Privacy Policy
1. Who we are
LovLume is a meditation and self-care app operated by LovLume ("we", "us"), registered at an address that will be published here once the company registration is complete.
We are the data controller for the personal data described in this policy.
For anything to do with your data, write to privacy@lovlume.com.
2. What this policy covers
This policy explains what the LovLume mobile app collects, why, what we do with it, who else sees it, and what you can ask us to do about it.
It applies whether you use LovLume as a guest or with an account.
3. What we collect
Account information. If you create an account: your email address, your display name, and the sign-in method you chose (email code, Google, or Apple). Your password, where you have one, is held by our sign-in provider and never reaches us.
Guest use. If you use LovLume without an account, we still create a record for you on our servers so your progress and settings can be saved. It is identified by a token stored on your device, not by your name or email.
What you do in the app. Which meditations you play and for how long, whether you finished them, which ones you favourite, which daily tasks you commit to and complete, your daily ritual progress, and which affirmations and breathing exercises you use.
What you write. Reflections you add to a completed task are stored with your account. Nobody reads them as a matter of routine.
Your settings. Theme, language, sound volumes, preferred voice, vibration, session-end bell, font size, notification preferences, reminder time, your time zone, and your monthly goal.
Device and app information. Platform, app version, and a session identifier generated each time you open the app. If you turn on notifications, we also store a push token and a device identifier so we can deliver them.
Usage measurement. If you agree to it, we record events describing how you move through the app - screens opened, a meditation started or completed, a task finished, a subscription screen viewed. These are linked to your account or guest record, so they are personal data, not anonymous statistics. You can turn this off at any time in Settings, and nothing else about the app changes if you do.
Purchases. If you subscribe, our payments partner tells us whether your subscription is active, which product you bought, which store it came from, and when it expires or renews. We never see your card details.
4. Why we use it, and our legal basis
To provide the app - playback, saving your progress, syncing your settings, and keeping you signed in. Legal basis: performance of our contract with you.
To run your subscription - unlocking premium content, keeping entitlements accurate, and sending you receipts and billing notices. Legal basis: performance of our contract with you.
To keep the service secure and working - detecting abuse, diagnosing failures, and preventing fraud. Legal basis: our legitimate interest in a service that works and is not abused.
To measure how the app is used, so we can improve it. Legal basis: your consent.
To show ads to people on the free tier. Legal basis: your consent, collected through Google's consent form. Without consent we show non-personalised ads only.
To send you reminders and progress notifications you have asked for. Legal basis: your consent.
To send you tips, news and offers by email. Legal basis: your consent. Every one of these emails has an unsubscribe link.
To meet legal obligations, such as tax record-keeping. Legal basis: compliance with a legal obligation.
5. Your choices
Anything we do on the basis of your consent, you can stop at any time, and it is no harder to stop than it was to start.
Settings -> Privacy and data holds all of it in one place: usage measurement, personalised ads, marketing email, and each category of notification. Turning any of them off takes effect immediately and does not limit your access to the app.
Withdrawing consent does not undo what was done while it was in place.
6. Advertising
LovLume shows ads to free-tier users through Google AdMob. Premium subscribers see no ads.
Before any ad loads, we ask for your choice using Google's consent form. If you consent, Google may use advertising identifiers to personalise what you see. If you do not, you still get ads, but non-personalised ones based only on general context.
You can change this at any time in Settings -> Privacy and data -> Personalised ads. On iOS, Apple asks separately for permission to track you across apps; if you decline there, we do not receive an advertising identifier at all.
7. Who else sees your data
We do not sell your personal data.
We use the following providers, each of which processes data on our instructions:
- Clerk - sign-in, account identity, and session security.
- RevenueCat - subscription status. It receives your LovLume user identifier along with purchase and device information.
- Google AdMob - advertising, where you have consented.
- Google Firebase Cloud Messaging - delivering push notifications.
- Postmark - sending account and marketing email.
- Cloudflare R2 - storing and delivering meditation audio.
- Render - hosting our servers and database.
We also disclose data where the law requires it, or where it is necessary to establish or defend legal claims.
8. Where your data goes
Our providers are based partly outside the European Economic Area, mainly in the United States.
Where data leaves the EEA or the UK, the transfer is covered by the European Commission's standard contractual clauses, or by an adequacy decision where one applies to that provider.
We will send you a copy of the safeguards in place if you ask.
9. How long we keep it
Account and activity data - for as long as your account exists. When you delete your account, we remove it from our live systems straight away; residual copies in encrypted backups are cycled out within 30 days.
Usage measurement events - 24 months, then deleted.
Guest records - removed when the guest session is replaced or when you upgrade to an account, at which point your progress moves with you.
Push tokens - until you turn notifications off, the token stops working, or you delete your account.
Billing records - as long as tax and accounting law requires, typically several years, independently of your account.
10. Your rights
Under the GDPR and equivalent laws you have the right to:
- get a copy of the personal data we hold about you;
- have inaccurate data corrected;
- have your data deleted;
- object to processing we base on legitimate interests;
- ask us to restrict processing while a dispute is resolved;
- receive your data in a portable format;
- withdraw consent at any time.
Two of these you can exercise yourself, immediately, without asking us: Settings -> Profile -> Export my data gives you a machine-readable copy of everything, and Settings -> Profile -> Delete account erases it.
For anything else, write to privacy@lovlume.com. We answer within one month.
If you think we have handled your data badly, you can complain to your national data protection authority. You are also welcome to raise it with us first.
11. Children
LovLume is not intended for children under 18, and we do not knowingly collect their data.
If you believe a child has given us personal data, write to privacy@lovlume.com and we will delete it.
12. Security
Data is encrypted in transit and at rest. Access to production systems is limited to the people who need it and is logged.
No system is perfectly secure. If a breach affects your data and is likely to put your rights at risk, we will tell you and the relevant authority as the law requires.
13. Changes to this policy
When we change this policy we update the version number and the effective date at the top.
If a change materially affects you, we will tell you in the app before it takes effect, and ask you to review it. We will not quietly swap the document.
14. Contact
Privacy questions and rights requests: privacy@lovlume.com
Everything else: help@lovlume.com
LovLume (company registration in progress)
Registered address: to be published once the company registration is complete