How Lumi Steps handles your information — in plain English.
Last updated: 9 May 2026
Lumi Steps is operated by M Morton, trading as Lumi Steps, a sole trader based in the United Kingdom. We are the data controller for the personal information described in this policy.
Our trading address is available on request via support@lumisteps.app.
ICO registration number: ZC134616 (verify on the ICO public register).
We try to collect as little as possible.
If you bought via the website (Stripe checkout), the only personal data we hold is:
Captured when you buy access via Stripe Checkout, and used to send you sign-in links and (on request) device-management links. Stored in our database against your purchase record.
Legal basis: performance of contract — without your email, we can't deliver access to the app you've paid for.
Card details are entered directly into Stripe's hosted checkout. They never reach our servers. We only receive a Stripe session ID and the email associated with the purchase.
Legal basis: performance of contract.
Each time you sign in on a new device we store a small record: a randomly generated device ID, a generic label derived from your browser's User-Agent (e.g. "iPhone", "Windows PC"), and timestamps for first and last sign-in. This is what enforces the 3-device limit and lets you remove devices via the manage-devices page.
Legal basis: legitimate interest — preventing one purchase being shared across unlimited devices.
Once you're signed in, we set an lumi_access cookie (a signed JWT) on your device, valid for up to 180 days. This is the only cookie we use. It contains your email and device ID, signed so we can verify it's authentic. It's HttpOnly + Secure — readable only by our server, never by JavaScript or third parties.
Legal basis: strictly necessary for the service you've requested (signed-in access).
If you bought via the App Store on iOS, we collect almost nothing:
When you buy or restore Lumi Steps, our purchase processor RevenueCat assigns a random anonymous identifier to your install. We use it solely to check whether you have an active Lumi Steps purchase. It contains no personal information — no name, no email, no Apple ID — and we cannot use it to identify you anywhere else.
Legal basis: performance of contract — verifying your purchase is necessary to grant you access.
The £14.99 In-App Purchase is processed entirely by Apple via your Apple ID. Apple is the merchant of record. Your card details, billing address, and Apple ID stay with Apple — they never reach us. (Apple's privacy policy applies to the App Store transaction itself.)
If you bought via Google Play on Android, we collect almost nothing:
When you buy or restore Lumi Steps, our purchase processor RevenueCat assigns a random anonymous identifier to your install. We use it solely to check whether you have an active Lumi Steps purchase. It contains no personal information — no name, no email, no Google account email — and we cannot use it to identify you anywhere else.
Legal basis: performance of contract — verifying your purchase is necessary to grant you access.
The £14.99 in-app purchase is processed entirely by Google via Google Play Billing and your Google account. Google is the merchant of record. Your card details, billing address, and Google account email stay with Google — they never reach us. (Google's privacy policy applies to the Play Store transaction itself.)
We use a small set of trusted processors to run the service. Each receives only the data they need.
Web (Stripe) buyers:
App Store (iOS) buyers:
We do not use Stripe, Resend, or our Redis database for App Store buyers — there's no email or device record on our side to share. The native iOS app loads its content from the app bundle on your device; it does not call our website's servers during normal use.
Google Play (Android) buyers:
We do not use Stripe, Resend, or our Redis database for Play Store buyers — there's no email or device record on our side to share. The native Android app loads its content from the app bundle on your device; it does not call our website's servers during normal use.
We do not sell, rent, or share your data with anyone for marketing or advertising purposes — ever.
Some of our processors above are headquartered outside the UK/EEA (primarily the United States). For all such transfers we rely on the UK International Data Transfer Addendum and the European Commission's Standard Contractual Clauses, which our processors have committed to. You can request copies of these safeguards via support@lumisteps.app.
Web (Stripe) buyers:
App Store (iOS) buyers:
Google Play (Android) buyers:
You have the right to:
To exercise any of these, email support@lumisteps.app. We'll respond within 30 days. There's no charge.
You also have the right to lodge a complaint with the UK Information Commissioner's Office: ico.org.uk/make-a-complaint.
Lumi Steps is designed for parents and caregivers of babies (0–18 months). The app is purchased and used by adults. We do not knowingly collect personal data from children. Information about your child (age range, milestones reached, etc.) is stored only on your own device — it never reaches our servers.
We use exactly one cookie: lumi_access, described in section 2 above. It is strictly necessary for keeping you signed in. We do not use any other cookies — no analytics cookies, no advertising cookies, no third-party trackers. Because the only cookie is strictly necessary for the service, no consent banner is required under UK law (PECR Reg 6(4)). Our first-party Vercel Web Analytics is cookieless, so PECR Reg 6 still applies.
Lumi Steps for iOS is a native app — it doesn't use cookies at all. Your purchase status is held entirely on-device via RevenueCat's local cache. (If you visit lumisteps.app in a web browser, the web cookie described above applies there, not here.)
Lumi Steps for Android is a native app — it doesn't use cookies at all. Your purchase status is held entirely on-device via RevenueCat's local cache.
Data in transit is protected by TLS (HTTPS). Cookies are HttpOnly, Secure, and SameSite=Lax. Authentication tokens are signed JWTs. Our database is access-controlled and encrypted at rest by Upstash. Payment card data never touches our servers.
Communications between the app, RevenueCat, and Apple use TLS (HTTPS) by default. Payment card data never touches our servers — Apple is the merchant of record. We hold no email address, no device records, and no database entry for App Store buyers, so there's effectively no server-side data of yours on our end to secure.
Communications between the app, RevenueCat, and Google use TLS (HTTPS) by default. Payment card data never touches our servers — Google is the merchant of record. We hold no email address, no device records, and no database entry for Play Store buyers, so there's effectively no server-side data of yours on our end to secure.
No system is perfectly secure. If we ever detect a personal data breach that affects you, we'll notify you and the ICO within 72 hours of becoming aware, as required by UK GDPR.
We may update this policy occasionally. Material changes will be flagged at the top of this page and (where appropriate) emailed to active customers. The "Last updated" date at the top always reflects the most recent revision.
Questions, requests, or concerns about your data: