Privacy Policy

LumenDrift is operated by Lumenshore Limited, a company registered in England and Wales under company number 09607326. Our registered office is Windsor House, Troon Way Business Centre, Humberstone Lane, Leicester, England, LE4 9HA. Lumenshore Limited is the controller of the personal information we use to operate LumenDrift: we decide why that information is needed and how it is handled.

This policy covers the LumenDrift website, iPhone app, account services, sound-world delivery, Royal subscriptions, messages and reports you send us, and privacy requests. It explains information collected directly from you, information generated when you use a feature, and information received from the authentication and purchase providers you choose. Features and permissions may differ between app versions and countries.

Other Lumenshore products have their own privacy policies. Some LumenDrift services use shared Lumenshore infrastructure, but this does not make your LumenDrift information public or turn this policy into a policy for every Lumenshore product. Apple, Google, and other providers may separately act as controllers for their own account, billing, security, and legal responsibilities.

Read the sections relevant to the features you use together with the regional supplement for your location. A regional supplement applies when the relevant law covers the processing; a language setting or website visit alone does not determine jurisdiction. Mandatory privacy rights take priority over any inconsistent term in our service agreements.

LumenDrift is designed around listening and personal choice. Local favourites, playback preferences, and listening history have a different purpose from an account record, a purchase entitlement, or a request for help. We describe these separately so that a promise about one does not obscure what happens to another.

We do not sell personal information, build third-party advertising audiences from your listening, or provide your personal content to external general-purpose AI providers for model training. The current website has no advertising pixels or session-replay integration. Essential service requests and website measurement still involve information processing, as described below.

• No automatic access to your private lifeOrdinary listening does not give us access to contacts, photos, precise GPS location, microphone recordings, calendar contents, or Apple Health records. A general privacy setting is not permission to collect all of these categories.
• No card-number collection by LumenDriftApple handles App Store payment details. LumenDrift and RevenueCat use purchase and entitlement information to recognise Royal access and restore purchases.
• No public listening profileYour favourites and listening history are not published as a public profile. Sending a message, a bug report, or something through another app is a separate action with its own recipients.
• No blanket anonymity claimAccount identifiers, hashed security identifiers, connection records, and information you submit can still be personal information. Removing a name does not automatically make a record anonymous.

The following inventory describes categories used across LumenDrift. It does not mean that every visitor provides every category. Reading a public page, playing a preview, signing in, buying Royal, and sending a report have different data requirements.

We do not buy consumer profiles from data brokers. Information received from a sign-in or payment provider is used for the relevant account or purchase relationship. We may also receive a lawful request from a regulator, an authorised representative, or a person reporting a security problem; those records are handled for that request, not as a new marketing list.

You can read public website pages without an account. Account-based features need an identity that we can authenticate; protected downloads need a valid access request; Royal restoration needs sufficient purchase information to check your entitlement. We cannot provide those particular functions if their necessary information is unavailable or invalid.

Sending a message, joining an available early-access list, and submitting a bug report are choices. Optional diagnostic details can help explain a technical problem, but a report still includes its text and basic feature context. You should include only information relevant to the issue and avoid passwords, payment details, medical records, or information about someone else that is not needed.

Withdrawing an optional permission or consent does not automatically close your account. It may stop the feature that depends on that permission. Similarly, refusing a preview security check can prevent that clip from playing while leaving public information pages available. We do not treat a request to exercise privacy rights as a reason to penalise you.

We may need a limited identity check before releasing account information or deleting an account. If we cannot safely verify the request, we will explain what is missing and consider another proportionate way to establish authority. Providing extra information for verification does not authorise unrelated use.

The app keeps local information that makes listening work: favourites, playlists, downloaded audio, playback preferences, recent listening, ritual selections, and settings. Local recommendation logic can use these choices to suggest a sound world or help you return to something familiar. This information is not automatically a cloud listening history.

Connecting to the service is separate. Account setup sends the account and device fields described in this policy, including a preferred ritual where provided. Requesting protected audio necessarily identifies the requested item to the service delivering it. A report may include the currently selected ritual or sound world. These actions mean that “stored locally” should not be read as a promise that our servers never learn which feature or audio item you requested.

An installation credential is held in the iPhone Keychain to protect access from that installation. Device backups, operating-system storage, and any information you deliberately share through Apple or another application are also subject to the controls of those systems. We do not represent an account sign-in or an iCloud-labelled setting as proof that your full library is being synchronised.

Manage downloaded worlds and other local information using the controls available in your app version. Removing the app can remove its application storage, but it does not necessarily erase Keychain items, device backups, provider records, or the account held by our service. Account deletion, local deletion, and subscription cancellation are explained separately below.

A sound-world choice is not a diagnosis. We do not use a Calm Recovery selection, a listening duration, or an accessibility preference to declare that you have a medical condition, infer a treatment need, or sell a health profile. LumenDrift is a listening product, not a medical record or an emergency service.

