Privacy Policy

Working draft – Alpha / in development

Lumavra is currently in active development and is not yet publicly available in the Apple App Store. Some features may be available only to developers or testers. Features, technical processes and the scope of functions may change before public release.

This version describes the current state of development. Features that are planned but not yet implemented are not described as existing features.

This English version is a translation of the German original (Datenschutzerklärung). In case of discrepancies, the German version prevails to the extent permitted by applicable law.

No advertising. No ad tracking. No sale of your data. Your projects are stored on your device and end-to-end encrypted in your own iCloud – not on our servers.

1. Controller

The provider of Lumavra, see Imprint. Contact, including for data protection matters: support@lumavra.com.

2. Your projects – on your device and in your iCloud

Lumavra stores names, ratings, favourites, the shortlist, name searches, your own tags and blocked terms, the history of suggestions, pictures, the photos used for them and your confirmations for photos (section 5) on your device.

Lumavra synchronises them between your devices through the private CloudKit database of your own iCloud, end-to-end encrypted with keys from your iCloud Keychain. Neither Apple nor we can read them. Apple's terms for iCloud also apply. This applies with an account and also as a guest – the guest has its own area in your iCloud. If you turn off iCloud for Lumavra in the iOS settings, the data stays on the device until iCloud is available again.

If others invite you to rate their names – or you invite others – those names are additionally stored on our server (section 11).

As a guest you do not need an account. On start, the app asks our server whether this app version is still supported and which version of the Terms of Use applies. Nothing about you is sent; for technical reasons your device transmits its IP address, which our records do not keep.

Without a network: So that Lumavra also starts without the internet, the device remembers what our server last answered about your account: display name, email address and your profile picture setting, the list of your projects (name, description, kind, archived or not), your plan with its limits, your usage and your credit balance. This is kept on the device only.

Signed out: When you sign out, the session ends, not the sight of your work. The account's projects remain visible on this device – read-only, to look at and to export – together with the account's display name and email address. Whoever holds the unlocked device can see them. The app no longer shows them once you delete the account (Section 10) or another account signs in on the device; it then also removes what the device remembered about the account. The project data itself stays in the app's storage for your next sign-in, until you delete the app.

App lock (optional): You can lock Lumavra with a PIN of its own, with Face ID or Touch ID if you wish – with an account, signed out and as a guest.

• The PIN itself is not stored. A check value calculated from it is kept in this device's keychain and does not leave it.
• Face ID and Touch ID are checked by the iPhone. The app only learns whether you were recognised; it receives no data about your face or fingerprint.
• On the device the app also records that the lock is turned on, how long the PIN is, when the app locks and how many wrong entries there were recently.
• None of this is sent to us.

The lock protects access to the app; it does not additionally encrypt your data. If you have forgotten the PIN, you set a new one with your iPhone's passcode or with Face ID. Whoever knows that passcode can therefore remove the lock.

3. AI suggestions for names

The AI name search is an online feature. Only what the search needs is transmitted:

• the kind of name and your description;
• the title of the name search;
• existing names, so that nothing is repeated;
• the language(s) you want, the language of origin or cultural background, and the script (Latin, original script or both);
• if you wish, your approximate region (section 7).

Your account identifier, Apple identifier, name and email address are not transmitted. What you type travels with it: personal data goes along only if you write it into a text yourself. Write what the name should suit – not who is waiting for it.

The request goes through our server to OpenAI; if OpenAI is unavailable or refuses, to Google (Gemini API) as a fallback (section 6).

So that suggestions are not repeated, our server remembers up to 500 names already suggested per project for 30 days – only the names, without the description. A record of every name generation – the request and its result, not your judgement of it – is kept for seven days so that abuse and offensive suggestions can be traced. The legal basis is Art. 6(1)(b) GDPR (contract) or point (f) (legitimate interest).

4. Pictures, photos and AI Studio

Lumavra makes pictures for a name – profile picture, icon, character – from your words or from a photo you choose. If you use the photo as the scene for your character, you can add a second photo that shows the character (such as your pet or a drawing); it is treated like the first.

On the device, without anything being sent: choosing a photo, the face check (section 5), cropping, masking and blurring. What you take out does not leave the device. Before sending, the app makes the photo smaller and removes its metadata (location, time, device).

