Privacy Policy

1. Introduction

This Privacy Policy describes how Dylluar Labs Consultoria em Tecnologia Ltda., operating under the brand name Lummi (“we,” “us,” or “our”) collects, uses, stores, shares, and protects information when you use the Lummi mobile application (“App”) and the website located at trylummi.app (“Website”), collectively referred to as the “Service.”

We are committed to protecting your privacy and handling your data in an open and transparent manner. By using the Service, you acknowledge that you have read and understood this Privacy Policy. If you do not agree with this Privacy Policy, you must not use the Service.

2. Data Controller

The data controller responsible for your personal data is:

• Entity: Dylluar Labs Consultoria em Tecnologia Ltda. (“Lummi”)
• CNPJ: 46.273.134/0001-87
• Contact Email: contact@trylummi.app
• Website: https://trylummi.app

For any privacy-related inquiries, including requests to exercise your data protection rights, please contact us at contact@trylummi.app.

3. Information We Collect

We collect the minimum amount of data necessary to provide and improve the Service. Below is a complete description of the categories of information we collect, how we collect it, and the purposes for which it is used.

3.1 Information You Provide Directly

3.2 Information Collected Automatically

3.3 Sensitive Information

Journal entries and reflection notes may contain information related to your religious beliefs and spiritual practices. We recognize this as sensitive personal data under applicable privacy laws (including GDPR Article 9 and LGPD Article 11). We process this data solely based on your explicit consent, which you provide by voluntarily creating such entries. All journal entries are encrypted using AES-256-GCM encryption before being stored on your device, and they remain encrypted during any cross-device synchronization via Apple iCloud. We do not access, read, or analyze the content of your journal entries.

3.4 Information We Do Not Collect

We do not collect your email address, phone number, date of birth, physical address, photographs, location data, contacts, calendar data, health data, or any biometric identifiers. The App does not require you to create an account with a username and password.

4. How We Use Your Information

We use the information we collect for the following purposes:

5. Third-Party Service Providers

We use a limited number of third-party services to operate and improve the App. Each provider acts as a data processor on our behalf and processes data only for the purposes described below.

We do not sell, rent, or trade your personal information to any third party. We do not share your data with third parties for their own marketing purposes.

6. Data Storage and Security

6.1 Local Storage

The App stores your data primarily on your device using an encrypted local database (SQLite). The App is designed to function fully offline without requiring an internet connection for core features.

6.2 Cloud Synchronization

If you are signed into iCloud on your device, the App may synchronize your reading progress, preferences, and encrypted journal entries to your private iCloud database via Apple CloudKit. This data is stored in a user-scoped, private database that only you can access. Cloud synchronization is optional and depends on your iCloud settings.

6.3 Encryption

We implement the following security measures:

• Journal entries are encrypted using AES-256-GCM encryption with a unique initialization vector (IV) for each entry before being written to local storage or synchronized to iCloud.
• Encryption keys are stored in Apple iCloud Keychain (synchronized across your devices) or Apple Secure Enclave as a fallback. We do not have access to your encryption keys.
• Data in transit is protected using HTTPS/TLS encryption for all network communications.
• Data at rest in iCloud is protected by Apple's infrastructure-level encryption.

6.4 No Server-Side Storage

Lummi does not operate its own backend servers. All user data resides either on your device or in your private iCloud account. We do not maintain a centralized database of user data.

7. Data Retention

8. International Data Transfers

Our third-party service providers may process your data in countries outside your country of residence, including the United States. Specifically:

• PostHog: Processes data in the United States and/or the European Union, depending on the hosting region.
• Sentry: Processes data in the United States.
• RevenueCat: Processes data in the United States.
• Apple iCloud: Data is processed in accordance with Apple's data processing locations as described in Apple's privacy policy.

Where personal data is transferred outside the European Economic Area (EEA) or Brazil, we ensure that adequate safeguards are in place, such as Standard Contractual Clauses (SCCs) approved by the European Commission, or reliance on the service provider's certification under an applicable data transfer framework.

9. Your Rights

Depending on your jurisdiction, you may have the following rights regarding your personal data. To exercise any of these rights, please contact us at contact@trylummi.app. We will respond to your request within 30 days (or within the timeframe required by applicable law).

9.1 Rights Under the EU General Data Protection Regulation (GDPR)

If you are located in the European Economic Area (EEA) or the United Kingdom, you have the following rights:

• Right of Access (Article 15): You may request a copy of the personal data we hold about you.
• Right to Rectification (Article 16): You may request correction of inaccurate or incomplete personal data.
• Right to Erasure (Article 17): You may request deletion of your personal data. You may also delete all local data directly through the App settings.
• Right to Restriction of Processing (Article 18): You may request that we restrict the processing of your data in certain circumstances.
• Right to Data Portability (Article 20): You may request a copy of your data in a structured, commonly used, and machine-readable format.
• Right to Object (Article 21): You may object to the processing of your data based on legitimate interests.
• Right to Withdraw Consent (Article 7(3)): Where processing is based on consent, you may withdraw your consent at any time without affecting the lawfulness of prior processing.
• Right to Lodge a Complaint: You have the right to file a complaint with your local data protection supervisory authority.

9.2 Rights Under the California Consumer Privacy Act (CCPA/CPRA)

If you are a California resident, you have the following additional rights:

• Right to Know: You may request that we disclose the categories and specific pieces of personal information we have collected about you in the preceding 12 months.
• Right to Delete: You may request deletion of your personal information, subject to certain legal exceptions.
• Right to Correct: You may request correction of inaccurate personal information.
• Right to Opt-Out of Sale or Sharing: We do not sell or share your personal information for cross-context behavioral advertising as defined by the CCPA. Therefore, there is no need to opt out.
• Right to Non-Discrimination: We will not discriminate against you for exercising any of your CCPA rights.