The current app-to-service integration does not upload raw Health data, calendar entries, microphone audio, contacts, or precise location. Permission explanations or settings for possible context features do not themselves mean that those data sources are connected or collected. If a future version introduces such processing, the feature needs its own clear explanation and any required platform permission and legal consent before collection.

An operating-system permission and a lawful basis for processing are different requirements. Where sensitive personal information is involved, an additional legal condition may be necessary. For example, a future optional health-data feature could require explicit consent as well as a purpose-specific Apple permission; ordinary acceptance of this policy would not substitute for that consent.

You can choose to reveal sensitive information in free-text messages even though we do not request it. Please keep reports focused on the product issue. If a submission contains unnecessary sensitive information, you can ask us to remove it; we may restrict its use or remove it when it is not needed. Do not send someone else’s private information unless you have a proper reason and authority to do so.

Clerk provides authentication for LumenDrift. When you sign in, we use the verified account identity to associate your app session with your LumenDrift profile. Our account records can contain a display name, email address, Clerk identity reference, locale, time zone, preferred ritual, and service timestamps. Authentication records and credentials are used to confirm that requests come from the appropriate account or installation.

If you choose Sign in with Apple, Apple may supply your name and an email address according to your choices and its sign-in rules. If you use Hide My Email, the address available to us can be an Apple relay address. Keep that forwarding route available if it is how you receive necessary account communications. We do not receive your Apple password or the contents of your Apple account.

The identity provider may maintain its own fraud-prevention, account-security, and sign-in records. Its role is distinct from the LumenDrift profile stored by Lumenshore. Signing out stops ordinary use of the session on that device; it does not erase the account, cancel Royal, or delete a provider’s independent records.

You can manage connected applications with your identity provider. Revoking a connection can prevent future sign-in using that method, but it does not necessarily delete information we already lawfully received. Use the account-deletion or privacy-request route if you also want us to erase or restrict that information.

Google sign-in is an optional way to authenticate through Clerk. The explanation below concerns that sign-in connection. It does not mean LumenDrift has access to all information associated with your Google account, and it is separate from any use of Google Cloud infrastructure for service backups.

Apple processes App Store purchases. LumenDrift does not receive or store your full payment-card number, card security code, or Apple payment credentials. Apple may retain payment, tax, fraud-prevention, and transaction information for its own responsibilities under its privacy notice and terms.

RevenueCat helps us manage purchase status and Royal entitlements. The integration uses a stable Clerk account identifier so that an entitlement can be associated with the correct signed-in person. It also processes product and transaction information, purchase environment, subscription state, expiry or renewal details, and events needed to recognise changes such as refunds or restoration. We do not supply your name or email as subscriber attributes in this integration.

Our backend maintains the subscription information needed to provide the correct access and reconcile provider events. A purchase identifier is still personal information when it can be connected to your account. It is not treated as anonymous merely because it differs from your email address.

Restoring purchases asks the relevant services to check an existing entitlement; it is not a new marketing registration. Deleting a LumenDrift account does not cancel an Apple subscription. Manage renewal in your Apple subscription settings, and use Apple’s refund process where applicable. Some transaction or accounting records may need to remain after account deletion for legal, fraud-prevention, or dispute purposes.

If your app version provides a messaging feature, sending a message transmits its text to the service. Conversation records can include the title, intent or category, status, source, timestamps, message order, and replies. These are service records, not information that remains exclusively on your phone. Only submit content you intend the service to receive.

The current reply implementation selects prepared responses rather than sending your conversation to an external generative-AI provider. A reply may be automated; it should not be understood as a person monitoring the conversation or as professional medical advice. The service does not provide crisis monitoring or guaranteed real-time responses.

A bug report includes your description, category, severity, expected behaviour where supplied, and the screen or entry point involved. Basic context can include the selected ritual, active world, playback state, and whether a session is active. If you include diagnostics, the report can also include app/build and operating-system versions, device class, locale, time zone, low-power mode, and broad counts of saved items or downloads.

The reporting feature filters sensitive diagnostic keys, but it cannot guarantee that private information typed into the message will be removed. Never include a password, authentication code, full payment details, private medical record, or unnecessary information about another person. We use reports to investigate the issue, improve reliability, and maintain appropriate records of its handling; submitting one does not promise a particular response time or resolution.

Vercel hosts the LumenDrift website. Delivering a page involves network and request information, including your IP address, requested resource, browser information, timing, and security-related signals. These requests can be processed by hosting and network infrastructure even when you do not fill in a form or create an account.

Vercel Web Analytics provides aggregate visit information. Measurements can include page URL or path, referrer, filtered query parameters, broad location derived from the request, device and browser categories, and a timestamp. Vercel describes a request-derived visitor hash that is discarded after 24 hours. That lifespan is not a promise that aggregate statistics or separate hosting logs are deleted after 24 hours.

Vercel Speed Insights measures page performance, such as loading, responsiveness, and visual stability, together with page and device context. The website does not configure custom analytics events, advertising profiles, or session replay. It does not intentionally attach a LumenDrift account identity or your in-app listening history to these website measurements.

