Privacy Policy
Effective date: 2026-11-13
Lumea is a free, minimal writing app run by one person. This policy explains what personal information it handles, why, where it goes, how long it is kept, and what you can do about it. It is written to meet Korea’s Personal Information Protection Act (PIPA), the EU and UK General Data Protection Regulation (GDPR), and US state privacy laws such as California’s CCPA/CPRA.
The short version
- Your account is just an email address. There is no password and no name.
- Your documents are private to you. They are not used for ads, AI training or analytics.
- There is one cookie, and it only keeps you logged in. No analytics, advertising or tracking.
- You can export or delete any document, or delete your whole account, at any time. Deletion is immediate; backups are gone within 7 days.
- Nothing is sold, and there is no profiling.
1. Who is responsible
The service is operated by Jiwon Pi, an individual based in the Republic of Korea (“we”, “us”). We are the controller of your personal information and also serve as the privacy officer under Korean law. You can reach us at anthonypiarch@gmail.com.
We have not appointed a representative in the EU or the UK under Article 27 GDPR.
2. What we collect
| Category | Data | Where it comes from |
|---|---|---|
| Account | Your email address | You, when you sign up or log in |
| Verification | A hash of the 6-digit code we email you, and its expiry time | Generated when you request a code |
| Documents | The text you write, with created and updated timestamps | You; timestamps are recorded automatically |
| Session | A hash of your session token | Generated when you log in |
| Request logs | IP address, time and address of each web request | Generated automatically by our host, Vercel |
| Correspondence | Your email address and what you write to us | You, if you email us |
We do not ask for your name, password or phone number, and we do not intentionally collect sensitive data (such as health information or government ID numbers). Your documents contain whatever you choose to write; we only store them and show them back to you.
3. Why we use it, and our legal bases
| Purpose | Data used | Legal basis (GDPR) |
|---|---|---|
| Creating your account, verifying your email and logging you in | Email address, code hash, session token hash | Performance of our contract with you (Art. 6(1)(b)) |
| Storing, syncing and showing your documents; export and delete | Documents and timestamps | Performance of contract (Art. 6(1)(b)) |
| Keeping the service secure: rate-limiting code requests and attempts, detecting and blocking abuse, diagnosing outages | Email address, request logs including IP address | Our legitimate interest in protecting the service and its users (Art. 6(1)(f)) |
| Answering your emails and requests | Email address, your message | Performance of contract (Art. 6(1)(b)) or our legitimate interest in responding to you (Art. 6(1)(f)) |
| Complying with the law | Whatever a lawful request requires | Legal obligation (Art. 6(1)(c)) |
Under Korean law, we process this information because it is necessary to enter into and perform our agreement with you (PIPA Article 15(1)(4)) and, for security, for our legitimate interests (Article 15(1)(6)). We don’t rely on consent, and we don’t use your information for any other purpose. Your documents are never read by anyone, except where we are legally compelled or where you ask us to look into a technical problem you reported.
4. Cookies and browser storage
One cookie. We set a single, strictly necessary cookie called “session”. It holds a random token (we store only its hash), cannot be read by JavaScript (httpOnly), and lasts up to one year or until you log out. Because we use no analytics, advertising or tracking cookies, we don’t show a cookie banner. You can block cookies in your browser, but you won’t be able to log in.
Browser storage. So that your writing is never lost when you are offline, the app keeps a few things in your browser’s localStorage: drafts not yet synced to the server, your theme and caret preferences, and the last document you had open with your cursor position. This stays on your device. It is cleared when you log out or clear this site’s data in your browser. On a shared computer, please log out when you’re done.
5. Who we share it with
We don’t sell, rent or share your personal information with anyone for their own purposes. We use three service providers that process data to run the service for us:
| Provider | What they do |
|---|---|
| Vercel Inc. (USA) | Hosts and serves the app; keeps short-term request logs |
| Databricks, Inc. (Neon) (USA) | Runs our Postgres database (accounts, codes, sessions, documents) |
| Plus Five Five, Inc. (Resend) (USA) | Sends the verification-code email |
Neon and Resend process data under their data processing agreements. Vercel’s data processing addendum does not cover the free Hobby plan we use, so Vercel handles data under its own terms and privacy policy.
We may disclose information if the law requires it, for example in response to a valid court order, and only as much as is required.
6. International transfers
We are based in Korea, and our providers are US companies, so your information is transferred outside your country, and outside Korea, whenever you sign up for and use the service. It travels over encrypted connections (TLS).