9.3 Rights Under the Brazilian General Data Protection Law (LGPD)

If you are located in Brazil, you have the following rights under the LGPD:

• Confirmation of the existence of processing of your personal data.
• Access to your personal data.
• Correction of incomplete, inaccurate, or outdated personal data.
• Anonymization, blocking, or deletion of unnecessary, excessive, or non-compliant data.
• Portability of your data to another service provider, upon express request.
• Deletion of personal data processed with your consent, except where retention is legally required.
• Information about public and private entities with which your data has been shared.
• Information about the possibility of denying consent and the consequences of such denial.
• Revocation of consent at any time.
• You may also file a complaint with the Brazilian National Data Protection Authority (ANPD) at gov.br/anpd.

10. Data Deletion

You may delete your data through the following methods:

• In-App Deletion: Use the “Reset All Data” option in the App settings to permanently delete all locally stored data and request deletion of synchronized iCloud data.
• App Removal: Uninstalling the App from your device removes all locally stored data. To remove iCloud data, you must also delete the App's data from your iCloud account settings.
• Email Request: Contact us at contact@trylummi.app to request deletion of any data held by our third-party service providers (PostHog, Sentry, RevenueCat). We will process your request within 30 days.

Please note that certain data may be retained by third-party providers in accordance with their own retention policies and applicable legal obligations (e.g., financial transaction records required for tax compliance).

11. Cookies and Tracking Technologies

11.1 Website

The Website at trylummi.app uses PostHog, a privacy-focused product analytics service, to understand how visitors interact with our pages and content. PostHog collects anonymized usage data such as pages visited, referral source, general geographic region, browser type, and interactions with page elements. This data helps us improve the Website and measure the effectiveness of our content.

PostHog uses cookies and local storage to distinguish returning visitors. No personally identifiable information (such as your name or email address) is collected through analytics unless you voluntarily provide it (e.g., by submitting the waitlist form). You may block cookies through your browser settings at any time.

11.2 Mobile App — Advertising Identifier (IDFA)

The App may request access to Apple's Identifier for Advertisers (IDFA) through the App Tracking Transparency (ATT) framework. This identifier is used solely for anonymous analytics to understand how the App is used and to improve your experience. You may deny this request when prompted by iOS, and the App will continue to function normally. You may also change this setting at any time in your device's Settings under Privacy & Security > Tracking.

12. Push Notifications

The App may request your permission to send local push notifications. These notifications are used for:

• Daily reading reminders at your chosen time.
• Evening encouragement nudges (if enabled).
• Trial status updates during your free trial period.

All notifications are scheduled locally on your device. We do not use a remote push notification service, and no notification content is sent to or processed by our servers. You may disable notifications at any time through your device settings or within the App settings.

13. Children's Privacy

The Service is not directed to children under the age of 13 (or under the age of 16 in the European Economic Area). We do not knowingly collect personal information from children under these ages. If we become aware that we have collected personal information from a child under the applicable age threshold, we will take steps to delete such information promptly. If you believe that a child has provided us with personal information, please contact us at contact@trylummi.app.

14. Automated Decision-Making

The App uses a rule-based recommendation system to suggest a Bible reading plan based on your selected time preference and emotional need during onboarding. This system uses a fixed matrix of predetermined combinations and does not employ artificial intelligence, machine learning, or profiling. You are not bound by the recommended plan and may choose any available plan at any time.

15. Artificial Intelligence

As of the date of this Privacy Policy, the Service does not use artificial intelligence (AI) systems, machine learning models, or generative AI features. All content in the App is curated by humans, and all recommendations are generated using deterministic, rule-based logic.

If we introduce AI-powered features in the future, we will update this Privacy Policy in advance to disclose: (a) the nature and purpose of the AI system; (b) what data is processed by the AI system; (c) whether the AI system makes or assists in making decisions that affect you; and (d) your rights in relation to such processing. We will notify you of any such changes in accordance with Section 18 of this Privacy Policy and in compliance with the EU AI Act (Regulation (EU) 2024/1689), including the transparency obligations set forth in Article 50 thereof.

16. “Do Not Track” Signals

The Website uses anonymized analytics (PostHog) to understand visitor behavior. We do not currently alter our Website tracking practices in response to “Do Not Track” browser signals. You may block analytics cookies through your browser settings. In the App, analytics tracking is subject to the iOS App Tracking Transparency framework, and you may opt out at the system level.

17. Website Privacy Practices

The Website at trylummi.app is a marketing and informational website. It uses PostHog for anonymized analytics (see Section 11.1) and offers a waitlist form where you may voluntarily provide your email address. Waitlist emails are stored via Resend and used solely to notify you about product updates. You may request removal from the waitlist at any time by contacting contact@trylummi.app. The Website does not require user registration, and analytics data is not linked to your identity.

18. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or the features of the Service. When we make material changes, we will:

• Update the “Last updated” date at the top of this page.
• Provide notice within the App or via the Website, as appropriate.
• Where required by law, obtain your consent before applying material changes to how we process your data.

We encourage you to review this Privacy Policy periodically. Your continued use of the Service after any changes indicates your acceptance of the updated Privacy Policy.

19. Contact Us

If you have any questions about this Privacy Policy, wish to exercise your data protection rights, or have concerns about how your data is handled, please contact us at:

• Email: contact@trylummi.app
• Website: trylummi.app/support

We will make every effort to respond to your inquiry within 30 days.