Website measurement currently loads during browsing. Our Cookie settings panel explains the active technologies; it does not save an acceptance or rejection choice or turn measurement off. Reading the policy, continuing to browse, and closing that panel are not recorded as consent. The Cookie Policy describes this behaviour and the available browser controls in more detail.

A website sound preview is a separate request from reading a page. On a playback request, the player loads Cloudflare Turnstile to assess whether the request appears legitimate. Cloudflare can process browser, device, and connection signals, including an IP address. The preview service verifies the resulting token before granting access to an excerpt stored in Cloudflare R2.

The service issues a time-limited media grant and uses request limits to reduce automated downloading and abuse. Quota records use pseudonymous, keyed identifiers derived from connection information, together with information such as the requested world, grant timing, request count, and bytes delivered. These are security controls, not a public listening profile. Pseudonymous identifiers remain protected information where they can relate to a person.

The player holds the fetched excerpt and temporary playback state in browser memory. It does not create a persistent offline audio library in localStorage, sessionStorage, or a service-worker cache. An already loaded clip may remain in memory after a signed link expires. Changing the selected world or removing the player releases its audio object; merely pausing it does not necessarily do so.

Cloudflare’s security processing and our own quota records are separate. The lifetime of a token does not describe every provider log. Blocking Turnstile or refusing the information required for its check can prevent playback. You can continue to read the website without starting a preview.

The current website application does not set its own account, advertising, language-preference, or consent cookie, and does not create application-owned localStorage or sessionStorage entries. Vercel Web Analytics does not use an analytics tracking cookie. These statements do not mean that network requests or provider security processing contain no personal information.

The website does not register a service worker for offline pages or audio. Browsers can still cache public images, fonts, scripts, and styles using ordinary HTTP caching. Temporary interface state, an unsubmitted form value, a Turnstile token, and a preview audio object are different from a permanent browser profile. Your browser may also independently restore form or page state.

The current preview flow does not use a Cloudflare pre-clearance cookie as its audio-access credential. Provider-managed security behaviour can differ from storage deliberately created by our application, so we do not make a blanket claim that every third-party context is cookie-free.

Deleting browser storage affects that browser; it does not send a request to erase your LumenDrift account, provider transaction records, or an email registration already submitted. The separate Cookie Policy summarises website technologies and the current Cookie settings panel. The retention and privacy-control sections of this policy explain how those practices affect your information.

Three different activities should be distinguished: local app events, operational monitoring of connected services, and website measurement. A setting about one activity does not automatically control all three. Necessary account authentication, purchase checks, and abuse prevention continue to need their relevant information when those services are used.

The current app’s analytics component keeps event records in memory and filters property names intended to exclude sensitive context and direct identifiers. It is not currently connected to an external event-upload service. Local event recording should therefore not be confused with a server-side listening history, but neither do we promise that every in-app event is disabled by every privacy-labelled setting.

The backend has operational error and performance monitoring through Sentry where configured. Error events can contain technical context, timestamps, route or job information, and diagnostic details needed to investigate a failure. Server-side scrubbing is designed to remove or mask categories such as email addresses, IP addresses, authentication tokens, and provider identifiers. Filtering reduces exposure; it does not justify putting secrets or unnecessary personal information into a report.

The LumenDrift website does not include a Sentry or PostHog browser integration, and it does not record a visual replay of your page session. Backend error monitoring is a different processing activity.

Where the website offers an early-access form, submitting it sends the email address you provide to our configured registration service, together with a label identifying LumenDrift as the source. Basic validation and abuse protection are used to reduce invalid or automated submissions. The form does not ask you to create a listening profile or disclose health information.

The website’s form protection can temporarily use an IP-derived request key to limit repeated submissions. A hidden form field is used to detect automated activity. The registration address is forwarded to the configured recipient service only as part of the requested registration. The form is not available when the delivery integration is not configured.

We use an early-access registration for the update or invitation described when you submit it. It is not permission to send unrelated promotions or enrol you in marketing for every Lumenshore product. Where consent is required, you can withdraw it. Use the unsubscribe option in an optional communication where provided, or the privacy-request route below.

Necessary account, purchase, security, or privacy-request messages have a different purpose from optional marketing. Withdrawing from an optional list does not prevent a message needed to address a request you made or a legal obligation. We may keep limited suppression information when needed to honour a request not to contact you again.

For processing subject to UK or EU data-protection law, we identify a lawful basis for each purpose. A contract basis applies only where information is objectively needed to provide the service you request. A legitimate interest is not unlimited permission: it must be necessary for the stated interest and balanced against your rights and reasonable expectations.

Some local laws use different grounds or require consent or additional safeguards. The regional supplements explain relevant distinctions. Listing legitimate interests here does not create a legal basis under a law that does not recognise it, and a data-protection basis does not replace a separate consent requirement for device access or electronic marketing.

Providers receive information necessary for their part of the service. A processor handles information on our behalf under the applicable arrangement; an independent controller decides its own purposes, for example Apple’s payment and account-security obligations. The same provider can perform different roles for different activities.

