Privacy Policy
How Lumi Steps handles your information, in plain English.
Last updated: 18 October 2026
1. Who we are
Lumi Steps is operated by 8stacks8, a small independent studio run as a sole trader in the United Kingdom. We are the data controller for the personal information described in this policy.
Our trading address is available on request via support@lumisteps.app.
ICO registration number: ZC134616 (verify on the ICO public register).
2. What we collect, and why
Lumi Steps is sold only through the App Store and Google Play. There is no account, no sign-up and no password. We collect almost nothing.
An anonymous customer identifier
When you buy or restore Lumi Steps, our purchase processor RevenueCat assigns a random anonymous identifier to your install. We use it solely to check whether you have an active Lumi Steps purchase. It contains no personal information, no name, no email, no Apple ID or Google account, and we cannot use it to identify you anywhere else.
Legal basis: performance of contract, verifying your purchase is necessary to grant you access.
Apple or Google handles your payment
The in-app purchase is processed entirely by Apple (on iOS) or Google (on Android), through your Apple ID or Google account. They are the merchant of record, not us. Your card details and billing address stay with them and never reach us. Their own privacy policies apply to the transaction itself.
What we do not collect
- No email address. Your access is tied to your Apple ID or Google account. We never ask for an email.
- No account, no password, no cookies, no sign-in tokens.
- No data about your baby. Milestones, age range, theme and every other in-app setting are stored on your own device only. They never leave it and never reach us.
- No third-party tracking, no Google Analytics, no Facebook Pixel, no advertising SDKs.
- No advertising data, there are no ads in Lumi Steps.
- No location data, no contacts, no microphone or camera access.
3. Who we share data with
We use a small set of trusted processors. Each receives only the data it needs.
- RevenueCat (purchase verification), receives the anonymous customer identifier described above and the store receipt. Based in the US; Standard Contractual Clauses apply. RevenueCat privacy policy.
- Apple or Google (the store transaction), processes your purchase and gives us only a verified entitlement status. Neither shares your card details or account email with us. Apple privacy policy ยท Google privacy policy.
- Vercel (hosting for this website only), serves these few public pages. Standard server logs (IP address, user agent, request URL) are retained briefly for operational and security reasons. We use Vercel's cookieless Web Analytics for aggregate page views only; it does not identify individual visitors. The app itself does not call this website. Vercel privacy policy.
We do not sell, rent, or share your data with anyone for marketing or advertising purposes, ever.
4. International transfers
Some of the processors above are headquartered outside the UK and EEA, primarily in the United States. For all such transfers we rely on the UK International Data Transfer Addendum and the European Commission's Standard Contractual Clauses, which those processors have committed to. You can request copies of these safeguards via support@lumisteps.app.
5. How long we keep your data
- Anonymous customer identifier (held by RevenueCat): retained for as long as Lumi Steps is installed and you have an active entitlement. It goes when you uninstall the app and clear its data, or when you submit a RevenueCat deletion request, which we can help with (see section 6).
- Store receipt: held by Apple or Google. See their privacy policies for their retention periods.
- If your purchase is refunded: your entitlement revokes automatically within minutes. We hold no purchase record of our own to delete.
- On-device data (milestones, settings): kept until you delete it in the app, or uninstall. We never receive it, so we cannot delete it for you.
- Website server logs: retained briefly by Vercel, then discarded.
6. Your rights under UK GDPR
You have the right to:
- Access, request a copy of the data we hold about you.
- Rectify, ask us to correct anything inaccurate.
- Erase, ask us to delete your data ("right to be forgotten").
- Restrict processing, ask us to pause processing your data while a query is resolved.
- Data portability, receive your data in a structured, machine-readable format.
- Object, object to processing based on legitimate interests.
- Withdraw consent, where processing is based on consent.
In practice we hold so little that most of these resolve quickly. To exercise any of them, email support@lumisteps.app. We will respond within 30 days. There is no charge.
You also have the right to lodge a complaint with the UK Information Commissioner's Office: ico.org.uk/make-a-complaint.
7. Children's data
Lumi Steps is designed for parents and caregivers of babies aged 0 to 18 months. The app is bought and used by adults. We do not knowingly collect personal data from children. Information about your child (age range, milestones reached and so on) is stored only on your own device, and never reaches us.
8. Cookies
Lumi Steps is a native app and uses no cookies at all. Your purchase status is held on your device.
This website sets no cookies either. The only measurement we use here is Vercel's first-party Web Analytics, which is cookieless and counts page views in aggregate. Because nothing is stored on your device, no consent banner is required under PECR.
9. Security
Communication between the app, RevenueCat and the stores uses TLS (HTTPS). Payment card data never touches our systems, because Apple or Google is the merchant of record. We hold no email address, no account and no database of customers, so there is effectively no server-side data of yours on our side to secure.
No system is perfectly secure. If we ever detect a personal data breach that affects you, we will notify you and the ICO within 72 hours of becoming aware, as required by UK GDPR.
10. Changes to this policy
We may update this policy occasionally. Material changes will be flagged at the top of this page. The "Last updated" date above always reflects the most recent revision.
11. Contact
Questions, requests, or concerns about your data: