Privacy, in plain language

LuminNest exists to support you and your child — your data exists for that one reason. This page says exactly what we collect, what we never collect, and what we will never do with it. No fine print that takes it all back.

What we collect

• Your account: your email address, through our sign-in provider (Google Firebase).
• About your child: a first name, an age, how they communicate (in broad strokes, so everything we make renders to fit), and — if you choose to share it — what they call you (“Momma”, “Nana”), so their stories can say it. No last name, no location, no school, no diagnosis.
• Your conversations with LuminNest: the moments you describe, the Spark Kits we generate, and the Spark Map we build from them — so LuminNest can remember what works for your child. They stay tied to your account and no one else’s.
• Made things: when a kit includes a narrated storybook, the audio files (which may speak your child’s first name) are stored at long, unguessable addresses so the app can play them back. The lullaby is the same for every family and contains no one’s information.
• Your feedback: when you tell us a kit helped or didn’t, we record that rating to adjust what we suggest next.
• Waitlist: if you join before launch, your email and (if you picked one) the plan you clicked.

What we never collect

We never ask for or store your child’s last name, birth date, location, school, photos, or diagnosis. LuminNest is deliberately built to know almost nothing that could identify your child.

What we will never do

• We will never sell your data. To anyone. Ever.
• No advertising, no ad trackers, no data brokers.
• We never write the content of your messages or your child’s details into system logs — logs carry only anonymous technical identifiers.

The helpers we use

A few trusted services do specific jobs: Google Cloud runs our engine and its AI generation, ElevenLabs turns storybooks into narration and composed our lullaby, Supabase and Firebase store data and handle sign-in, Vercel serves the website, and Resend delivers the weekly email. Each one receives only what its job requires. At launch, all AI processing runs under terms that do not permit training on your data.

The shared portrait — always your call

Sharing your child’s portrait page is off by default. If you turn it on, anyone holding your unguessable link can read that one page (never your kits or conversations) — and one tap turns it off again, immediately, forever.

Take everything with you

Settings has a button called “Export all our data” — one click hands you everything LuminNest knows, as a file you keep. No request form, no waiting period. That button is this policy, made testable.

School documents (IEPs)

When you show LuminNest an IEP for translation, it is read in memory, reviewed, and forgotten— never written to a database, a log, or your history. You keep the review; we keep nothing. We refuse to hoard your child’s file.

Children’s use

LuminNest is built for and operated by caregivers. The child-facing corner (stories, the Quiet Sky) is designed to be opened by you and handed over — it collects nothing from your child, shows no ads, and never will. (This section will be reviewed with counsel before launch.)

Where your data lives

Your data is encrypted in transit and at rest, stored with Google Cloud and Supabase, with row-level security so each family’s data is walled off to their own account.

Payments (at launch)

Subscriptions are processed by Stripe. Your card number goes to Stripe, never to us — we don’t see it and we don’t store it.

Deleting your data

You can remove any Spark Map entry — or everything — whenever you choose, no questions asked. To delete your entire account and all data, email us (see Contact) and it will be done.

Cookies

Only what sign-in requires (Firebase authentication). No advertising or cross-site tracking cookies.

If this page changes

If we ever change how we handle data, we’ll email account holders before it takes effect — and this page will always reflect what is actually true.

I wouldn’t put my own child’s information into anything I didn’t trust completely. This is that standard. — Ashley, Founder