The register below describes the providers reflected in the current product integrations and recovery configuration. A provider being headquartered in a country does not identify every server, support location, or subprocessor it uses. Information may be handled in the United Kingdom, the European Economic Area, the United States, and other countries used by the provider’s infrastructure; see International transfers for the safeguards and how to request more detail.

LumenDrift uses several distinct paths. Understanding them helps explain why removing a local file is different from deleting an account, why a website visit does not need a Clerk profile, and why a purchase can leave records with Apple even after a LumenDrift account has been removed.

Shared hosting does not automatically authorise combining your information across products for a new purpose. If a new feature needs a different data flow, such as uploading a local library or connecting sensitive context, that use must be explained and supported by the required choices and legal basis.

• BrowsingYour browser requests the site from Vercel. Website measurement and performance requests are processed separately from the app’s account and local listening information.
• PreviewingYour browser requests a Turnstile check from Cloudflare, then asks the preview service for a short-lived grant. Cloudflare delivers the excerpt and the service updates its security quota records.
• Signing inYour chosen identity provider and Clerk establish the sign-in. The LumenDrift service uses the verified identity to create or locate your product profile and authenticate subsequent requests.
• Using RoyalApple and RevenueCat establish purchase and entitlement status. The app and backend use the relevant identifier and status to provide access and reconcile changes.
• Sending a message or reportThe submission and relevant context enter the LumenDrift service database. Authorised handling and operational monitoring may involve the providers described above.
• Maintaining continuityService databases can have protected recovery copies. Recovery infrastructure may hold a copy of information from multiple Lumenshore products, with LumenDrift records identified within that shared system. A backup is not used as a separate marketing dataset.

Lumenshore is based in the United Kingdom. Our providers operate internationally, and using LumenDrift can involve processing outside your country of residence, including in the United States and the European Economic Area. A region selected for one storage bucket does not guarantee that all account data, support access, network processing, and backups remain in that region.

Where UK or EU law restricts a transfer, the relevant transfer must have a recognised route. Depending on the recipient and destination, that can be an adequacy decision or appropriate contractual safeguards, such as the European Commission’s Standard Contractual Clauses, the UK International Data Transfer Agreement, or the UK Addendum, together with required assessments and supplementary measures.

A Data Privacy Framework or UK Extension route can be relevant only when the recipient’s current certification, the transfer, and the relevant legal decision cover the processing. We do not assume that every US provider or every service is covered. A provider’s general description of its safeguards is also not a promise that all information stays in one country.

Transfers under other laws may require additional notice, consent, contracts, assessments, or restrictions. Those requirements cannot be replaced by a general statement that you accept this policy. Contact us to ask about the safeguards applicable to your information and how to obtain a copy or explanation, with confidential details redacted where justified.

We retain personal information for the purpose for which it is needed, taking account of the amount and sensitivity of the information, account activity, unresolved requests, legal obligations, security needs, and applicable limitation periods. Different records have different lifecycles. A short-lived credential does not mean the underlying account or provider log has the same lifetime.

The table distinguishes fixed technical lifetimes from purpose-based retention. Where a fixed period is not stated, the relevant criteria apply; this is not a statement that we keep the information indefinitely or that another product’s retention settings apply to LumenDrift. You can ask about the retention applicable to a particular record.

In the app, open Settings, choose Privacy, find LumenDrift account, and choose Delete LumenDrift account. Review what will be removed, then confirm. Contact Lumenshore through the privacy-request route if you cannot access the app. We need to associate the request with the correct account and verify your authority. An optional explanation can help us understand the request, but you do not need to provide a detailed reason to ask for erasure.

Submitting a request is not the same as completion. The service tracks its progress and can record a failure that needs attention. We do not describe information as erased merely because a request has been accepted. If an exception or verification issue prevents all or part of the request, we will explain the reason and the available next steps as the law requires.

Safeguards in the service include encrypted network connections, authenticated account requests, installation credentials, product-scoped access checks, restricted media delivery, request limits, and filtering of sensitive diagnostic fields. Provider infrastructure adds its own storage, access, and operational controls. These measures serve different purposes and should not be confused with a blanket guarantee that every record is end-to-end encrypted.

An installation secret is kept in the iPhone Keychain, while the backend uses a keyed cryptographic representation for the corresponding check. Preview access uses short-lived grants rather than exposing an unrestricted private storage location. Access to account and deletion operations is checked to reduce the risk of one person or product affecting another person’s records.

Only people and service providers with an appropriate operational reason should have access to personal information. Security also depends on limiting what is collected and sent: private health details, passwords, access codes, and payment credentials do not belong in diagnostic fields or report text.

No storage or transmission method removes every risk. Protect your device, use the security controls offered by your identity provider, and avoid sharing account sessions. If you suspect unauthorised access or an information disclosure, use the privacy-request route and provide enough detail to identify the issue without sending further sensitive information unnecessarily.

A personal-data breach can involve loss, alteration, destruction, or unauthorised access or disclosure. If we become aware of a suspected breach affecting LumenDrift information, the response is to investigate the facts, limit the impact, assess the risk to people, and document the decisions and remedial steps. A technical fault does not automatically amount to a reportable personal-data breach.

