Privacy Policy
Last updated: July 2, 2026 · Applies to lumetry (the "Service")
The short version
Your photos never leave your device. Lumetry decodes, edits and exports your images entirely in your browser. We never upload, store, or even see your photographs.
What we do collect
Account data. If you create an account: your email address and authentication identifiers, stored with our authentication provider (Supabase). If you sign in with Google, we receive your email address from Google; we do not receive your contacts or other Google data.
Edit settings. If you are signed in, your edit parameters (slider values, curves, ratings, flags — small JSON documents) sync to our servers so they follow you across devices. These contain no image data.
Photo fingerprints. To operate free-plan quotas we store a one-way cryptographic hash derived from a file's name, size and modification date. This cannot be reversed into a filename or image and is used only for counting.
AI requests. When you use AI editing, the text of your request (typed or transcribed from your voice by your browser) is sent to our server and forwarded to our AI provider (Anthropic) to generate edit values. Voice audio is processed by your browser's speech recognition; we never receive audio. AI request counts are kept for rate limiting.
Payments. Purchases are processed by Lemon Squeezy as merchant of record. We receive your purchase email and plan status — never your card details. See Lemon Squeezy's privacy policy for their processing.
What we don't do
We don't sell your data. We don't run third-party advertising. We don't use tracking beyond privacy-respecting, cookie-less analytics. We don't fingerprint your device.
Local storage
Lumetry stores working data in your browser (IndexedDB/localStorage): edit settings, thumbnail caches, your remembered photo folder, and trial usage. This stays on your device and can be removed by clearing site data.
Your rights
You can request a copy or deletion of your account data at any time by emailing SUPPORT_EMAIL_PLACEHOLDER. Deleting your account removes your synced edit settings, fingerprints, and entitlement records. If you are in the EU/UK, you have rights under GDPR including access, rectification, erasure, and portability.
Data retention & security
Account data is retained while your account exists. Data is transmitted over HTTPS and stored with our infrastructure providers (Supabase, Netlify, Lemon Squeezy) in their respective regions.
Children
The Service is not directed at children under 13 (or the minimum age in your jurisdiction) and we do not knowingly collect their data.
Changes
We'll update this page when our practices change and note the date above.
This policy is provided as a template drafted without legal counsel — have it reviewed by a lawyer in your jurisdiction before relying on it. Placeholders: SUPPORT_EMAIL_PLACEHOLDER, company name/jurisdiction.