Privacy Policy

Who we are

Luma ("we", "our", "us") is an AI photography companion for Fujifilm, Canon, Nikon, and Sony shooters, built and operated by CraftedPxl, LLC as an independent product. You can reach us at info@craftedpxl.com.

Information we collect

We collect the minimum necessary to provide the service:

• Account data — email address and password (or OAuth token) when you create an account.
• Profile data — display name and avatar you optionally provide.
• Usage data — which features you use, recipes you save, gear you add, and AI tools you interact with, so we can personalise your experience and improve the product.
• Device data — device type, OS version, and app version, for crash reporting and compatibility.
• Sign-in records — each time you sign in we record the IP address and browser or app details (user agent) of that sign-in, so you can see and end your active sessions and so we can spot account abuse. A record is deleted 30 days after that session ends. Rate limits also key on your IP address for up to two hours.
• Payment data — billing is handled entirely by Polar, which acts as the merchant of record for your purchase. We store the customer and subscription identifiers Polar returns to us, together with your subscription tier; we never see or store your card details.
• Location — only if you use the “find spots near me” search in Photo Spots. Your browser asks your permission first, and the coordinates it returns are sent to our server and on to Anthropic, our AI provider, to generate shooting suggestions for that area. We cache the resulting suggestions against a coordinate pair rounded to roughly a kilometre; that cache is shared and is not linked to your account. The coordinates you searched also appear in our server logs alongside your account ID for a limited period, so that we can diagnose failures. We do not otherwise build a history of where you have been.
• Photos — images sent to AI tools for analysis are forwarded to our AI provider for the duration of that request and are not retained by us afterwards. Images you choose to save are stored: your journal is private to your account, while images attached to community posts and published recipes are served from publicly accessible URLs so they can be displayed to other users. Anyone holding such a URL can view that image without signing in. Deleting the post or recipe removes the stored image. Photos uploaded to the former Photo Vault stay stored, private to your account, until you delete your account. Before any photo is stored — journal, profile picture, community post or recipe — any location it carries in its metadata is removed.
• Community reports and moderation — reports you file about community posts, comments or recipes, and records of moderation actions on your account or your content (including a Community ban or a suspension), are kept until they are resolved or you delete your account. Deleting your account removes them.
• Blocks and reports — if you block or report someone, or report an AI result, we keep that record until you delete your account; reports may include the text of the result you reported.
• Community rules agreement — when you agree to the community rules before your first post, comment or published recipe, we record the date and the version of the Terms you agreed to, until you delete your account.
• Links you add to a post — when you add a link to a Web link or Gear link post, our server fetches that page once to read its title, site name and short description, so the site sees a request from our hosting provider, not from your device. The page address and what was read are kept for up to a day so a repeat lookup does not fetch the page again, and are not linked to your account. If the page names a preview picture, a small copy of it (about 480 pixels) is stored with your post and shown on its link card, after the same automated moderation as images you upload; you can remove it before posting, and it is deleted with the post. The copy is made when the preview appears, so if you close the post without publishing it, the copy is deleted a day later.

How we use your information

• Authenticate you and keep your session secure.
• Personalise your feed, recipe recommendations, and AI tool results.
• Process subscription payments via Polar.
• Send optional push notifications about new recipes, community activity, new firmware for cameras in your Gear, or product updates (you can opt out at any time in Settings → Alerts on the web, or More → Settings → Notifications in the Android app).
• Monitor service health, diagnose errors, and improve performance.
• Comply with legal obligations.

We do not use your data to train third-party AI models, sell it to advertisers, or share it with data brokers.

Third-party services

Luma integrates the following sub-processors. Each governs its own data under its own privacy policy:

