How we handle your data.

The short version

• We store only what you give us: your email, your account, the children's profiles you create, and the stories you make.
• We never sell your data. Ever.
• We do not use children's information for advertising, and we do not train AI on your child's identity.
• You can delete your account and all associated data in one click from your dashboard.

What we collect

Account information. Your email address, name (if you provide it), and login provider (Google, Apple, etc.).

Children's profiles. The name, age, pronouns, and descriptive details you enter for each child. These are used to generate personalized stories — nothing else.

Stories. The full text and illustrations of every story you create. Stored so you can read them again later and ordered/printed.

Billing. Stripe handles all payment data. We never see your full card number.

Usage analytics. Anonymous, aggregate metrics about which features people use, so we can improve the product. Never tied to specific children.

What we do not do

• We do not sell, rent, or share your data with marketers.
• We do not train our AI models on the names, photos, or descriptions of specific children.
• We do not show ads — not on Lumora, not in our emails, not anywhere.
• We do not allow third-party tracking pixels from advertising networks.

Who we share with

We use a few trusted infrastructure providers:

• Anthropic — generates the story text. Sees only the story prompt, not your account.
• Stripe — handles billing.
• Cloudflare— hosts the illustrations and PDFs, and runs Cloudflare Turnstile (an invisible bot-protection check) on our story-creation page to keep automated abuse from burning through generation costs. Turnstile collects limited browser signals (timing, request metadata, a short-lived cookie) to score whether a visitor is human; it does not see your form content or your child's profile. See Cloudflare's Turnstile Privacy Addendum for the details Cloudflare publishes about this product.
• Clerk — manages your login.
• Resend — sends transactional email (receipts, story-ready notifications).

Each one has its own privacy policy. We've chosen these because their values are aligned with ours.

Your rights

• Access — request all data we have about you. Just email hello@lumora.kids.
• Delete — delete any story, profile, or your entire account from your dashboard, anytime.
• Correct — change your information in your account settings.
• Export — download all your stories as PDFs.
• Opt out — unsubscribe from emails with one click in any email we send.

Children's privacy

Lumora is designed for parents and guardians to use with their children. Accounts are only for adults (18+); children do not create accounts or log in directly. Any details about a child are entered by the parent on their account, and only used to personalize stories. We do not show ads to children and do not train AI models on a child's identity.

For the full children's privacy notice — including how parental consent works, what we collect, your rights as a parent, retention windows, and how to report a concern — see our Children's Privacy Notice (COPPA-aligned). If you believe a child has created an account, please contact us and we'll delete it immediately.

Questions

Write to hello@lumora.kids. A real person reads every email.