Privacy policy

Last updated: 21 August 2026

Lume is an iOS app for building the habit of walking. This policy explains, without hedging, what data it collects, what it uses that data for, who it shares it with and how you can delete it. The principle behind all of it: data exists so the mechanics work, and for nothing else.

Data controller

The data controller is the developer of Lume, based in Spain. For any question about your data, write to hello@heylume.app.

What data is collected, and what for

Your account

• Sign in with Apple identifier: an anonymous code Apple generates for Lume. It is what lets you recover your progress if you reinstall the app.
• Email: only if you choose to share it when signing in. You can use Apple's private relay to hide it, and the app works just the same.
• Display name and fire colour: you choose them, and they are what the members of your campfire see.
• Time zone and daily goal: so your day closes at your midnight and against your target.

Your activity

• Steps and workout minutes per day: daily totals read from Apple Health. Never minute-by-minute series, and no other health data.
• Days met: whether you reached your goal each day and by what means (steps, workout, free pass or declared absence).
• Walks: start and end date and time, steps, distance and the route you walked.

Your route

During a walk, the app records your precise location to draw your route. That route is shared with your campfire — the group of one to ten people you belong to — so they can see where you have been. It is not public and it is not shared with anyone else.

The ends are trimmed. The first and last few hundred metres of every walk never leave your phone, so a route never starts or ends at your front door. If a walk is too short to trim, only the approximate area where it happened is shared, with no route at all.

You can say "not this one". A switch, while you walk or when you finish, keeps that whole walk on your phone: nothing about it is shared, not even the area. And a walk you already shared can be withdrawn later, which deletes it from the server.

The full, untrimmed trace always stays on your device: it is what you see of your own walks.

An approximate home area is also stored (a wide cell, on the scale of kilometres) with a single purpose: to blur the location of your home when your fire is shown to your group.

Your campfire

• Group name, invite code, who the members are and since when.
• Absence periods you declare (“I'm away until the 12th”), so a trip does not count as a failure.

You can leave a campfire whenever you want, without deleting your account: in the Campfire tab, by tapping its name. When you leave, any routes you had shared with that group are withdrawn from the server and your fire stops appearing on their map. What you wrote in the conversation stays with the people still inside — it is everyone's conversation, not only yours — and you lose access to it.

Your conversation and your photos

• The messages you write in your campfire, along with the night they belong to. Only members of that campfire can see them.
• The photos you send to your campfire, along with their size. They are kept in private storage and served through signed links that expire: without that link, the photo is not accessible to anyone.
• Reports and blocks: who you have blocked, and what content you have reported and for what reason. A block is never disclosed to the other person.

Before a photo is uploaded, the app strips its metadata on your phone: the GPS location, the exact timestamp and the device model that the camera embeds in the file. What leaves your phone is the image, and nothing else.

Notifications and sessions

• Device token for Apple's notification system (APNs), if you grant permission. There are two separate channels: the daily reminder, with a hard budget of at most one a day, and campfire alerts when someone writes, which can be turned off separately in Settings. A campfire alert says who wrote and in which group, never the content of the message.
• Sessions: a cryptographic hash of your session credentials (never in the clear) and your device name, so sessions can be closed and improper access detected.

Apple Health (HealthKit)

Lume only reads your steps and your workouts from Apple Health, and writes nothing. Only daily aggregates leave the device (total steps and workout minutes for the day), which are essential for your log to appear in your campfire and to restore your history if you reinstall.

Data obtained from HealthKit is never used for advertising or marketing, never sold, never disclosed to third parties and never used for any purpose other than the app's own mechanics.

What Lume does not do

• It shows no advertising and integrates no ad networks.
• It uses no third-party analytics and no trackers.
• It does not sell or disclose your data to anyone.
• It does not build profiles or make automated decisions about you.
• It does not read campfire conversations. Only content someone reports is looked at, and only to decide on that report.

Legal basis

All the processing described is necessary to provide the service you ask for by using the app (Article 6(1)(b) GDPR). There is no processing for other purposes, so you are not asked to consent to anything else.

Who it is shared with

• The members of your campfire: they see your name, your colour, whether today's log is lit and the route of the walks you share, trimmed at both ends. Never your home or your health data.
• Apple: as the provider of sign-in and of notification delivery (APNs).
• Backup provider: database backups are encrypted before leaving the server and stored on Backblaze B2. The provider cannot read them.
• Cloudflare: campfire photos are stored in Cloudflare R2, in a private bucket. They are neither public nor indexable, and are only served through signed links that expire after an hour.

There are no other recipients. Data is hosted on a private server administered directly by the developer, in the European Union.

How long it is kept

For as long as your account exists. If you delete your account, all your data is removed from the database immediately and for real (not deactivated) — photos included — and disappears from backups through their automatic rotation, within 30 days at most. Local data on the phone is removed when you uninstall the app.

Your campfire's messages and photos

Messages and photos are visible while the campfire stays lit — that is, while its streak of complete nights is unbroken. The album does not expire by age or after 24 hours: while the live streak is alive, the conversation and photos stay visible.

When the streak breaks, that content stops being shown. On the server it is kept for 90 more days from that moment, and then deleted for real, including the photos in storage. That period exists for one specific, limited reason: to handle a report, resolve a dispute between campfire members, or reconstruct a technical failure. It is not used for anything else.

If content has been reported, it is kept while the case is open, even past that period. That is the only exception.

How to delete your account

From within the app: You → Settings → Account → Delete everything. You do not have to write to anyone or explain yourself. If you prefer, you can also request it by email at hello@heylume.app.

Your rights

You can exercise your rights of access, rectification, erasure, portability, restriction and objection at any time by writing to hello@heylume.app. If you believe something has not been handled properly, you can lodge a complaint with the Spanish Data Protection Agency (aepd.es) or with the supervisory authority in your country of residence.

Children

Lume is not directed at children under 14 and does not knowingly collect their data.

Changes to this policy

If this policy changes, the new version will be published on this same page with its update date. If a change materially affects how your data is handled, notice will be given inside the app.