Privacy Policy

The short version

• Your health information (injection logs, doses, symptoms, food logs, weight, notes, and anything read from Apple Health) stays on your device. We do not upload it to our servers as a matter of course.
• AI chat messages travel to Anthropic so a model can reply. We do not store chat text on our servers. Your transcript lives only on your device, and you can clear it.
• We store a small set of account records on our servers: your sign-in email, a user ID, subscription status, Hero program status, chat usage counts, and (unless you opt out) affiliate click records.
• We do not sell your personal information. We do not run third-party analytics or advertising SDKs in the app.
• Affiliate attribution is the one thing we declare as "tracking" under Apple's rules. You can turn it off in Settings.
• Server data is encrypted in transit and at rest. It is not end-to-end encrypted, and we do not claim it is.

1. Information that stays on your device

The following is stored only in the app's local database on your iPhone. It is not sent to Lumiden's servers:

• Injection logs, dose amounts, and injection-site rotation history
• Symptom logs and food logs
• Weight entries and notes
• Your name, as entered during onboarding
• Your AI chat transcript (see Section 4 for how chat works in transit)
• Readings the app displays from Apple Health (see Section 2)
• An optional profile photo, if you add one

This data is protected by your device's built-in encryption and your passcode. Deleting the app deletes this local data. If you use an iPhone backup (iCloud or computer), your local app data may be included in that backup under Apple's terms, which we do not control.

One exception, under your control: if you turn on Personalized Chat, a short summary of recent health context is included with your chat messages. Section 4 explains exactly what that summary contains and where it goes.

2. Apple Health (HealthKit)

With your permission, Lumiden reads two things from Apple Health: your weight and your daily step count. That is the full list.

• Read-only. Lumiden never writes anything to Apple Health.
• On-device only. HealthKit readings are displayed in the app and are never transmitted to Lumiden's servers, to Anthropic, or to any other third party.
• Never for marketing. We do not use HealthKit data for advertising, marketing, or any purpose other than showing it to you in the app, consistent with Apple's HealthKit rules.
• Revocable. You can withdraw access at any time in the iOS Health app under Sharing, or in iOS Settings.

3. Information we store on our servers

Lumiden's backend runs on Supabase, a hosted database and authentication provider. the United States (AWS us-east-1) If you create an account, we store:

• Email address, used to sign you in. If you use Sign in with Apple with "Hide My Email," we receive and store the private relay address Apple generates, not your real one. Sign-in options are Sign in with Apple, Google, and an emailed sign-in link.
• A user ID (a random identifier) that ties your account records together.
• Subscription records: your tier (free, Premium, Hero, or Lifetime) and expiration, so paid features work across reinstalls. Apple processes all payments; see Section 6.
• Hero program records: whether you have Hero status, the role category you certified, and the discount type you chose, including any charity donation selection.
• Chat usage metadata: for each chat message, a record of the role (you or the assistant), a token count, and your privacy mode setting. This is how we enforce daily chat limits. The text of your messages is never stored on our servers.
• Affiliate event records, unless you opt out. See Section 5.

Our infrastructure providers (Supabase and its hosting platform) keep standard operational logs, such as IP addresses used for rate limiting and abuse prevention. These are infrastructure logs, not profiles we build about you.

If you join the website waitlist, we store the email you give us and use it only to tell you when Lumiden is available. You can unsubscribe at any time.

4. AI chat and Anthropic

Lumiden's chat companion is powered by a Claude model from Anthropic. Here is the full path of a chat message:

• Your message travels from your device, through Lumiden's server function, to Anthropic's API, which generates the reply.
• Lumiden's servers do not store the text of your message or the reply. Only the usage metadata described in Section 3 is recorded.
• Your transcript is kept on your device only. You can clear it at any time in the app.
• Under the provider terms that apply to Lumiden's use of Anthropic's API, chat content is not used to train Anthropic's models.

Personalized Chat (optional)

If you turn on Personalized Chat, each message also carries a short health-context summary so the companion can respond with your situation in mind: your medication name, last injection date, where you are in your dose cycle, recent symptoms, and food tolerance notes. This summary comes from your on-device logs, is sent to Anthropic to generate the reply, and is not stored on Lumiden's servers. The app explains this before your first chat, and you can turn Personalized Chat off at any time in Settings.

Crisis routing

If a message matches certain crisis or urgent-symptom patterns (for example, language about self-harm or a possible overdose), the app replies with a pre-written message pointing to emergency resources instead of sending your message to the AI model. In that case we log only the category of the match and the time, never your words.