| Recipient (contact) | Country | Data | Purpose | Kept for |
|---|---|---|---|---|
| Vercel Inc. (privacy@vercel.com) | Singapore (server region, AWS) and Vercel’s global delivery network (Vercel Inc. is based in the USA) | Everything exchanged while you use the app; request logs including IP address | Hosting and serving | While a request is handled; logs as in section 7 |
| Databricks, Inc., operator of Neon (privacy@databricks.com) | AWS ap-southeast-1 (Singapore / 싱가포르) (Databricks, Inc. is based in the USA) | Email address, code and session hashes, documents and timestamps | Database storage | Until you delete it, plus up to 7 days in backups |
| Plus Five Five, Inc. (Resend) (support@resend.com) | Japan (sending infrastructure: AWS ap-northeast-1, Tokyo) (Plus Five Five, Inc. is based in the USA) | Email address and the code email | Sending verification codes | As in section 7 |
Safeguards. The EU and the UK recognise Korea as providing adequate protection for personal data. For onward transfers to Neon (Databricks) and Resend, we rely on the European Commission’s Standard Contractual Clauses and the UK Addendum included in their data processing agreements. Vercel’s data processing addendum does not cover the Hobby plan, so for transfers to Vercel we rely on Vercel’s certification under the EU-U.S. Data Privacy Framework and its UK Extension. Under Korean law, these transfers are disclosed here as outsourcing necessary to perform our agreement with you (PIPA Article 28-8(1)(3)).
If you don’t want your data transferred, you can choose not to sign up, or delete your account at any time in Settings. The service cannot run without these providers, so it can’t be used without the transfer.
7. How long we keep it
- Account and documents: until you delete them or your account.
- Verification codes: expire after 10 minutes and are deleted once used or expired.
- Sessions: up to one year, or until you log out.
- Rate-limit records: only as long as needed to apply the limit.
- Request logs (including IP address): on the Vercel Hobby plan we use, the request logs we can see are available for 1 hour. Any copies Vercel keeps itself are kept for the period set out in Vercel’s privacy policy.
- Email delivery records: 30 days, the data retention period of Resend’s free plan.
- Emails you send us: up to 1 year after your request is resolved, then deleted.
- Backups: deleted data may remain in database backups and point-in-time history for up to 7 days, then it is gone.
When you delete a document, it is removed from the live database immediately. When you delete your account in Settings, your account, sessions and all documents are erased from the live database immediately. Deleted data is not recoverable by us once the 7-day backup window has passed. If a law requires us to keep something longer, we keep it separately and only for that period.
8. Security
- All traffic is encrypted with TLS.
- Verification codes and session tokens are stored only as hashes, never in plain form.
- Code requests and attempts are rate-limited to stop guessing and abuse.
- Access to the systems and data is restricted to the operator.
- Data is stored in our providers’ access-controlled data centres.
No system is perfectly secure. If a breach affects your information, we will notify you and the relevant authorities as the law requires.
9. Your rights
Wherever you live, you can:
- Access and take a copy of your data: export every document as .txt or .md from the app.
- Correct it: edit your documents directly, or email us to change your email address.
- Delete it: delete any document, or your whole account in Settings.
- Restrict or object to processing, including processing based on legitimate interests.
- Log out to end your session on a device.
For anything you can’t do in the app, email us (see section 15) from the address on your account, so we can confirm it’s you. You may also act through a legal guardian or an authorised agent with written authorisation. We will respond within 10 days. Some requests may be limited where the law allows, and if so we will tell you why.
We do not make decisions about you based solely on automated processing, including profiling, that have legal or similarly significant effects.
10. EEA and UK residents
In addition to the rights above, you have the right to data portability (provided by the export feature) and the right to lodge a complaint with a data protection supervisory authority, in particular in the country where you live or work or where an alleged infringement took place. In the UK, that is the Information Commissioner’s Office (ICO). We would appreciate the chance to address your concern first.
Providing your email address is necessary to create an account; without it we cannot provide the service.
11. California and other US residents
- What we collect: identifiers (email address, IP address), the content you write and internet activity limited to request logs, for the purposes and periods described above.
- No sale or sharing: we do not sell your personal information or share it for cross-context behavioural advertising, and have not done so in the past 12 months.
- Sensitive information: we do not use or disclose sensitive personal information for any purpose other than providing the service you asked for.
- Your rights: you may ask to know what we collect, and to delete or correct it. You may use an authorised agent. We will not discriminate against you for using these rights.
Since we neither sell nor share data, there is nothing to opt out of, but we honour Global Privacy Control signals all the same.
12. Korean residents
The privacy officer responsible for handling your personal information, requests and complaints is Jiwon Pi, operator (contact details in section 15). If you need further help or remedy, you can contact these independent bodies:
- Personal Information Dispute Mediation Committee: 1833-6972, www.kopico.go.kr
- Personal Information Infringement Report Center (KISA): 118, privacy.kisa.or.kr
- Supreme Prosecutors’ Office: 1301, www.spo.go.kr
- Korean National Police Agency: 182, ecrm.police.go.kr
13. Children
You must be at least 14 to use Lumea, or older if the law where you live sets a higher age (in some EEA countries, 16). We do not knowingly collect information from children under that age. If we learn that a child has signed up, we will delete the account. Parents or guardians can let us know using the contact details in section 15.
14. Changes to this policy
If we change this policy, we will post the new version here at least 7 days before it takes effect. For important changes, such as collecting new kinds of data, we will give at least 30 days’ notice and also email you. Previous versions are available on request.
This policy is available in English and Korean. If they differ, the Korean version prevails, without affecting any rights you have under the law of the country where you live. See also our Terms of Service.
15. Contact
Jiwon Pi, Republic of Korea: anthonypiarch@gmail.com