Online, through our server to an AI provider (section 6) – only when you trigger it:

• the description of the photo ("What the photo shows"); you see it and can change it;
• AI Studio: questions, proposals and revising your prompt;
• making a picture and, with Pro or Ultra, editing with AI (such as refilling an area).

Your details (kind, style, framing, extras, text in the picture, your wishes) and, where applicable, the prepared photos go along. A region is never sent with pictures.

Check before every picture: Before a picture is made, our servers check the name and your details against a list of prohibited terms (section 8); what is to be left out of the picture is read only by the check that follows. Then an AI model from Google (Gemini API) checks the finished prompt – it contains the name, your details and the description of the photo, not the photo itself – for whether it asks for a picture we do not make: anything sexual or nudity, sexualisation of children and young people, hate, graphic violence or swear words. If the check refuses or cannot take place, no picture is made and no credits are charged. The check is automatic and can be wrong. Editing with AI (fill) sends no text, so there is no such check there. Legal basis: Art. 6(1)(f) GDPR (protection against misuse and unlawful content).

Stored in the project – on the device, in your iCloud, in exports and backups:

• the prepared photos;
• the picture made;
• the prompt used;
• the description of the photo and whether it shows a person, an animal or an object;
• where applicable, your confirmation for the face (section 5).

Our servers only pass photos and pictures on and do not store them.

5. Photos with faces

Before a photo leaves the device, the app checks on the device whether at least one face can be seen on it. It uses Apple's Vision framework for this. Faces are only counted; the app does not recognise who it is. Nothing is sent for this, and no facial features are created that would be stored.

If the app finds a face, it asks whether you may use this photo – because you are on it yourself or the person agrees; for a child, the parents decide. Faces in pictures, on posters or on dolls are detected too. Conversely, the app may miss a face.

• Your confirmation is stored with the photo, on the device, in your iCloud, in exports and backups:

  • when it was given;
  • in which language;
  • the wording of the question and the notice;
  • how many faces were found.

  If you choose the same photo again, the app does not ask again. If you delete the photo in the app, the confirmation goes with it.

• Our server receives with the request only "no face found" or "confirmed" (with the version of the wording). This is kept in the record of AI usage (section 8), never the photo.

• Your confirmation does not replace the consent of the person shown.

Legal basis: Art. 6(1)(f) GDPR (evidence that the question was asked and answered).

6. AI providers

We use language and image models through business interfaces. Requests go through our servers; the AI service runs at a cloud provider in the EU (Sweden) and stores neither photos nor pictures nor prompts. The external AI providers process the content transmitted to them under their business and privacy terms. They may process requests and results for a limited time for security, abuse-prevention or operational purposes. Details depend on the provider and the plan.

Who actually receives a request:

The app shows which model makes a picture before it is made; depending on your plan you can choose it. Transfers to the USA take place on the basis of the EU-US Data Privacy Framework or the European Commission's Standard Contractual Clauses.

Training: We ourselves do not use your requests, photos, pictures or results to train general AI models. External AI providers are subject to their own business and privacy terms. OpenAI and Google commit, for the paid business interfaces we use, not to use the content transmitted to train general models; we use the Gemini API exclusively on the paid tier. For fal and Black Forest Labs, the specific contractual or technical commitment is still to be verified before publication. We have objected to training at Black Forest Labs; until this is confirmed, no "no training" commitment applies there.

7. Region (optional)

Only for name suggestions and only if you turn it on: if you tap "Use current region", iOS determines your approximate location once; the coordinates go to Apple to determine the country and broad region. Only the country and region go to us with the request, so that suggestions catch regional nuances; we neither receive nor store coordinates. You can remove this information at any time.

8. Your NubisMedia account

"Sign in with Apple" creates a NubisMedia account (for users aged 16 and over), one account for the NubisMedia apps with a separate membership for each app. Our servers store:

• Apple identifier, email address or Apple relay address, display name – contract (Art. 6(1)(b) GDPR)
• sign-in sessions – contract
• plan, purchases from Apple (subscriptions, credit packs) as transaction data signed by Apple, your credit balance – no payment details – contract; legal obligation to retain records (point (c))
• for your projects only the name, description, kind and whether archived, plus how much of your plan is used – contract
• your backup destination (provider, folder name, times) and a value derived from your Apple identifier from which the name of your backup folder is formed (section 9) – contract
• your acceptance of each version of the Terms of Use – evidence (point (f))

Records:

• AI usage: Every call to an AI provider is recorded, for billing credits and against abuse (points (b), (f)):

  • account identifier, kind, model, result, cost and duration;
  • for photos, the result of the face check (section 5);
  • for the check before a picture, only "allowed", "refused" or "not possible".

