Luma Privacy Policy (Made Simple)

Last updated: 18 September 2026
Brought to you by the team at Calverra Holdings LLC.

The short version – in plain english

• We use encryption and other security measures to help protect your information.

• We use your information to provide Luma, save your entries, manage your account and help when you need support.

• You choose what to write. Your entries may contain sensitive information.

• We use service providers to operate Luma. This policy explains the information involved and why it is used.

• If you use AI habit suggestions, your goal, reason, target date and selected value are sent to Google Gemini.

• We do not sell personal information or share it for cross-context behavioural advertising.

• You can ask about your information, exercise your privacy rights or request account deletion at hello@myluma.app.

Your Questions, Answered

Who’s behind the app?

Luma is run by Calverra Holdings LLC, based in Maryland, United States. We are responsible for deciding how the personal information described in this policy is used. In data protection law, this makes us the “data controller”.

This policy covers the Luma app and our websites and related services that link to this policy.

Luma was previously operated by WorryTree Ltd. Calverra received existing account and service information as part of the transfer of the Luma business so that it could continue providing the service.

Email: hello@myluma.app

Postal address: Calverra Holdings LLC, 2631 Housley Road, PMB 1301, Annapolis, Maryland 21401, United States.

Our UK representative

Our representative in the United Kingdom is Prighter Ltd, 20 Mortlake High Street, London SW14 8JN, United Kingdom.

If you’re in the UK, you can also contact us through our representative using our privacy portal, or email us directly at hello@myluma.app.

What personal data do you collect and why?

We use information to make Luma work, support you and improve the app. Some comes from you, some is generated when you use our app or websites, and some comes from sign-in and subscription providers. We also received existing account and service information from Luma’s previous operator, as explained above.

Here’s a simple overview:

We do not collect precise GPS location or access your phone’s microphone, call logs or movement sensors. Analytics providers may estimate your country or city from your IP address.

How do the AI features use my information?

For AI habit suggestions, Luma sends your goal, reason, target date and selected value to Google Gemini.

Saved worry and emotional-weather entries are not sent automatically. Anything you type into the goal or reason fields is included, so avoid information you do not want sent to the AI provider.

Google’s processing can include safety and security checks. Information sent to AI is not necessarily deleted immediately after a response.

AI suggestions support reflection. They are not medical advice, diagnosis or treatment.

Who receives my information?

Providers help us host Luma, store information, manage subscriptions, deliver messages, provide support, operate websites and forms, understand usage and provide AI features.

They include Heroku and MongoDB Atlas for hosting and databases, Google Analytics for Firebase for analytics, Branch for app links, and Google Gemini for AI. Information is shared for the relevant service, subject to applicable data-protection requirements.

Apple and Google also handle information for their own sign-in, app-store and payment services under their own privacy policies.

If you use linked-calendar reminders, a worry title can appear in your calendar. People and services with access to that calendar may see it.

We do not sell personal information, share it for cross-context behavioural advertising or use entries to build advertising profiles.

We may disclose information where necessary and lawful for legal obligations, valid legal requests, professional advice or legal claims. Health information receives additional protections required by law.

If Luma is sold, merged or transferred, relevant information may transfer where lawful. We will clearly notify you of an ownership transfer affecting your information. A transfer does not itself permit new uses or remove consent requirements.

What are your legal reasons for using information?

Where UK or EEA data-protection law applies, we rely on:

• Contract: to provide your account and requested features, manage subscriptions and respond to requests needed to deliver the service.

• Legitimate interests: to protect Luma, prevent fraud and misuse, investigate technical problems and protect legal rights. These interests must be balanced against your rights and the impact on you.

• Legal obligations: to meet applicable accounting, tax and data-protection duties.

• Consent: where your permission is required for a particular use, including marketing and optional processing that requires consent.

Some information you enter may reveal details about your health. Where the law requires explicit consent for this information, that consent must be separate from accepting our Terms of Service. Using Luma or reading this policy does not itself provide that consent.

You can withdraw consent by contacting hello@myluma.app. Withdrawal may affect the features we can provide.

We need account information to provide your account. Optional features and marketing are separate choices.

How do analytics and marketing work?

Google Analytics for Firebase helps us understand feature use. This may involve installation identifiers, device and app information, usage events and approximate IP-derived location. Identifiers do not make information anonymous. The current app’s worry and emotional-weather completion events exclude entry text, worry categories and emotional-weather answers.

