Privacy Policy
Lumi
Last updated: 26 July 2026
This privacy policy applies to the Lumi app (the “Application”) for mobile devices, created by Burak Ahmet Şentürk (the “Service Provider”) as a Freemium service. The service is provided “AS IS”.
Who is responsible for your data
The data controller for the Application is:
Burak Ahmet Şentürk
Email: buraksenturktr@icloud.com
What information we collect
Automatically collected
- Your device’s Internet Protocol (IP) address
- Screens you open in the Application, and the time and date you open them
- Time spent in the Application
- Your mobile device’s operating system and device model
Identifiers
- Anonymous account identifier. On first launch the Application creates an anonymous account through Firebase Authentication. This produces a persistent identifier (a “UID”) that is not linked to your name, email address, or Apple Account. The same UID is used to identify you in our database, in our analytics, and in our subscription provider’s records.
- Push notification token. A device token (FCM token) used solely to deliver the notifications you have enabled.
Location
The Application collects your device’s location to determine your approximate geographical position and uses it as follows:
- UV data. Your coordinates are sent to Apple WeatherKit to retrieve the real-time UV index for where you are.
- Notifications. Your most recent coordinates are stored on our servers so that scheduled notifications (for example a morning UV briefing or a high-UV alert) can reference the UV conditions at your location.
- Analytics. The name of the city derived from your coordinates is recorded in our analytics alongside the UV reading.
Your skin type
Your selected skin profile (Fair, Medium, or Dark) is used to calculate how long your sunscreen protection lasts and to personalise the wording of your reminders.
Your skin profile is recorded in our analytics, both as an event parameter and as a persistent user property attached to your anonymous UID. We use it to understand how different users apply sunscreen and to improve the accuracy of our reapply intervals.
Subscription status
Whether you hold an active Lumi Pro subscription is stored on our servers and with our subscription provider. We do not receive or store your payment card details — all payments are handled by Apple.
Settings we store on our servers
- Time zone
- System language preference
- Which notification types you have enabled
Stored only on your device
Your sunscreen application history — the time of each application, the UV index captured at that moment, your skin profile at that moment, and the protection interval — is stored locally on your device and is not transmitted to our servers. Uninstalling the Application permanently deletes this history.
Why we process your data, and on what legal basis
| Purpose | Data used | Legal basis (GDPR Art. 6) |
|---|---|---|
| Show you the UV index for your location | Location | Your consent (the iOS location permission) |
| Send the notifications you enabled | Push token, location, notification settings, time zone, language | Your consent (the iOS notification permission) |
| Provide and restore your subscription | Anonymous UID, subscription status | Performance of a contract |
| Understand usage and improve the Application | Usage events, skin profile, city, device information | Our legitimate interest in improving the Application, and your consent where local law requires it |
| Diagnose crashes and errors | Crash reports, device information | Our legitimate interest in keeping the Application working |
| Show advertising to users on the free tier | IP address, device information | Our legitimate interest, and your consent where local law requires it |
You can withdraw consent at any time by turning off the relevant permission in the iOS Settings app. Withdrawing location permission stops UV retrieval; withdrawing notification permission stops all reminders.
Third-party services
The Application uses the following third-party services. Each has its own privacy policy governing how it handles data:
| Service | What it receives | Privacy policy |
|---|---|---|
| Apple WeatherKit | Coordinates (to return UV data) | apple.com/legal/privacy |
| Firebase Authentication | Anonymous UID | firebase.google.com/support/privacy |
| Cloud Firestore | UID, push token, coordinates, time zone, language, notification settings, subscription status | firebase.google.com/support/privacy |
| Firebase Cloud Messaging | Push token | firebase.google.com/support/privacy |
| Google Analytics for Firebase | Usage events, skin profile, city, device information | firebase.google.com/support/privacy |
| Firebase Crashlytics | Crash reports, device information | firebase.google.com/support/privacy |
| Google AdMob | IP address, device information, ad interactions | policies.google.com/technologies/ads |
| RevenueCat | Anonymous UID, subscription status | revenuecat.com/privacy |
We may also disclose your information:
- as required by law, such as to comply with a subpoena or similar legal process;
- when we believe in good faith that disclosure is necessary to protect our rights, protect your safety or the safety of others, investigate fraud, or respond to a government request;
- to trusted service providers who work on our behalf, who have no independent use of the information disclosed to them, and who have agreed to the rules set out in this policy.