Where UK or EU notification duties apply, a reportable breach must be notified to the relevant supervisory authority without undue delay and, where feasible, within 72 hours after awareness. A breach likely to create a high risk to people’s rights and freedoms may also require notice to affected people without undue delay. Other jurisdictions can impose different thresholds or timing; the applicable rule governs.

A notice, when required, should explain the nature of the incident, likely consequences, protective steps taken or proposed, practical steps you can take, and a contact route. We may provide information in stages if the investigation is continuing. We will not require you to provide your password or a payment to receive a breach notice.

Please report a suspected exposure promptly and avoid forwarding another person’s private data more widely than necessary. Keeping account contact details current can help necessary communications reach you. A promise to notify where required is not a claim that no incident can occur.

The app can use locally stored choices and listening context to suggest a ritual or sound world. Those suggestions are intended to help you choose audio. They do not determine eligibility for employment, credit, insurance, healthcare, or another similarly significant service, and they are not a clinical assessment of mood or health.

Some service decisions are automated for practical reasons: a purchase check determines whether a Royal entitlement is active, a security rule limits repeated preview requests, and a session check may reject an invalid credential. If you believe a result is wrong, you can ask us to review the relevant account or privacy issue. Correcting a purchase may also require the provider that holds the transaction.

Current messaging replies select prepared content and do not send your conversation to an external general-purpose AI model. We do not use personal messages, sign-in data, or listening history to train such models. Introducing a materially different AI feature would require its own assessment, clear explanation, and any required choices before the new use.

We do not currently make solely automated decisions about you that produce legal or similarly significant effects of the kind subject to special protections under applicable privacy law. If that changes, the required information about the logic, significance, consequences, and safeguards—including human review where required—must be provided. You retain the rights available under the law that applies to you.

Aggregate statistics can help us understand whether a page is slow, a feature is failing, or a sound-world preview is being requested. Where information has been irreversibly anonymised so that a person cannot reasonably be identified, it is no longer treated as personal information under laws that recognise that distinction.

Pseudonymisation is different. A hashed request key, account reference, device identifier, or transaction reference may still be linkable to a person. We continue to treat such information as protected where the applicable law requires it. A dashboard displaying totals does not mean that every underlying request or service log was anonymous at collection.

We do not use aggregation as a reason to re-identify people or assemble advertising profiles from private listening choices. When de-identified information is shared, the intended purpose and restrictions must be appropriate to its form and the applicable law. Access and erasure requests may not be technically meaningful for information that can no longer be linked to you; we will not collect new identifying information solely to reconnect a genuinely anonymous statistic.

In addition to the providers listed above, a limited disclosure may be necessary to comply with a valid legal requirement, respond to a regulator, establish or defend a legal claim, investigate fraud or a security incident, or protect someone’s vital interests where the law permits. The request, recipient, authority, and scope matter; a general interest in the information is not by itself a reason to release an account’s contents.

Where appropriate, we assess the validity and proportionality of a government or law-enforcement request and seek clarification or challenge an overbroad request. We disclose only the information legally required or otherwise lawfully justified for that purpose. We may notify the affected person where permitted and appropriate, but cannot promise notice where the law prohibits it or doing so would compromise a lawful investigation.

Professional advisers, such as lawyers or accountants, may need relevant information for confidential advice, compliance, or a dispute. If Lumenshore is involved in a merger, acquisition, financing, or transfer of a business, relevant information may be disclosed under appropriate confidentiality and data-protection restrictions. Any successor’s use must remain subject to applicable law, and material changes to the controller or purposes require the appropriate notice.

Links to Apple, Google, regulators, or other websites take you to services with their own notices. Their independent processing is not controlled solely by this policy. Following a link does not authorise LumenDrift to send unrelated private information to that service.

Your rights depend on the law applicable to the information and processing. You do not need to know a statute name or use legal terminology to make a request. Describe what you want to access, correct, delete, restrict, or challenge, and we will consider the applicable right and explain the outcome.

The following rights commonly apply under UK or EU law; regional supplements explain additional or different rights. They are subject to conditions and exceptions, such as another person’s privacy, legal privilege, required records, or a justified legal claim. An exception should be explained rather than used as a blanket refusal.

• Information and accessAsk whether we process your personal information, obtain a copy where the right applies, and understand purposes, categories, sources, recipients, transfers, retention, and relevant automated processing.
• CorrectionAsk us to correct inaccurate information or complete information that is incomplete for its purpose. Some identity or purchase details also need to be corrected with the provider that supplies them.
• ErasureAsk us to delete information where the legal grounds for erasure apply. Account deletion and local-device cleanup are separate; limited lawful retention exceptions are explained above.
• RestrictionAsk us to limit use in circumstances such as a dispute about accuracy or a pending objection. Restricted information may still be retained while the issue is resolved.
• PortabilityWhere the conditions apply, receive information you provided in a structured, commonly used, machine-readable format and ask for transfer to another controller where technically feasible. This does not require disclosure of another person’s data or proprietary materials.
• ObjectionObject to processing based on legitimate interests for reasons relating to your situation. You can object to direct marketing at any time without having to justify that objection.
• Withdrawal of consentWithdraw consent for an optional purpose without affecting processing that was lawful before withdrawal. We will explain any consequence for the feature involved.
• Review and complaintAsk for review of an applicable automated decision, challenge a refused request, and complain to a supervisory authority or seek a judicial remedy. You do not have to waive these rights to use LumenDrift.

