Lumen Privacy Policy

1. Who we are

Patea LLC ("Patea," "we," "us," or "our"), a Utah limited liability company, operates Lumen at lumenlist.app. This policy explains what personal data we collect when you use Lumen, why we collect it, who can see it, and what rights you have over it.

2. The short version

Lumen is a place for families to share gift lists. We collect what it takes to run that: your name, your email address, your password (stored only as a hash), and the lists, families and gift picks you create. We do not sell your data, we do not show advertising, and we do not run analytics.

One rule is central to how Lumen works: the person who owns a list cannot see who is getting what from it. Our database enforces that rule. It is not only hidden on the screen.

3. Information we collect

• Account information: your name, email address and password. The password is stored only as a bcrypt hash. We cannot read it.
• What you put into Lumen: the gifts on your list (titles, notes, prices, store links and picture links), the families you create or join, and the gifts you say you will get for someone, including whether you have bought them.
• Invitations: when you invite someone by email, we store that email address and send one invitation to it. An invitation can be accepted for 7 days. We keep the record until it is replaced by a new invitation to the same address or the family is deleted.
• Sign-in sessions: when you sign in, we store a session record that includes your IP address and your browser's user-agent string, and we set cookies so you stay signed in (Section 7). We also keep short-lived counters, keyed by IP address, that limit repeated sign-in attempts.
• Tour progress: whether you have seen the short tour of the app, and which of its first steps you have done.
• Application logs: our servers record errors and diagnostic messages so we can find and fix problems. A log entry can include an email address. We keep these logs for 30 days. We do not keep a log of each page you request.

We do not collect payment information. Lumen is currently free.

We do not ask for sensitive categories of personal data, such as information about your health, religion or precise location. A gift list is free text, though, and what a person asks for can say something about them. We treat everything on a list as private to its owner and the families they have joined.

4. Who can see what

• Your list is visible to every member of every family you have joined on Lumen, and to nobody else.
• Your gift picks are visible to you and to the other members of a family you share with the person the gift is for. That person cannot see them. They cannot see who picked a gift from their own list, or that anything was picked at all.
• Your name is visible to the people in your families, and to anyone you send an invitation. If your account has no name, your email address is shown to your families in its place.

Anyone in a family can invite others to it, so the people who can see your list can change as your family adds members.

5. How we use your information

We use your information to:

• provide Lumen: show lists to the right people, and keep gift picks hidden from the person they are for;
• send the emails Lumen needs: confirming your address, resetting your password, and invitations that you or your family send;
• keep the service secure and working;
• comply with the law.

We do not use your information for advertising. We do not use it to train AI models.

6. Store links and gift pictures

• When you paste a store link, Lumen's server fetches that page once to read the product's name, picture and price. The store sees a request from our server, not from you.
• Gift pictures are loaded by your browser directly from the store's website. When you or your family view a gift that has a picture, that store receives your browser's IP address, just as it would if you opened its site.
• Following a store link takes you to a site Patea does not run. That site's own privacy policy applies there.

7. Cookies and browser storage

• Sign-in cookies keep you signed in. One is set when you sign in, lasts up to 30 days, and is renewed as you use Lumen. A second holds a short-lived copy of your session, for up to five minutes at a time, so pages load without a fresh check each time. Both are used only to keep you signed in, and the service needs them to work. We set no advertising or cross-site tracking cookies.
• Browser storage on your device holds the look you chose for Lumen and small notes that let the tour of the app pick up where you left off. These stay in your browser.

8. Service providers

We share personal data with the providers that help us run Lumen, and only as needed for that:

• Amazon Web Services: hosting, content delivery, application logs and backups, in the United States.
• Neon: our database, hosted on Amazon Web Services in the United States.
• Resend: email delivery.
• Cloudflare: domain name service.

We do not sell your personal data, and we do not share it for targeted advertising.

9. How long we keep your information

• We keep your account, and what you have put into Lumen, for as long as your account exists.
• You can remove a gift from your list at any time. To leave a family, ask the person who created it to remove you, or contact us.
• To delete your account and everything in it, email us at hello@pateastudio.com from the address on your account. We will delete it within 30 days.
• We back up our database every night and keep each backup for 30 days. Deleted information can remain in those backups until they expire.
• Sign-in sessions expire after 30 days without use. Application logs are kept for 30 days.

10. Your rights

Under the Utah Consumer Privacy Act, Utah residents have the right to:

• confirm whether we process their personal data, and access it;
• correct inaccuracies in their personal data;
• delete personal data they have provided;
• obtain a copy of their data in a portable format;
• opt out of the sale of their personal data and of its use for targeted advertising. Patea does neither.

We extend these rights to everyone who uses Lumen, wherever they live. To use them, email hello@pateastudio.com from the address on your account. We will respond within 45 days. If we decline a request, we will tell you why, and you may appeal by replying to that email. If your appeal is denied, Utah residents may contact the Utah Division of Consumer Protection.

Lumen is operated from the United States and is intended for people in the United States.

11. Security

We protect your information with encryption in transit, hashed passwords, and database rules that limit each person to their own data and the data of their families. No system is completely secure, and we cannot guarantee absolute security.

12. Children's privacy

Lumen is made for families, and families include children. Accounts are for people 13 and older. We do not knowingly collect personal data from a child under 13. A parent or guardian can keep a list for a younger child under the adult's own account. If we learn that a child under 13 has created an account, we will delete it. If you believe a child under 13 has given us personal data, email hello@pateastudio.com.

13. Changes to this policy

We may update this policy from time to time. If a change is material, we will email you before it takes effect. The date at the top of this page shows when the policy was last changed.

14. Contact

Questions or requests about this policy: hello@pateastudio.com.

Patea LLC, Utah, United States.