5. Affiliate links and tracking, with an opt-out

Some links in Lumiden, mainly in the Cost Guide, are affiliate links. If you tap one and later enroll or buy something from that partner, the partner may pay Lumiden a commission. To make that attribution work:

• We record affiliate events (an impression, click, or conversion, plus the partner stream and product involved) tied to your user ID in our own database.
• When you tap an affiliate link, an attribution identifier is passed to the partner so the referral can be credited to Lumiden.

Under Apple's definitions, this counts as tracking, and we declare it that way on our App Store privacy label. Three things to know:

• You can opt out. There is a toggle in the app's Settings that turns affiliate attribution off. Links still work; we just stop recording attribution events.
• It never costs you more. Prices are the same whether or not attribution is on.
• It never changes what we show you. We order recommendations by what we judge most useful, not by what pays us most. See our Affiliate Disclosure.

We do not run any third-party advertising or analytics SDKs in the app, and we do not share your data with ad networks or data brokers.

6. Payments

Subscriptions and the Lifetime purchase are processed by Apple through the App Store. Apple never shares your card number or full payment details with us. We receive only what we need to turn on the features you paid for: an entitlement record and your subscription status.

7. Who receives your information

We use a small number of service providers to run Lumiden:

• Supabase hosts our database, authentication, and server functions (Section 3).
• Anthropic processes chat messages to generate replies (Section 4).
• Apple processes payments and, if you use Sign in with Apple, sign-in (Sections 3 and 6).
• Google processes sign-in if you choose Google sign-in.
• Affiliate partners receive an attribution identifier when you tap their link, unless you have opted out (Section 5).

We do not sell your personal information, and we have not sold it in the past. We may disclose information if the law requires it, to protect the safety of a person, or as part of a business transfer such as a merger or acquisition, in which case this policy would continue to apply to your data until you are told otherwise.

8. How long we keep information, and how to delete it

• On-device data stays until you delete it in the app or delete the app itself.
• Server records (Section 3) are kept while your account exists. When you delete your account, your profile and the records tied to it, including chat metadata, subscription records, Hero records, and affiliate events, are deleted from our production database. Settings, then Delete everything Residual copies in encrypted backups are removed on the backup provider's rotation schedule. a limited period set by our hosting provider's backup policy
• Waitlist emails are deleted when you unsubscribe or after the launch mailing is complete.

You can also request deletion by emailing hello@lumiden.app. We will verify the request and act on it within the timelines required by applicable law.

9. Your rights and choices

Wherever you live, you can:

• Access and export. Your health logs are on your device, and the app includes an export feature. You can also ask us for a copy of the account records we hold.
• Correct. Edit your data in the app, or ask us to correct account records.
• Delete. See Section 8.
• Opt out of affiliate tracking. See Section 5.
• Withdraw Apple Health access. See Section 2.

California residents

The California Consumer Privacy Act gives you rights to know, delete, correct, and opt out of the sale or sharing of personal information, and the right not to be discriminated against for exercising them. We do not sell personal information. Affiliate attribution (Section 5) may qualify as "sharing" under California law; the in-app opt-out toggle is how you opt out. To exercise any right, email hello@lumiden.app. We will verify your identity before acting, and you may use an authorized agent.

Users in the EEA, UK, and other regions with GDPR-style laws

Lumiden currently distributes on the US App Store. If you use Lumiden from a region with GDPR-style law, you have rights of access, rectification, erasure, restriction, portability, and objection. Our legal bases are performance of our contract with you (running the app and your account), your consent (Personalized Chat, affiliate attribution, Apple Health access), and our legitimate interests (securing and improving the service). You may lodge a complaint with your local supervisory authority.

10. Children

Lumiden is rated 17+ and is intended for adults managing their own prescribed medication. It is not directed to children, and we do not knowingly collect personal information from anyone under 13. If you believe a child has provided us personal information, email hello@lumiden.app and we will delete it.

11. Security

Data sent to our servers is encrypted in transit (TLS) and encrypted at rest by our hosting provider. Access to account records is restricted by row-level security rules, so each account can reach only its own records. To be precise about what we do not offer: Lumiden's server-side data is not end-to-end encrypted. No online service can promise perfect security, and we do not. If a breach affects your personal information, we will notify you as applicable law requires.

12. Changes to this policy

When we change this policy in a meaningful way, we will update the effective date at the top, post the new version at this address, and tell you in the app before the change takes effect if it materially affects how your data is handled. Earlier versions are available on request.

13. Contact

Crestline Labs
Crestline Labs, attn: Travis, General Delivery, Melbourne, FL 32904
Email: hello@lumiden.app hello@lumiden.app