You can use the relevant privacy or account control available in the app. If that route is unavailable, you cannot sign in, or your request concerns the website, write to Lumenshore at the address below, marked “LumenDrift — Privacy request”. This postal route does not require an active account or subscription. The privacy contact is Lumenshore Limited; this policy does not designate a separate statutory Data Protection Officer.

Tell us the product, the account email or other information reasonably needed to find the record, what you want us to do, and how to reply. An approximate date or description can help identify a message or website interaction. Do not send a password, one-time sign-in code, full payment-card details, or an identity document unless a specific, proportionate verification step has been explained.

LumenDrift is not directed to children under 13, and we do not knowingly collect their personal information through an account without the authorisation required by applicable law. Older children can also receive special protection. Thirteen is not a universal age for independent consent or contractual capacity; the relevant country and type of processing matter.

A parent playing audio for a child does not require a child account, school record, named child profile, or health history. Family-oriented content is not a request to upload information about children. We do not ask for child names or ages as analytics properties, and we do not use children’s information for behavioural advertising.

The current product does not offer a school administration service or a process for a school to authorise a child’s account on behalf of a parent. We do not claim that a general family feature is a FERPA arrangement, a COPPA parental-consent mechanism, or an age-verification system. If a future feature requires those safeguards, they must be established before the relevant processing begins.

We do not sell personal information or share it for cross-context behavioural advertising, and the current website has no targeted-advertising integration. Where a law requires recognition of an applicable opt-out preference signal, that right remains available. You do not need to turn on a signal to obtain our stated no-sale and no-advertising-sharing practices.

The current website does not have a custom Global Privacy Control or Do Not Track handler that disables Vercel measurement. Sending one of these browser signals, opening Cookie settings, or closing that panel does not currently switch off the measurement scripts. We do not represent those actions as a stored acceptance, rejection, or withdrawal of consent.

You can control website access and storage through your browser and privacy tools, avoid starting an optional preview, manage permissions in iOS, disconnect an identity-provider connection, and use the relevant account or deletion controls. Blocking scripts may affect previews or other functionality. Browser-level choices do not automatically remove information already received by a provider.

Where consent is required for a processing activity, an appropriate affirmative choice is necessary; a no-cookie design or a legitimate-interest statement does not automatically settle that requirement. If we introduce advertising, sale, or other consent-dependent processing, the notice and controls must reflect the new practice before it begins. You can also use the request route to object or ask how a choice affects your information.

We may update this policy when features, providers, data flows, or legal requirements change. The version and date identify this notice. For a material change, we will provide additional notice appropriate to the change and required by law, such as a prominent website or in-app notice. Where new consent is required, a notice alone is not sufficient.

A policy update does not remove rights that already apply, authorise an incompatible use of information retroactively, or change an independent provider’s legal obligations. The Terms of Service and EULA describe the service relationship; this policy explains personal-information handling. Mandatory privacy and consumer protections continue to apply.

Version 1.0 — 17 September 2026: expanded LumenDrift-specific notice covering local and connected app information, identity providers, Royal, website measurement and previews, the provider register, retention and deletion, request handling, children, and regional supplements.

You can print or save this page using the control at the top. If you need clarification about a previous notice or how a change affects information you already provided, contact Lumenshore through the privacy-request route.

These supplements explain regional rights in addition to the main policy. They apply where the relevant law covers our processing, taking account of its territorial scope, exemptions, and commencement dates. The same request route is available regardless of whether your country appears below. We do not infer your legal residence or age from your interface language.

For UK processing, the relevant framework includes the UK GDPR and Data Protection Act 2018, as amended. For processing covered by EU/EEA law, the GDPR and applicable national legislation apply. Lumenshore Limited is the controller identified at the start of this policy. Our UK address is our company contact; it should not be read as an address for an EU representative.

The purposes and lawful-bases table, provider register, retention criteria, and international-transfer section explain the corresponding information for LumenDrift. You can ask for further detail about a legitimate-interest assessment or the safeguard applicable to a transfer. Where we rely on consent, it must be specific to the processing and capable of withdrawal.

Where the California Consumer Privacy Act, as amended by the California Privacy Rights Act, applies, this section supplements the collection and use disclosures above. State privacy laws have coverage thresholds and exceptions; we do not suggest that every law applies to every visitor solely because the website can be reached there.

The categories below reflect the LumenDrift processing described in this notice. Sources are you, your browser or device, authentication and purchase providers, and people submitting authorised requests. Business purposes are providing accounts and media access, managing Royal, protecting and measuring the service, handling submissions, and meeting legal obligations. Retention follows the category-specific criteria in the main policy.

