you are located in the EEA, you have additional rights under the General Data Protection Regulation (GDPR), including the right to access, rectification, erasure, data portability, restriction of processing, and the right to object to processing. Our legal bases for processing are: consent (for birth data and optional profile information), contract performance (for account and service features, including the AI generation the readings are made of and the daily reading email), legitimate interests (for security, analytics, and service improvement), legitimate interests (for sending invitation emails on behalf of our users to the email addresses they provide), and consent (for promotional email). To exercise these rights, contact us at hello@meridian-labs.co.

For California Residents

If you are a California resident, you have rights under the California Consumer Privacy Act (CCPA/CPRA), including the right to know what personal information we collect, the right to delete it, and the right to opt out of the sale or sharing of personal information. We do not sell or share personal information. To exercise your rights, contact us at hello@meridian-labs.co.

8. Children's Privacy

Lumia is not directed at children under 16. We do not knowingly collect information from children under 16 (or under 13 in jurisdictions where 13 is the applicable minimum age). If you believe a child has provided us with personal information, please contact us and we will delete it promptly.

9. Data Retention

• Active accounts. We retain your account data for as long as your account is active.
• Deleted accounts. If you request account deletion, we remove your personal data within 30 days, except where we are required by law to retain it.
• Cached data. Computed data (such as chart calculations) is cached temporarily and refreshed periodically. Cache data does not persist beyond the active lifetime of your account.
• Analytics data. Anonymous, aggregated analytics data may be retained indefinitely as it cannot be linked back to individual users.
• Server logs. Server logs containing IP addresses and request metadata are retained for up to 90 days for security and debugging purposes.

10. The Android App

The Lumia Android app, distributed through Google Play, delivers the same Lumia service described in this policy, and this policy applies to it in full. The Android app does not request device permissions beyond those the web service uses, and it does not access your contacts, precise device location, camera, or files unless you choose to add a photo to a journal entry. It collects the same information, for the same purposes, as described in Sections 1 and 2 — including the analytics described in Section 5, which apply identically in the app.

The app runs on Google Chrome and Google Play services on your device; Google's handling of data in those components is governed by Google's own privacy policy. You can delete your account and its data from the app itself (Account → Settings → Delete account) or by following the steps at withlumia.app/delete-account, whether or not the app is still installed.

11. International Data Transfers

Your data is processed and stored on servers located in the United States. If you are accessing the App from outside the United States, your data will be transferred to and processed in the United States. We take appropriate safeguards to ensure your data is protected in accordance with this Privacy Policy.

12. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will update the “Last updated” date at the top of this page and notify you through the App. We encourage you to review this policy periodically.

13. Contact Us

If you have questions about this Privacy Policy or your data, contact us at:

Meridian Labs LLC
Email: hello@meridian-labs.co