Where our website offers cookie settings, you can use them to manage optional cookies. Email hello@myluma.app for help with analytics choices or to withdraw any consent you have given. Accepting this policy does not itself authorise optional analytics that requires your consent.

We send marketing emails when you opt in. You can unsubscribe using the link in each message or by emailing hello@myluma.app. Essential account, security and service messages are separate from marketing.

Quizzes and surveys are optional. We explain how answers will be used when collecting them and obtain separate consent where required. Completing a quiz or survey does not automatically subscribe you to marketing.

Social networks, newsletter platforms and other services you choose to visit have their own privacy policies. Please review those policies before sharing information with them.

How do you protect my information?

We use technical safeguards and working practices designed to protect information against unauthorised access, loss, misuse and disclosure. We are responsible for managing access and the data-protection obligations of providers acting on our behalf.

We investigate security incidents, take steps to limit their effects, and notify affected people and regulators as required by law.

Securing your device and checking access to linked calendars can also help. Our responsibility to protect the service remains.

How long do you keep information?

Different information serves different purposes:

• Accounts and entries: kept while your account remains open so you can use Luma and return to your journal. Stopping use, cancelling a subscription or uninstalling the app does not itself delete them. You can request deletion at any time.

• Support correspondence: retained according to the time needed to resolve your request and address any related complaint or legal claim.

• Financial records: retained according to accounting and tax requirements and unresolved payment disputes.

• Consent and request records: retained as needed to demonstrate and respect your choices, including a limited record of marketing opt-outs.

• Technical and analytics records: retention depends on their purpose and sensitivity, outstanding technical or security investigations, and applicable legal requirements.

Deletion from live account records does not necessarily remove every copy at once. Separate copies may exist in backups, technical logs or provider records. Contact us for information about how a deletion request applies to those copies.

If we introduce an inactivity-deletion rule, we will explain it before applying it and give affected users advance notice and a way to keep their account.

Where is information processed?

Calverra is based in the United States. Our service providers and support personnel may process information in other countries, including through remote access. International processing is subject to applicable data-protection requirements.

Contact hello@myluma.app for information about processing locations and the transfer arrangements relevant to your information, including a copy of applicable safeguards where available under law.

How can I delete my account?

Request deletion from the Profile section of Luma or email hello@myluma.app. You do not need to reinstall the app to email us. We may ask for enough information to verify that the account belongs to you.

We handle deletion of your account, entries and associated information, and requests to relevant providers, in accordance with applicable law. We explain any limited retention that applies. Separate copies may exist in backups and logs, as described above.

If you want a copy of your information, request it before deletion.

Deleting the app, cancelling a subscription and deleting your account are separate actions. Account deletion does not necessarily cancel an app-store subscription; manage that separately through Apple or Google.

What rights and choices do I have?

Depending on your location and the law, you may have rights to:

• Know whether and how we use your information and obtain access or a copy.

• Correct inaccurate information or request deletion.

• Restrict particular uses or receive certain information in a portable format.

• Object to processing based on legitimate interests because of your circumstances.

• Withdraw consent at any time. This does not affect the lawfulness of earlier processing.

• Obtain information about recipients of your personal information or consumer health data, and appeal a refusal where the law provides that right.

You can object to direct marketing at any time. If you withdraw consent needed for a particular feature, such as processing health information in your journal, we may no longer be able to provide that feature.

We do not use information for solely automated decisions with legal or similarly significant effects. AI suggestions are ideas for you to consider.

Contact hello@myluma.app to exercise a right or appeal. We may verify your identity or an agent’s authority. Requests are normally free; rights may have legal conditions or exceptions. We do not unlawfully discriminate against you for exercising them.

We normally respond to UK and EEA requests within one month, explaining any permitted extension or pause. Elsewhere, we follow applicable deadlines. If we refuse, we explain why and any appeal route.

How can I raise a concern?

You have the right to complain to us. Use our email, postal address or UK representative’s privacy portal.

We acknowledge privacy complaints within 30 days, investigate without undue delay, keep you informed and tell you the outcome.

You may also complain to the UK Information Commissioner’s Office or the relevant regulator where you live, including an EEA data-protection authority. You need not finish our process first.

How will I know about changes?

We update the date when this policy changes and clearly flag significant changes, for example by email or in-app notice, in advance where required.

If a new use requires your consent, we will ask before making that use. Continuing to use Luma does not replace consent required by law.

Need help or have a question?

We’re here to help. Email us at hello@myluma.app if you have a question about your information or anything in this policy.