Privacy Policy

01

Who we are

Lume is an app that supports people who are quitting smoking or vaping. It is operated by LUME DESENVOLVIMENTO DE SOFTWARES LTDA, a Brazilian company registered under company ID (CNPJ) 65.806.764/0001-14, headquartered at Av. Cristóvão Colombo, 2144, Sala 408, Andar 3 — Floresta, Porto Alegre/RS, CEP 90560-001, Brazil ("Lume", "we").

For the purposes of this policy and of Brazilian Law 13.709/2018 (the General Data Protection Law — LGPD), we are the controller of the personal data processed in the Lume app and on this website.

02

Who this policy applies to

This policy applies when you download, install or use the Lume app — on iPhone or Android —, when you browse this website, and in any related interaction: support, community, Support Circle and subscription management.

It does not apply to third-party services you reach from Lume. The App Store, Google Play and Instagram have their own policies, and theirs are the ones that govern while you are in there.

Using Lume means agreeing with what is described here. If you disagree with any part of it, the honest path is not to use the app — and to write to us saying why, if you feel like it.

03

Data we process

We process the minimum needed for Lume to work. Concretely, this:

04

Why this data is sensitive

Quitting smoking is a matter of health. When you log a relapse, what you felt right before lighting a cigarette, or how many days you have been smoke-free, that is sensitive personal data under article 5, II of the LGPD — and processing it follows stricter rules.

In practice, this means:

• This data is processed with your consent, given freely, informedly and specifically when you use the app (LGPD, art. 11, I).
• We do not share the content of your records with advertisers, data brokers, health plans or insurers. Ever. It is not a commercial commitment, it is a line we do not cross.
• Mixpanel only receives usage events — "logged a moment", "finished the breathing exercise" —, never the text of what you wrote.
• AppsFlyer receives install and campaign data, never record content nor any information about your health.
• You can withdraw your consent at any time by deleting your account, as described in Delete Account.

05

What we use your data for

We process the data above for these purposes and nothing beyond them:

• Running the app — authenticating you, keeping the counter accurate, syncing your records across sessions and devices, showing your history and your phase.
• Supporting you when a craving hits — choosing which resource to offer (breathing, water, movement, community) based on what you logged.
• Managing the subscription — unlocking paid features, reflecting the state the store reports to us and showing the right offer.
• Sustaining the community — publishing under the nickname you chose, delivering interaction notifications and enabling reporting, blocking and moderation.
• Sending reminders — the notifications you authorised, at the times you configured.
• Improving the product — understanding in aggregate how the app is used and where it fails.
• Measuring acquisition — knowing which channel people arrived through, within what you allowed.
• Providing support — answering messages sent to our support channel.
• Complying with the law — responding to requests from competent authorities, the courts or the Brazilian data protection authority (ANPD).
• Keeping things secure — detecting fraud, abuse and breaches of the Terms of Use.

We do not use your records to train third-party artificial intelligence models, and we do not sell personal data.

06

Legal bases

Each category of data rests on a specific legal basis under the LGPD:

07

Community and public content

The Lume community is where people share what they are going through. A few things need to be clear before you post:

• Posts and comments are visible to other Lume users. Do not write anything there you would not want another person to read.
• Authorship shows the nickname you chose. The name coming from your Apple, Google or email sign-in is not displayed.
• Messages in a Support Circle stay within that circle — but they are still read by its members, and they are not end-to-end encrypted.
• We moderate reactively: we review reported content and remove whatever breaches the Terms of Use or the community guidelines. You can report and block another person at any time.
• When you delete your account, your posts and comments are removed. Excerpts other people quoted in their replies may remain, detached from your identity.

08

Subscription and billing

We use Superwall to decide which offer to show and to record subscription-related events — offer screen shown, plan started and ended. It identifies you by an app identifier, not by your name.

09

Who we share it with

We only share data with the processors below, who help make Lume work. Each receives only what its role requires:

Beyond these, we may share data with public authorities where there is a legal obligation or a court order, and with legal counsel where necessary to defend our rights. We do not sell your data and we do not share it with advertisers or data brokers.

10

International transfers

The processors listed above keep infrastructure outside Brazil, which entails international transfer of data. When that happens we observe articles 33 to 36 of the LGPD: we contract suppliers that demonstrate a level of protection compatible with Brazilian law and that adopt appropriate contractual clauses and security measures.

11

Storage and retention

Your data is kept for as long as your account exists — that is what keeps the counter running and your history available to you.

12

Security

We apply technical and administrative measures to protect your data:

• Encryption in transit (TLS) on every connection between the app and our servers.
• Encryption at rest applied by the database provider.
• Row-level access rules in the database, so each account sees only its own data.
• Authentication delegated to recognised providers — Apple and Google —, which means their password never passes through us.
• Internal role-based access control, on a least-privilege basis.
• Monitoring of and response to security incidents.

No system is immune to failure. If a relevant security incident occurs, we will notify you and the Brazilian data protection authority, as article 48 of the LGPD requires.

13

Your rights

The LGPD grants you, as the data subject, the rights below. All of them can be exercised through our support channel, and none of them costs anything:

We answer within 15 days, under article 19 of the LGPD. In some cases we ask for extra information to confirm it really is you — that is a protection for you, not a barrier.

14

How to delete your account

There are two routes, and both erase everything. The full walkthrough, with what is removed and what remains, is in Delete Account.

1. In the app: Profile → Settings → Delete my account.
2. By email: write to contato@meulume.com from the address linked to your account.

15

Notifications

Lume sends notifications to remind you to check in, to mark milestones on your journey and to tell you about community interactions. They only exist if you allow them, and permission can be withdrawn whenever you want:

• Inside the app, under Settings → Notifications, where you can choose types and times.
• On iPhone, under Settings → Lume → Notifications.
• On Android, under Settings → Apps → Lume → Notifications.

Turning notifications off does not affect the rest of the app. The counter keeps running.

16

Tracking and advertising

On iPhone, iOS shows the App Tracking Transparency (ATT) prompt asking whether you allow Lume to track your activity. If you answer "Ask App Not to Track", we do not perform attribution based on the advertising identifier — and nothing in the app stops working because of it.

Lume shows no third-party ads and builds no advertising profile from the content of your records. Attribution exists so we know which channel people arrive through, and nothing beyond that.

This website uses no cookies, has no analytics and loads no tracking script whatsoever. A site that talks about privacy really should not need a consent banner.

17

Children and teenagers

Lume deals with nicotine dependence and is rated 12+ in the stores. Even so, it was built for adults, and creating an account presupposes the capacity to accept the Terms of Use.

Where a teenager does use it, processing will observe their best interest and article 14 of the LGPD, with the consent of a parent or legal guardian, as applicable.

If you are a guardian and you notice Lume being used by someone in your care contrary to this policy, write to us and we will act on it.

18

Changes to this policy

This policy may change to keep up with the app, the law or store requirements. The date at the top of this page indicates the version in force.

A material change is announced inside the app before it takes effect. If it involves a new purpose that depends on consent, we will ask for your consent again — silence does not count as an answer.

19

Contact and data protection officer

For questions about this policy or to exercise any of your rights, use the channel below. It is the same address that answers as Data Protection Officer under article 41 of the LGPD.

You may also go directly to the Brazilian data protection authority at gov.br/anpd. We would rather sort it out before that, but the choice is yours.