Where PIPEDA or applicable provincial private-sector privacy law governs, you can ask about the existence, use, and disclosure of your personal information, request access, and challenge its accuracy or completeness. Consent must be meaningful for the purpose and sensitivity involved. Withdrawal may be subject to lawful or contractual limits, which should be explained.

PIPEDA access requests generally require a response within 30 days; limited extensions require an explanation and notice of the complaint right. Québec also generally requires a response to an access or correction request within 30 days. Provincial requirements may apply instead of, or alongside, federal rules.

Where Brazil’s LGPD applies, you can request confirmation of processing, access, correction, information about shared use, and anonymisation, blocking, or deletion of unnecessary, excessive, or unlawfully processed data. You may also have rights to portability, withdrawal of consent, and deletion of consent-based information, subject to statutory retention exceptions.

You can ask about the consequences of refusing consent and the entities with which information is shared. The purposes, sources, recipient categories, and retention criteria in this policy describe the relevant LumenDrift activities. A lawful basis must fit the actual purpose; optional consent cannot be assumed from ordinary browsing.

If you challenge a decision made solely through automated processing that affects your interests, we will consider the review and explanation rights provided by the LGPD. LumenDrift’s current local suggestions and prepared message replies are described above; they are not a medical or credit assessment.

International transfers must meet the applicable LGPD requirements and ANPD rules. Contact Lumenshore through the privacy-request route for rights or transfer questions. You can petition or complain to the Autoridade Nacional de Proteção de Dados where its procedures apply.

Where Japan’s APPI applies, the stated purposes of use are the account, listening-service, subscription, security, website, request-handling, and legal purposes described in this policy. We should not use personal information beyond a permitted purpose without the authorisation required by law.

You may request disclosure of retained personal data and relevant third-party provision records, correction of inaccurate information, and cessation of use, deletion, or cessation of third-party provision where the statutory conditions apply. The scope and exceptions differ from GDPR terminology; we will assess the request under the applicable Japanese requirements.

Foreign transfers may require consent and specified information or another recognised APPI route, together with continuing safeguards where required. Our provider register and international-transfer section identify the service roles; you can request details of the relevant overseas recipient and protection measures. A provider’s country of incorporation alone does not establish the transfer’s lawfulness.

Use the privacy-request route to exercise a right or raise a concern. You can also seek guidance from Japan’s Personal Information Protection Commission. Verification should be proportionate and should not require unrelated sensitive information.

Where the PIPL applies, you may have rights to know and decide about processing, restrict or refuse it, access and copy information, correct it, request deletion in the specified circumstances, and request an explanation of processing rules. Withdrawal of consent applies where consent is the basis.

The PIPL does not provide a general legitimate-interests basis equivalent to the GDPR. Processing must fit a ground recognised by the PIPL, and separate consent may be required for matters such as sensitive information or overseas provision. Children under 14 receive specific protection; LumenDrift does not provide a child-information collection flow that substitutes a general policy acceptance for guardian consent.

An overseas transfer may require additional information about the recipient, a permitted transfer mechanism, an impact assessment, and other conditions depending on the circumstances. This notice does not assert that a security assessment, certification, or filing has been completed merely because a global provider is listed.

You can use the privacy-request route for information, correction, deletion, consent withdrawal, or an explanation. Where mandatory local conditions cannot be met for a feature, that feature must not process the information in a way that disregards those conditions.

Where South Korea’s PIPA applies, you can request access, correction, deletion, and suspension of processing, subject to the law’s conditions and exceptions. Applicable rights relating to automated decisions and transmission of personal information must also be considered. You may exercise rights through a duly authorised representative.

Overseas processing requires a lawful route and the information or choices required for that route, including recipient and purpose details where applicable. The provider register and transfer section explain LumenDrift’s service model; contact us for the details relevant to your information. We do not treat broad agreement to this policy as permission for every overseas disclosure.

The law provides particular safeguards for children under 14, including legal-guardian consent where required. A family listening feature is not a child-account consent process. If you believe a child’s information has been collected improperly, use the privacy-request route so we can assess and address it.

The Personal Information Protection Commission provides guidance and oversight. Its rules can apply to overseas businesses where the relevant criteria are met. The identity of an overseas provider does not remove your applicable rights or the obligations associated with a reportable breach.

India’s Digital Personal Data Protection Act 2023 and the Digital Personal Data Protection Rules 2025 have a staged commencement. This notice does not present every provision as already in force. The applicable obligations and rights depend on the provision’s commencement, the processing involved, and any relevant exemption.

As the relevant provisions become applicable, the framework includes rights concerning information about processing, correction and erasure, grievance redressal, and nomination of another person to exercise rights in specified circumstances. Consent must satisfy the applicable notice and choice requirements, and it must be possible to withdraw it as the law provides.

The framework contains specific requirements for children’s information, including a statutory under-18 definition subject to the applicable provisions and exemptions. We do not treat the general under-13 statement in this policy as replacing an Indian child-protection requirement or claim to operate a verified parental-consent system that the app does not provide.

