LumaWell Privacy Policy

Effective September 16, 2026

Controller: Brightness Labs LLC ("Brightness Labs," "we," "us," or "our")

Contact: legal@lumawell.app

This Privacy Policy explains how Brightness Labs collects, uses, discloses, and protects information when you use the LumaWell mobile application and related services (together, the "Service"). It applies to LumaWell only.

Information we collect

Information you provide

Depending on how you use LumaWell, you may provide:

  • Account and profile information: name, email address, profile photo, age range, gender, country, time zone, and sign-in method. Authentication credentials are handled by Firebase Authentication and, when chosen, Apple or Google. Brightness Labs does not receive your full Apple or Google password.

  • Vaping and progress information: quit date, vaping frequency and device type, estimated puffs and spending, goals, motivations, craving times, craving intensity, mood, stress level, triggers, outcomes, check-ins, resets, slips or returns to regular use, streaks, badges, notes, and related activity.

  • Luma Companion and AI-feature information: messages you send to Luma Companion, recent conversation context, and information used to create personalized recommendations, Weekly Reflections, and Recovery Insights.

  • Support and feedback: messages, attachments, and other information you send when you contact us.

Some vaping and progress information may be considered health-related or sensitive information under applicable law. You choose what to enter, and we use it only for the purposes described in this Policy.

Information collected when you use the Service

We may collect:

  • app and device information, such as device type, operating system, app version, language, time zone, and approximate region inferred from IP address;

  • identifiers needed to operate and measure the Service, such as your Firebase user ID, push-notification token, and an app-instance identifier generated by Google Analytics for Firebase;

  • app-usage information, such as app opens, sessions, screens and features viewed, onboarding progress, feature interactions, and subscription-funnel activity;

  • timestamps and technical or security logs needed to operate, measure, troubleshoot, and protect the Service; and

  • subscription information, such as the selected product, entitlement status, renewal status, and purchase region. Apple processes payment details; we do not receive your full payment-card number.

LumaWell does not currently request access to Apple Health, precise location, contacts, or advertising identifiers.

How we use information

We use information to:

  • create and manage your account;

  • provide, synchronize, maintain, troubleshoot, and secure the Service;

  • display progress, streaks, milestones, and personalized content;

  • recommend resets and provide support around cravings and difficult moments;

  • generate Luma Companion responses, Weekly Reflections, Recovery Insights, and other AI-assisted content;

  • deliver notifications you choose to enable, including reminders and relevant progress or craving support;

  • process and restore subscriptions and confirm access to Pro features;

  • respond to support requests and feedback;

  • understand how people use the Service, whether features work as intended, and how to improve the Service; and

  • comply with law, prevent abuse, and enforce our Terms of Service.

Where the GDPR or UK GDPR applies, we rely on one or more of the following legal bases: performing our contract with you, your consent where required, our legitimate interests in operating and securing the Service and improving its features, and compliance with legal obligations.

AI-assisted features

LumaWell uses artificial intelligence to provide features such as Luma Companion, Weekly Reflection, Recovery Insights, and personalized recommendations.

When you use these features, we may send our AI service provider:

  • the message you submit;

  • recent messages needed to maintain the conversation;

  • your first name, goals, and selected motivations;

  • limited or summarized progress information, such as vape-free days, Daily Reset streak, recent craving patterns, recent reset activity, and verified milestones; and

  • aggregated activity needed to prepare reflections or insights.

We design these requests to exclude your email address, Firebase user ID, full profile, and raw account records. LumaWell currently uses Anthropic to generate AI-assisted content. Anthropic processes the information on our behalf to provide these features.

AI-generated content can be inaccurate and is not medical advice. AI features do not make decisions that determine your legal rights, employment, insurance, credit, or access to essential services.

How we disclose information

We do not sell your Personal Information. We do not share it for cross-context behavioral advertising, and LumaWell does not display third-party advertising.

We disclose information only as reasonably necessary to the following categories of recipients:

  • Google Firebase and Google Analytics for Firebase: authentication, database, file storage, cloud functions, operational logs, push-notification delivery, and aggregate app-usage measurement;

  • Anthropic: generation of AI-assisted responses, reflections, and insights;

  • RevenueCat and Apple: subscription management, purchase validation, entitlement status, and restoration of purchases;

  • Apple or Google: authentication, when you choose the corresponding sign-in method;

  • Professional advisers and authorities: when reasonably necessary to obtain legal, security, or other professional advice, comply with law or valid legal process, enforce our agreements, or protect rights and safety; and

  • Transaction participants: if Brightness Labs is involved in a merger, acquisition, financing, reorganization, bankruptcy, or sale of assets, subject to appropriate confidentiality and notice where required.

