Do Not Sell or Share My Personal Information
Last updated: 2026-05-28.
The short version
Lume does not sell your personal information.We do not share it for cross-context behavioral advertising. We don't run third-party ad pixels, we don't feed your data into ad networks, and we don't monetize your follows or watch history. If you're a California resident and want to formally opt out anyway, the request below is honored.
What CCPA / CPRA gives you
Under the California Consumer Privacy Act and the California Privacy Rights Act, California residents have the right to:
- Know what categories of personal information a business has collected about them and the purpose.
- Request deletion of personal information (see our Account & Data Deletion page).
- Opt out of the "sale" or "sharing" of personal information.
- Correct inaccurate information we hold about you.
- Limit the use of sensitive personal information.
- Not be discriminated against for exercising any of these rights.
What Lume actually does with your data
- Follows / watch state / ratings / comments / friendships: stored only to provide the app's features — alerts, friend feeds, recommendations. Never shared externally.
- Email address: used to sign you in (via Apple or Google), send the optional email confirmations of friend requests, and contact you for account / legal reasons.
- Push notification tokens: sent to Apple Push and Google FCM only when we deliver an alert you opted into. Tokens are deleted when you sign out or delete your account.
- Optional contact match: if you tap Find friends from contacts, the app SHA-256 hashes the email of each contact on your device and sends only the hashes to our server. Raw contacts never leave your device.
- Movie / show metadata: fetched from The Movie Database (TMDB) — we send TMDB the title/ID you're looking at, never your identity.
Categories we don't sell or share
For completeness under CCPA § 1798.130, here are the categories we collect (per the statutory list) and our disposition on each:
- Identifiers (email, account ID): Collected. Not sold. Not shared for advertising.
- Commercial information: None collected — Lume is free; we have no purchases.
- Internet / network activity: Standard server logs (timestamps, IP truncated to /24, request IDs) retained 30 days. Not sold. Not shared.
- Geolocation: Not collected.
- Sensory data: Not collected (we have no audio / video upload).
- Professional / employment / education info: Not collected.
- Inferences: We compute a personalized recommendation score on-server from your follows; inferences are not shared externally and are wiped on account deletion.
How to submit an opt-out request
Even though we don't sell or share, you can formally opt out by emailing contact@app-lume.com with the subject "CCPA opt-out request" from the address tied to your Lume account.
We'll confirm receipt within 10 business days and confirm completion within 45 days, per CCPA § 1798.130(a)(2). For deletion requests specifically use our Account & Data Deletionpage — it's faster.
Authorized agents
You may use an authorized agent to make a CCPA request on your behalf. Email us with the subject "Authorized agent request"plus a copy of the written authorization signed by the consumer, and we'll coordinate verification before acting on it.
Global Privacy Control
Lume honors the Global Privacy Control (GPC) signal. If your browser sends a Sec-GPC: 1header, we treat that as a do-not-sell / do-not-share signal for that session, even though we already don't sell or share by default.
No retaliation
We will not deny service, charge a different price, or provide a different level of quality because you exercised your CCPA rights. That's the law, and that's also our policy.
Contact
CCPA / privacy questions: contact@app-lume.com. We usually respond within 1–3 business days.