• Cloudflare — hosting, database, file storage, sign-in, image resizing, and DDoS protection (privacy policy). Your account, profile, recipes, gear, journal, community posts, and the images you upload are all stored with Cloudflare, and your password is checked there, never stored in readable form. Images you attach to community posts and published recipes are resized with Cloudflare Images before they are stored. If you use the free recipe try on our home page without an account, Cloudflare Turnstile checks that you are not a robot; its check loads only once you start typing in that box.
• Resend — sends account emails, such as password-reset links (privacy policy). Resend receives your email address and the message we send you.
• Polar — payment processing and merchant of record (privacy policy). Polar is the seller of record for your subscription: it takes payment, calculates and remits any sales tax or VAT, and issues your receipt. We identify you to Polar by your Luma account ID, and Polar tells us which plan you hold.
• Web Push (browser vendor) — if you enable notifications, your browser registers a push subscription with its own vendor's push service. We store that subscription: its endpoint, plus the browser-supplied keys required to encrypt messages to it. That push service belongs to your browser vendor, not to us — for Chrome and other Chromium browsers it is operated by Google, and for Firefox by Mozilla — so delivering a notification to you means sending it to your vendor’s endpoint. We use the Web Push standard directly and do not use Firebase Cloud Messaging or any other Google messaging product of our own.
• Anthropic — AI features send only the minimum context required to generate a response (privacy policy). Under Anthropic's standard API terms, inputs and outputs are not used to train their models by default. The free recipe try on our home page sends only the description you type and the brand you pick; neither the description nor the recipe is stored, and to allow one try a day we keep a counter for your network address for up to a day.
• Google (Gemini API) — some illustrative images in the app, such as daily recipe artwork and composition examples, are generated on demand. We send Google a short text prompt describing the image we want; we do not send your photos (API terms).
• Sightengine — automated content moderation (privacy policy). When you attach an image to a community post, that image is sent to Sightengine to be checked against our content rules before it is published. The title and caption of a community post, the text of a comment, the name and description of a recipe you publish to Community, and your display name are sent to Sightengine the same way when you post or publish them, sign up or change your name.
• Google (Sign-In) — if you choose “Continue with Google”, Google authenticates you and tells us your email address, name, and profile picture. Google therefore knows you have an account with us. Your profile picture continues to be served from Google’s servers, so your browser contacts Google when it is displayed (privacy policy).
• Unsplash — we no longer source imagery from Unsplash ourselves, but an article in the news feed may link to an image hosted there. When one does, your browser loads it directly and Unsplash receives your IP address (privacy policy).
• News publishers — the news feed shows an article's picture from the publisher's own website. When one is shown, your browser or the app loads it directly from the publisher's servers, which therefore receive your IP address and device details; we do not copy or proxy these images.
• Lorem Picsum — some photos shown in Community, on posts and on published recipes, are free stock photos served by Lorem Picsum (picsum.photos and fastly.picsum.photos). When one is shown, your browser loads it directly and Lorem Picsum receives your IP address (website).
• Sentry — error and crash reporting (privacy policy). When something goes wrong in the app we send Sentry the technical details of the failure along with your account ID, so we can tell whether a problem affects one person or everyone. Crash reports from the Android app are different: they hold the error, the app version and the Android version, carry no account ID, email or device ID, and reach Sentry through our own server.

We do not use advertising networks, analytics SDKs, or data brokers. Cloudflare Web Analytics runs at the edge and is cookieless — it does not build a profile of you across sites.

Product milestones. To understand how people get from signing up to subscribing, we record — in our own database, with no analytics provider involved — the first time your account reaches each of nine steps: creating the account, confirming your email address, choosing a camera brand, getting your first recipe, opening Luma again a week or more after signing up, running out of AI credits, seeing an upgrade prompt, starting a checkout, and a subscription becoming active. Each record holds your account ID, the step, when it happened, and one short label (for example, whether you signed up with email or Google, which brand or AI tool it was, or which plan you chose). Nothing else about your activity is recorded this way. Turning on Settings → Privacy → Analytics opt-out on the web stops these records for your account from that point on, on every device (the switch belongs to your account; the Android app has no switch of its own), and deleting your account deletes them.

Where your data is processed

The services Luma depends on are located in several countries. If you use Luma from the European Economic Area, the United Kingdom, or elsewhere, your personal data will be transferred to and processed in countries outside your own — including the United States.

• Your account and content — your account, profile, recipes, gear, journal entries, and community posts are stored in a Cloudflare database located in Western Europe.
• Your files — journal photos and any images you upload are stored in Cloudflare storage located in Western Europe.
• Backups — a weekly copy of our database (not your files) is kept for 4 weeks in a private Google Drive account held by Luma’s operator, so the service can be restored if Cloudflare ever loses it (Google’s privacy policy). Nobody else has access to it.
• The app and its requests — served through Cloudflare's global edge network, so both the app and the requests it makes are handled at whichever location is nearest to you.
• The sub-processors listed in § 04 — each operates from its own jurisdiction, which is not always the same as ours or yours. Their locations and safeguards are described in their own privacy policies, linked above.