We may use or disclose aggregated or de-identified information that cannot reasonably identify you.

We do not use Google Analytics for Firebase to collect your name, email address, Luma Companion messages, notes, custom goals, or the contents of your vaping and wellness entries. We do not use analytics information for third-party advertising.

Data retention

We retain Personal Information only for as long as reasonably necessary to provide the Service, maintain your account, fulfill the purposes described in this Policy, resolve disputes, enforce agreements, and meet legal, tax, accounting, or security obligations.

Luma Companion retains a limited recent conversation history to maintain continuity. Generated reflections and insights, progress records, and activity you log may remain associated with your account until deleted or de-identified. Backup copies and technical logs may remain for a limited period after deletion before being overwritten.

When we no longer need information, we delete or de-identify it unless retention is required or permitted by law.

Your choices and rights

Depending on where you live, you may have the right to access, correct, delete, or obtain a copy of your Personal Information; object to or restrict certain processing; or withdraw consent where processing is based on consent.

You can:

  • update certain profile and vaping information in the app;

  • control LumaWell notifications in the app and in your device settings;

  • cancel a subscription through your Apple account settings; and

  • initiate an account-deletion request through the in-app account controls or contact legal@lumawell.app.

We may need to verify your identity before completing a request. Deleting your LumaWell account does not automatically cancel an App Store subscription. We may retain limited information where an exception applies, such as to comply with law, complete a transaction, prevent fraud, or establish or defend legal claims.

You may appeal a decision about a privacy request by replying to our response. You may also have the right to complain to your local data-protection authority.

California privacy notice

California residents may have rights under the California Consumer Privacy Act, as amended by the California Privacy Rights Act (CCPA/CPRA).

During the preceding 12 months, we may have collected the following categories of Personal Information:

  • identifiers, such as name, email address, account ID, and device identifiers;

  • customer-record information, such as profile information;

  • characteristics of protected classifications, such as age range or gender, when you choose to provide them;

  • commercial information, such as subscription product and status;

  • internet or other electronic-network activity, such as app interactions and technical logs;

  • approximate location inferred from IP address or purchase region, where available;

  • inferences used to personalize progress content; and

  • sensitive Personal Information, including vaping, craving, and related wellness information you choose to enter.

We collect this information from you, your device, app stores, authentication providers, and the service providers identified in this Policy. We use and disclose it for the business purposes described above.

Subject to applicable exceptions, California residents may request access to, correction of, or deletion of their Personal Information. You may also request information about our collection, use, and disclosure practices and may use an authorized agent. We will not discriminate against you for exercising a privacy right.

We do not sell Personal Information or share it for cross-context behavioral advertising. We use sensitive Personal Information only for purposes permitted by the CCPA/CPRA, including providing and securing the Service; accordingly, we do not offer a separate right-to-limit link.

To submit a request, email legal@lumawell.app. We will verify the request as required by law and generally respond within 45 days. If reasonably necessary and permitted by law, we may take one additional 45-day extension and will notify you.

International processing

Brightness Labs is based in the United States, and information may be processed in the United States and other countries where our service providers operate. Where required, we use recognized safeguards for international transfers, such as contractual protections.

Security

We use reasonable administrative, technical, and organizational safeguards designed to protect information, including access controls and encryption in transit. No method of storage or transmission is completely secure, so we cannot guarantee absolute security.

Children's privacy

LumaWell is not intended for children under 13, and we do not knowingly collect Personal Information from children under 13. If we learn that we have done so, we will take reasonable steps to delete it. Users between 13 and 17 should use LumaWell only with the guidance of a parent or legal guardian.

If you believe a child under 13 has provided Personal Information, contact legal@lumawell.app.

Third-party links

The Service may link to websites or services that we do not control. Their privacy practices are governed by their own policies.

Changes to this Policy

We may update this Policy to reflect changes to the Service, our practices, or applicable law. We will post the updated Policy and revise the effective date. If changes are material, we will provide additional notice when reasonably required.

Contact us

For privacy questions or requests, contact:

Brightness Labs LLC

California, United States

legal@lumawell.app