LumaShift Privacy Policy

Effective date: 11 September 2026

In short: the app needs your email address and whatever you create inside it. We run no analytics or trackers of our own, and your data is never sold. Advertising (Yandex) and Plus payment (NOWPayments) are separate independent services, described below. You can export a copy of your data or delete your account entirely from inside the app.

LumaShift is an app for planning work shifts, notes, and personal events. This document explains in plain language what data the app collects, why, who can see it, and how to delete it.

The developer of the app (“we”) is an individual. Contact for any data-related question: support@lumashift-app.com.

1. What we collect

Only what the app needs to work. Nothing beyond that.

Account data. Your email address and an internal user identifier. If you sign in with Google or Apple, we receive an email address and an identifier from them — we never see your password for those services. If you register with an email and password, the password itself is stored by Google Firebase Authentication, not by us, and is not visible to us in readable form.

Content you create. Workplaces, shift and event templates, shifts, recurring schedules, notes and their contents, note folders, events, birthdays, holidays, amounts you type into "Earnings" by hand, and files you attach to notes.

Friends data. If you use the Friends tab: your username, friend requests, and your friends list.

App settings. Interface language, light or dark theme, note styling, and a subscription tier flag.

What we do NOT collect. We run no analytics or usage-counting system of our own, use no third-party trackers such as Google Analytics, and do not track you across other apps or websites. We do not collect your location, your contacts, call history, or clipboard contents. The one exception is advertising and subscription payment, each with its own independent provider described below.

2. Why we need it

So you can sign in and reach your records from any device.
To store and synchronise the content you create.
To open the app in the language and appearance you chose.
To make Friends and note sharing work, if you choose to use them.

We do not sell your data or hand it to third parties for their own purposes, except as explicitly described in this document.

3. Where the data is stored

Google Firebase (Firebase Authentication and Cloud Firestore) — accounts and all content you create, except attached files. Google acts as a data processor on our behalf. Data may be stored on Google servers outside your country.

Cloudflare R2 — files you attach to notes. The bucket is private: files have no public address, and access is granted only to your app after verifying that you are signed in to your account.

Traffic between the app and the servers is encrypted (HTTPS).

4. Advertising

The app and the web version show ads through Yandex's ad network (Yandex Ads). This network may use your device's advertising identifier and technical information about it (device type, OS version, and similar) to serve and measure ads. We do not hand Yandex your email or the contents of your notes or shifts. Yandex Ads has its own data-processing policy.

5. Paying for LumaShift Plus

LumaShift Plus is a paid, one-time feature unlock. The payment itself, in cryptocurrency, happens entirely on the side of an independent payment processor, NOWPayments: we hand it only the amount and an order number, and you complete the payment on their own hosted page. We never receive or store card numbers, private keys, or wallet details — only NOWPayments sees those, and they have their own privacy policy. After payment, NOWPayments tells us only that it succeeded, and we mark your account as Plus.

6. Who else can see your data

By default, nobody but you. There are two ways to share data, both entirely by your own choice.

Friends. A friend request must be sent and accepted — it never happens on its own. Once accepted, you and your friend can mutually see each other's workplaces, shifts, events, and notes. This does not cover amounts in "Earnings", birthdays, or holidays — those stay visible only to you. Separately, you can grant a friend the "secretary" right, letting them add, change, and delete your shifts and events on your behalf (but not your notes or workplaces); you can revoke that right, or the friendship itself, at any time.

Access to one note. Independently of being friends, you can invite a specific friend to a single note, choosing a role — view-only or edit. The invited person sees only a short preview (the title and the start of the text) and decides themselves whether to accept or decline; until they accept, they have no access to the note itself or its attachments. After accepting, they can see that note's content and files, and you see their email address in the participant list. You can revoke access at any time without touching your other notes.

We may also disclose data where the law requires it — for example, in response to a lawful request from a competent public authority.

7. How long we keep data

For as long as you use your account. Deleting an individual record — a note, a shift, an event — deletes it immediately and permanently. Deleting your account deletes everything (see the next section).

8. Your rights: getting a copy or deleting your data

Get a copy of your data. In the app: Profile → Account → Download a copy of my data. The app gathers everything you created into a single file and saves it wherever you choose.

Delete your account and all data. In the app: Profile → Account → Delete account and data. This removes all your shifts, workplaces, templates, notes and folders, events, birthdays, holidays, "Earnings" entries, settings, your friends list and requests, note invitations, attached files in storage, and the account itself. Your username is released and can be claimed again. This is irreversible. If you shared notes, participants lose access to them as part of the deletion. A friend you used to know may keep an inert record of the former friendship — it grants no access to your data, since your account no longer exists.

You can also write to support@lumashift-app.com to correct your data, ask a question, or make a complaint. We reply within a reasonable time.

If you are in the European Union, you have rights under the GDPR: access, rectification, erasure, restriction of processing, data portability, and objection to processing. The legal bases for processing are performance of a contract with you (providing the app’s functionality) and your consent.

9. Children

The app is not directed at children under 13, and we do not knowingly collect their data. If you believe a child has given us their data, contact us and we will delete it.

10. Security

Access to your records is restricted by server-side security rules: only someone signed in to your account, plus the people you explicitly granted access to — through a friendship or an invitation to a specific note — can read or change them. Files are kept in a private bucket with no public links. That said, no system is perfectly secure, and we cannot guarantee absolute security of transmission or storage.

11. Changes to this policy

If this policy changes, we will update this document and the effective date at the top. We will announce material changes inside the app.

12. Contact

Questions, deletion requests, complaints: support@lumashift-app.com