Each of these providers publishes the safeguards it applies to international transfers, such as the European Commission's Standard Contractual Clauses or the EU–US Data Privacy Framework. We rely on those safeguards rather than maintaining separate ones of our own.

If you would rather your data were not processed in these locations, please do not create an account. If you already have one, you can delete it at any time from Settings → Data → Delete account on the web or More → Settings → Account → Delete account in the Android app, which removes your personal data as described in § 07.

Why we are allowed to process your data

If you are in the EEA or the UK, data protection law requires us to have a lawful basis for each thing we do with your data. Ours are:

• To provide the service you asked for (performance of a contract) — creating and running your account, signing you in, storing your recipes, gear and journal, and running the AI features when you invoke them. Without this we cannot give you the product.
• To take payment (performance of a contract, and legal obligation) — processing subscriptions through Polar, and keeping the billing records that tax and accounting law requires us to keep even after you leave.
• To keep the service safe and working (legitimate interests) — automated moderation of images posted to the community, rate limiting, abuse prevention, and error reporting; and recording the product milestones described in § 04, so we can see where people get stuck between signing up and subscribing (you can switch these off in Settings). Our interest is in protecting users, keeping Luma running and improving it; we have weighed that against your privacy and limited what is sent to what each check needs.
• With your consent — push notifications, and the “find spots near me” search, which is the only feature that uses your location. You choose whether to turn these on, and you can withdraw consent at any time in Settings or in your browser, without affecting anything you did before you withdrew it.

Where we rely on legitimate interests, you have the right to object — see § 08.

Data retention

We retain your account data for as long as your account is active. If you delete your account, your personal data is removed from the live service straight away, except where retention is required by law (e.g. billing records).

To recover from a failure we keep backup copies of our database: Cloudflare keeps point-in-time copies for 30 days, and we keep a weekly copy for 4 weeks (described in § 05). Your data leaves the last of these copies within 60 days of deleting your account. We restore from a backup only to recover the service, never to bring back a deleted account.

Transient AI processing data (e.g. EXIF analysis inputs) is discarded within 24 hours.

Your rights

Depending on where you live, you may have the right to:

• Access a copy of the personal data we hold about you.
• Correct inaccurate data.
• Request deletion of your data ("right to be forgotten").
• Object to or restrict certain processing.
• Data portability (receive your data in a structured format).

To exercise any of these rights, email us at info@craftedpxl.com. You can also delete your account directly from the app under Settings → Data → Delete account on the web or More → Settings → Account → Delete account in the Android app. The steps, what is deleted and what is kept are on the account deletion page.

Cookies and local storage

Luma uses browser localStorage and session tokens only to keep you signed in and remember your preferences. We do not use advertising cookies or cross-site tracking.

Children

Luma is not directed at children under 13. We do not knowingly collect personal data from anyone under 13. If you believe we have collected data from a child, please contact us and we will delete it promptly.

Changes to this policy

We may update this policy from time to time. We'll notify you of material changes via in-app notice or email. Continued use of Luma after the effective date constitutes acceptance of the updated policy.

How we protect your data

We take these measures to keep your data safe:

• Encrypted in transit. Luma is served over HTTPS only. Plain HTTP requests are redirected to HTTPS, and browsers are told to use HTTPS for the site for a year (HSTS).
• Passwords are hashed. Your password is stored only as a salted PBKDF2 hash, never in readable form.
• Private photos use short-lived links. Journal photos are private to your account and are shown through signed links that expire after one to one and a half hours.
• Limited access. Only the operator of Luma can reach production data and the moderation tools; actions taken in Luma’s admin tools are logged.
• Location removed from photos. Before a photo is stored, any GPS location in its metadata is removed (§ 02).

No system is perfectly secure. If you find a security problem, please write to info@craftedpxl.com.

Contact

Questions? Requests? Something feels off? Email us at info@craftedpxl.com — we read every message.