  Prompts, names, photos, descriptions and pictures are not included. If the check refuses a picture, its reason (such as "violence") is kept in the AI service's operational log for 10 days, without any text and without the account identifier.

• Access: Refused requests, limits reached and restricted accounts are recorded so that a restriction can be explained and reviewed (point (f)). Project contents are not included.

• Content screening: Names, your details for pictures and your own prompts are checked against system-wide block lists and rules that nobody can change in the app. The content is checked, not you. If a rule applies, we record this with your account identifier as an access decision – which rule applied, not your text. Before every picture, an AI model also checks the prompt (section 4).

Separate from this are your own tags and blocked terms: they belong to the project, are stored on the device and in your iCloud, and only control what is shown or suggested to you.

Servers, databases and cache run on Microsoft Azure in data centres in the EU as processors.

9. Export, automatic backup and bringing projects back

Export: A project can be exported as a .lumavra file, on every plan and as a guest. The file is not encrypted and contains names, ratings, pictures, photos and your confirmations for photos. You decide where it goes.

Automatic backup – for every account, including Basic: Lumavra backs up each project as a .lumavra file – currently not encrypted, like the export – into one folder of your choice:

• in the Files app;
• in OneDrive, only in the app folder Apps/Lumavra (Files.ReadWrite.AppFolder);
• in Google Drive, only in files Lumavra created itself (drive.file).

Signing in to Microsoft or Google takes place with the provider. The access keys are stored only in the device's Keychain, never on our servers. The files are stored with the provider, under its terms.

• Folder name: In this folder Lumavra creates a subfolder for your account. Its name (e.g. p53x879yu4fdc8kz) is derived from your Apple identifier, with a secret key and irreversibly. This way the same Apple ID finds its folder again – on a new iPhone or after deleting the account – without us keeping anything about you after the deletion.
• manifest.json: Every folder contains a small file describing it: folder name, the Lumavra account ID at the time of the backup, when it was created and last written, the number of projects and the app version. No Apple identifier and no email address.
• Deleted and renamed projects: The backup moves the file of a deleted project into the subfolder Deleted, with the time of deletion in its name. The file of a renamed project follows its new name. Nothing is deleted in the backup.
• Bringing projects back: The app shows which backed-up projects are not in the app, in your own folder and in folders of earlier accounts next to it. You bring a project back as a new project. The device remembers which ones you have already brought back.
• Archive copies: When you archive a project, the app places a .lumavra copy in the backup folder or, without a backup, on the iPhone ("On My iPhone › Lumavra › Archiv").

Google user data (Limited Use): Lumavra uses its access to Google Drive exclusively to write, read, rename and move your backup files in the folder Apps/Lumavra. Nothing is passed on or combined with other data. Use complies with the Google API Services User Data Policy, including the Limited Use requirements – in particular not for advertising, not for sale, not for credit checks and not for training general AI models.

10. Deleting your account – what stays, what goes

In the app you can leave Lumavra or delete your NubisMedia account for all apps.

• On our servers we delete your account data and everything they hold about your projects, including the derived value for the backup folder.
• Your projects are not lost:
  • Before the deletion, the app places each project as a .lumavra file in "On My iPhone › Lumavra › Vor dem Löschen".
  • After that, the guest area on the device takes over the projects and uploads them to its iCloud zone.
  • The app removes the account's iCloud copy only once this upload is confirmed. If iCloud is off, it stays.
• Exports and backups in your own storage remain there.
• An Apple subscription does not end; you can only cancel it with Apple.
• Purchase records and your credit balance are kept without name and address, to the extent obligations or restoring your purchases require it. If you sign in again, the app sends the Apple-signed transactions of your Apple ID again; on the basis of this verified purchase data – not your Apple identifier – you get back a running subscription and any unused bought credits.
• Feedback rounds: The shared names, answers, invitations and participants of your projects are deleted, as are your participations and answers in other people's rounds (section 11).
• Acceptance records and logs (section 8) and the record of evidence for invitations (section 11) are kept until their period expires.