Advertising
The free tier of the Application shows advertising supplied by Google AdMob.
The Application does not ask for permission to track you across other companies’ apps and websites, and does not collect Apple’s advertising identifier (IDFA). Advertising is therefore not personalised on the basis of cross-app tracking. AdMob still processes technical information such as your IP address, device type, and interactions with an ad in order to deliver and measure it.
International data transfers
Our service providers, including Google (Firebase, AdMob) and RevenueCat, process data on servers located in the United States and other countries outside the European Economic Area and the United Kingdom. Where data is transferred out of the EEA or UK, those transfers rely on the European Commission’s Standard Contractual Clauses or another transfer mechanism permitted by applicable law. Details are set out in the privacy policies of the providers listed above.
Artificial intelligence
The Application does not use Artificial Intelligence (AI) technologies to process your data or provide features.
How long we keep your data
| Data | Retention |
|---|---|
| Your record in our database (UID, push token, coordinates, settings, subscription status) | Kept for as long as the Application remains installed and in use, and until you ask us to delete it |
| Analytics data | Retained by Google Analytics for Firebase according to the retention period configured for the project, up to a maximum of 14 months |
| Crash reports | Approximately 90 days, per Firebase Crashlytics defaults |
| Subscription records | For as long as required by our subscription provider and by tax and accounting law |
| Sunscreen application history | Stored only on your device; deleted when you uninstall the Application |
Your rights
Depending on where you live, you may have the right to:
- access the personal data we hold about you;
- correct inaccurate data;
- delete your data (“right to erasure”);
- receive a copy of your data in a portable format;
- object to or restrict processing based on our legitimate interests, including analytics and advertising;
- withdraw consent you previously gave, at any time.
To exercise any of these rights, email buraksenturktr@icloud.com. We will respond within one month. Because the Application does not collect your name or email address, we may ask you for your anonymous UID so that we can locate your record.
If you are in the European Economic Area or the United Kingdom and you believe we have not handled your data properly, you have the right to lodge a complaint with your national data protection supervisory authority. You do not need to contact us first.
If you are a California resident, you have the right to know what personal information we collect, to request its deletion, and not to be discriminated against for exercising those rights. We do not sell your personal information.
Deleting your data
Uninstalling the Application stops all further collection, deletes your locally stored sunscreen history, and ends analytics collection from your device.
Uninstalling does not automatically delete the record already held in our database. Our backend exists only to send the notifications you enabled; it does not run an automated deletion process. To have your stored data erased, email buraksenturktr@icloud.com and we will delete your record.
Children
The Application is not directed at children and we do not knowingly collect personal data from children under 13 — or under 16 where that higher age applies under local law, as it does in parts of the European Economic Area.
If we discover that a child below the applicable age has provided personal data, we will delete it promptly. If you are a parent or guardian and believe your child has provided us with personal data, please contact buraksenturktr@icloud.com so that we can take the necessary action.
Security
We care about safeguarding the confidentiality of your information and maintain physical, electronic, and procedural safeguards to protect the information we process. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.
Changes to this policy
This policy may be updated from time to time. We will notify you of changes by publishing the revised policy on this page and updating the date at the top. You are advised to review this policy periodically. Continued use of the Application after a change constitutes acceptance of the revised policy.
Contact
For any question about this policy or about how your data is handled, email buraksenturktr@icloud.com.