LumaShift Privacy Policy

Effective date: 10 August 2026

In short: the app needs your email address and whatever you create inside it. There are no ads, no analytics and no trackers, and your data is never sold. You can export a copy of your data or delete your account entirely from inside the app.

LumaShift is an app for planning work shifts, notes, and personal events. This document explains in plain language what data the app collects, why, who can see it, and how to delete it.

The developer of the app (“we”) is an individual. Contact for any data-related question: support@lumashift.app.

1. What we collect

Only what the app needs to work. Nothing beyond that.

Account data. Your email address and an internal user identifier. If you sign in with Google or Apple, we receive an email address and an identifier from them — we never see your password for those services. If you register with an email and password, the password itself is stored by Google Firebase Authentication, not by us, and is not visible to us in readable form.

Content you create. Workplaces, shift templates, shifts, notes and their contents, note folders, events, birthdays, and files you attach to notes.

App settings. Interface language, light or dark theme, note styling, and a subscription tier flag.

What we do NOT collect. The app contains no ads, no usage counters, no analytics, and no third-party trackers. We do not collect your location, your contacts, call history, clipboard contents, or a list of your other installed apps. We do not track you across other apps or websites.

2. Why we need it

So you can sign in and reach your records from any device.
To store and synchronise the content you create.
To open the app in the language and appearance you chose.
To make note sharing work, if you choose to use it.

We do not use your data for advertising, and we never sell it or hand it to third parties for their own purposes.

3. Where the data is stored

Google Firebase (Firebase Authentication and Cloud Firestore) — accounts and all content you create, except attached files. Google acts as a data processor on our behalf. Data may be stored on Google servers outside your country.

Cloudflare R2 — files you attach to notes. The bucket is private: files have no public address, and access is granted only to your app after verifying that you are signed in to your account.

Traffic between the app and the servers is encrypted (HTTPS).

4. Who else can see your data

By default, nobody but you.

There is one exception: you can share a note yourself. The app creates a short invitation code that you pass to a person of your choice by any means you like. When they enter the code, you decide whether they can only read the note or also edit it. From that moment the content of that specific note, including files attached to it, becomes visible to that person, and their email address appears in your list of participants. You can revoke access at any time. The rest of your records stay private.

We may also disclose data where the law requires it — for example, in response to a lawful request from a competent public authority.

5. How long we keep data

For as long as you use your account. Deleting an individual record — a note, a shift, an event — deletes it immediately and permanently. Deleting your account deletes everything (see the next section).

6. Your rights: getting a copy or deleting your data

Get a copy of your data. In the app: Profile → Data and account → Download a copy of my data. The app gathers everything you created into a single file and saves it wherever you choose.

Delete your account and all data. In the app: Profile → Data and account → Delete account and data. This removes all your shifts, workplaces, templates, notes and folders, events, birthdays, settings, attached files in storage, and the account itself. This is irreversible. If you shared notes, participants lose access to them as part of the deletion.

You can also write to support@lumashift.app to correct your data, ask a question, or make a complaint. We reply within a reasonable time.

If you are in the European Union, you have rights under the GDPR: access, rectification, erasure, restriction of processing, data portability, and objection to processing. The legal bases for processing are performance of a contract with you (providing the app’s functionality) and your consent.

7. Children

The app is not directed at children under 13, and we do not knowingly collect their data. If you believe a child has given us their data, contact us and we will delete it.

8. Security

Access to your records is restricted by server-side security rules: only someone signed in to your account, plus the people you explicitly granted access to a specific note, can read or change them. Files are kept in a private bucket with no public links. That said, no system is perfectly secure, and we cannot guarantee absolute security of transmission or storage.

9. Changes to this policy

If this policy changes, we will update this document and the effective date at the top. We will announce material changes inside the app.

10. Contact

Questions, deletion requests, complaints: support@lumashift.app