If you still use the same NubisMedia account in another app (such as Blurami) and leave only Lumavra, the account remains for the other app.

11. Feedback on names – inviting and being invited

You can ask people to rate the names of a sub-project of yours, and you can be asked yourself. It is only about names, never about pictures. Unlike your projects, the data shared for this lives on our servers. We are responsible for sending and storing it; who is asked is decided by the person inviting.

When you invite (contract, Art. 6(1)(b) GDPR):

• You enter the person's name and e-mail address and set a deadline. You are responsible for inviting only people you may approach for this. We send the invitation in your name.
• For the round, the app places the names you share on our server: the text and kind of each name, plus the round's title and deadline. No pictures, prompts, reasons or tags. Our server can read these names; they are not end-to-end encrypted like the rest of your projects (section 2).
• You see who is invited and the answers (Yes, Maybe, No) under the name you entered for the person.
• You get a notification on your device (push through Apple) when somebody has accepted or an invitation was locked after too many wrong codes.
• If you delete a project or your account, we delete the shared names, the answers, the invitations and the participants that belong to it.

When you are invited (consent through your confirmation, Art. 6(1)(a); evidence (f)):

• You receive an e-mail with a link to our website. Nothing happens until you confirm there; the invitation expires after 7 days. The page says who is asking and what is stored. After you confirm, we send a code, valid for 15 minutes, to the same address. You do not need an account: you take part as a guest, in the browser or in the app.
• We store the name the inviting person entered for you, your address and language, your answers and a record of evidence: when you were invited, confirmed, sent a code, redeemed, withdrawn, removed or locked, with name, address and the IP address the action came from. We store the code and your access key only as an irreversible check value.
• We use your address only for this invitation, not for advertising.
• The inviting person sees your answers under the name they entered for you.
• Your access lasts until the inviting person's deadline, at most 90 days; without a deadline 14 days from the code. After that you can no longer answer.
• On the website your browser keeps the access key and your language in local storage (not a cookie) so that you can answer; in the app the key is in the device's keychain. If you sign in to the app with an account, the round can be tied to your account: you then find it on every device of yours and, even after it has ended, in your history until you take it off your list.
• You can leave at any time. In a running round your access ends and we delete your answers. A round that has ended you only take off your list; your answers stay with the inviting person.
• If the inviting person removes you, your access ends. Your answers stay as anonymous votes unless they delete them too.
• If the same person invites you again, we recognise you. For that we store an irreversible value formed from your address and the inviting person's identifier with a secret key. It applies only to that person and stays with the round for as long as it exists – even long after the address itself has been deleted.
• If you delete a NubisMedia account you answered rounds with, we delete your participations and answers.

How long: We delete the address of an invitation 30 days after it expires, and that of a person who answered 30 days after the end of their window. We delete the record of evidence after 12 months (section 14). Name, answers and the recognition value stay with the round until they are deleted. If you want us to delete your address sooner, write to support@lumavra.com. The e-mails are sent by our e-mail provider (section 12).

12. Apple and other services

Apple's privacy policy applies to sign-in, the App Store, iCloud, the face check on the device, Face ID and Touch ID for the app lock and determining the region. Support emails are processed by our email provider (point (b) or (f)).

13. Website

No advertising, no tracking, no cookies, no content from third-party servers.

The page for feedback invitations (app.lumavra.com) keeps in your browser's local storage only what it needs for you to answer: your access key and your language. This is not a cookie; you remove it by leaving or in your browser (section 11).

14. Retention periods

Longer only where the law, the establishment or defence of legal claims, or security requires it in an individual case.

15. Your rights

You have the right of access, rectification, erasure, restriction of processing and data portability, the right to object to processing based on legitimate interests, and the right to lodge a complaint with a data protection supervisory authority. Lumavra does not make automated decisions (Art. 22 GDPR). Requests to support@lumavra.com.

16. Changes

We adapt this policy when Lumavra changes. Technical details are available on request.