Use Lumenshore’s privacy-request route for a request or grievance about LumenDrift information. Any statutory escalation to the Data Protection Board follows the provisions and procedures in force. The official commencement materials linked below govern the rollout; a future commencement does not prevent you from raising a present concern with us.

Where the Swiss FADP applies, you can ask whether personal data about you is processed and obtain the information needed to understand that processing, including purposes, recipients, retention, and relevant overseas disclosure. Access information is generally provided free of charge within 30 days, subject to the applicable exceptions.

You may seek correction of inaccurate data and the available remedies to stop unlawful processing or obtain deletion. The conditions for portability and protections concerning automated individual decisions apply where their statutory requirements are met. LumenDrift’s current recommendation and automation practices are described in the main policy.

Overseas disclosure requires the protection recognised by Swiss law, such as a recognised adequate destination or appropriate safeguards. An EU or UK mechanism does not automatically answer every Swiss requirement. You can request information about the destination and safeguard relevant to your data.

Contact Lumenshore through the privacy-request route. You can also consult the Federal Data Protection and Information Commissioner or seek the remedy available before the competent court. This notice does not claim a local representative exemption or designate an unverified Swiss representative.

For processing covered by German law, the GDPR operates alongside the Federal Data Protection Act and other applicable rules. The rights, purposes, provider information, and request process in the main policy apply. You may complain to a competent German data-protection authority; a local authority can help determine the appropriate jurisdiction.

Section 25 of the Telecommunications-Digital-Services Data Protection Act (TDDDG) separately governs storing information on, or accessing information from, terminal equipment. Consent is generally required unless a statutory exception applies, including qualifying strictly necessary activity. A technology’s not using a traditional cookie does not itself remove this requirement.

The current website’s measurement loads without a saved optional-analytics choice, and Cookie settings is informational. The Cookie Policy describes that behaviour. We do not label continued browsing as consent or assume that all measurement is exempt simply because its reports are aggregate.

For consent-based information-society services offered directly to children, the GDPR age threshold in Germany is 16. This specific consent rule does not determine every aspect of a minor’s legal capacity or replace the protections described in the children’s section.

Where French law applies, the GDPR and the French Data Protection Act provide the rights described in the main policy, with national provisions that may add protections. You can exercise rights through Lumenshore’s privacy-request route and complain to the Commission nationale de l’informatique et des libertés (CNIL).

French law allows directions concerning the retention, erasure, and communication of personal data after death, within the applicable legal conditions. A person entitled to act may contact us about such directions or a deceased person’s account. We will verify their authority and consider other people’s privacy; being a relative does not automatically grant unrestricted access to every message.

For consent-based online services, France uses a threshold of 15 for a child’s independent consent. Below that age, the applicable joint consent requirements involving the child and a holder of parental authority must be met. This is not a general permission to collect children’s information.

Cookies and similar technologies remain subject to the relevant French rules and CNIL guidance. Our current browser storage and measurement disclosures appear in the Cookie Policy; reading this page or closing an information panel is not recorded as consent.

Where Polish law applies, the GDPR (RODO) and applicable national rules govern the processing. You may request access, correction, deletion, restriction, portability, and objection where the conditions for each right are met. Consent can be withdrawn for a consent-based purpose without making earlier lawful processing unlawful.

The right to erasure is not absolute. For example, a specific legal duty or a justified claim may require limited retention. We should explain the reason and restrict remaining information to that purpose. Our account-deletion section describes the difference between active service records, completion evidence, local device data, and backup copies.

You can complain to the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych). You do not need to send your request in legal language, and a complaint or request does not require a Royal subscription. The UK location of Lumenshore does not remove rights that apply to our processing under Polish or EU law.

National rules on electronic communications and device access can apply in addition to the GDPR. A Polish language or locale setting is not evidence that a user has consented to tracking, disclosed an age, or authorised a new purpose.

Where Ukraine’s Law on Personal Data Protection applies, you can ask about the sources and location of your data, the purpose of processing, the controller and recipients, and the conditions of access. Applicable rights include access, a reasoned objection, correction or destruction of unlawfully processed or inaccurate information, and withdrawal of consent where relevant.

The main policy describes the LumenDrift categories, purposes, recipients, retention criteria, and international service model. Transferring information abroad must satisfy the legal conditions that apply to the transfer. Merely listing an international provider is not a substitute for those conditions.

Use Lumenshore’s privacy-request route to exercise a right or explain a concern. The Ukrainian Parliament Commissioner for Human Rights provides information and oversight concerning personal-data protection, and judicial remedies may also be available. We will assess the request under the applicable law rather than assuming that an interface language determines your rights.

The current app does not require medical records, school information, or precise location for ordinary listening. Please avoid including such information in a report unless it is necessary to explain the specific issue you want us to address.

A shared language does not create a single privacy regime. The following points apply under the relevant local law; the general contact route remains available in each case. Brazil has its own supplement above.

These countries have distinct privacy frameworks. This supplement does not assume a single regional consent rule, a universal data-localisation requirement, or that a website visit alone establishes the application of every local law.