Lulie Privacy Policy
Effective date: October 26, 2026 Last updated: October 26, 2026
1. Who we are
Lulie (the "app") is provided by Bünyamin Mete, Istanbul, Türkiye ("we", "us"). We are the data controller for the personal data described in this policy.
- Privacy contact: [email protected]
- EU representative (GDPR Art. 27): not appointed; you can send requests directly to the email address below
- UK representative (UK GDPR Art. 27): not appointed; you can send requests directly to the email address below
- Data protection officer: not appointed
Users in Turkey: a separate KVKK Disclosure Notice (Aydınlatma Metni) is available in the app under Settings > Privacy and Legal.
2. Summary
- You can use the app as a guest. We do not ask for your name or email address. Signing in with Apple (or Google, where offered) is optional.
- Your face is measured on your phone. Facial landmark points are computed in memory and are never written to disk or sent anywhere.
- Face photos are kept on your phone so you can compare week to week. You can delete them with one tap.
- Cloud features are optional and need your consent. If you agree to the AI reading on the consent screen, (a) one photo is sent to an AI provider to analyse your face and draw a projection, and (b) your weekly photos are backed up in an encrypted form that only your phone can open. If you turn the AI reading off, or if it is not available to you (for example, if you are under 18), no photo leaves your phone.
- We do not sell your data, we do not show ads, and we do not use your face to identify you. Face data never goes into analytics.
3. Face data
This section is our public notice and retention schedule for face data, including for the purposes of the Illinois Biometric Information Privacy Act (BIPA), the Texas Capture or Use of Biometric Identifier Act (CUBI), GDPR Art. 9 and KVKK Art. 6. We treat all of the processing below as covered by these laws, even where it happens only on your phone.
3.1 On-device measurement (always on your phone)
When you use the camera, the app uses Apple's on-device Vision framework to find points on your face. From these points it calculates, on your phone:
- a face shape category (oval, round, square, heart or long) and a confidence level;
- four face proportion numbers (for example, the ratio of face length to width and a jaw angle);
- colour and pose statistics of the photo (such as median skin tone channel values, brightness histogram, head angle) and a measurement change value.
The landmark coordinates themselves exist only in memory and are discarded. They are never saved to disk, never backed up and never sent over the network.
3.2 Photos stored on your phone
| What | Where | How long |
|---|---|---|
| Daily before/after photos | App storage on your phone, protected by iOS Data Protection; excluded from device backups | Deleted automatically after 7 days |
| Weekly comparison photos (one per week; week 0 is from onboarding) | App storage on your phone, protected by iOS Data Protection; included in your iOS device backup | Weeks 0 to 12 are kept until you delete them. After week 12, only every fourth week is kept; the others are deleted automatically when the next week's photo is saved |
| AI projection image (if created) | Same as weekly photos | Until you delete your face photos |
| Temporary copy sent to AI (if you consented) | Temporary folder on your phone | Deleted when the request ends, and on next app start |
Because weekly photos and the projection are part of your iOS device backup, they will also be in any iCloud or computer backup you make of your phone. Those backups are controlled by you and Apple under your Apple Account, not by us.
3.3 Encrypted cloud backup (only with your consent)
If you agree to the AI reading on the consent screen (or later turn on Encrypted Cloud Backup in Settings), your weekly photos and projection image are backed up to our cloud storage so you do not lose them when you change phones.
- Each photo is encrypted on your phone with AES-256-GCM before it is uploaded.
- The encryption key is created on your phone and stored only in your iPhone Keychain and, if you have it turned on, your iCloud Keychain. We never receive the key. We and our hosting provider cannot open your photos.
- On our server we store only the encrypted file, its size, a checksum and the upload time, linked to a random device identifier.
- If you lose the key (for example, iCloud Keychain is off and you change phones), the backup cannot be recovered by anyone, including us.
- When a weekly photo is pruned or deleted on your phone, the encrypted copy is deleted too.
- Turning off Encrypted Cloud Backup deletes all of your encrypted copies from our storage. Photos on your phone stay.
The backup is stored with Cloudflare (R2 object storage). See section 7.
3.4 AI face reading and projection (only with your consent)
If you agree to the AI reading, the following is sent from your phone, over an encrypted (TLS) connection, through our server to an AI provider:
| Request | What is sent |
|---|---|
| Onboarding reading (once; again if you choose "Read my face again") | One photo (long edge at most 1024 px, cropped to your face, location and camera metadata removed), your face shape category and confidence, the side you usually sleep on |
| Projection (at most twice per user) | The same photo, your face shape category, up to three face areas you selected, a light quality value |
| Weekly comparison | This week's photo and, if both are good quality, last week's photo; your face shape category, the measurement direction calculated on your phone, and the results of up to four previous weeks |
We do not send your name, email, goal or account identifiers to the AI provider. Our server (a Cloudflare Worker) passes the request through in memory and does not save the photo or log the request body.
What comes back:
- Readings are limited to a fixed list of categories (for example, "balanced" or "tense" for a face area, or "up / same / down" in a weekly comparison). There is no free text.
- The projection is an AI-generated image based on your photo. It is labelled in the app as "From your own frame, by AI. An estimate, not a promise." It is shown only if it passes quality checks on your phone.
- The AI is instructed not to infer your age, ethnicity, religion, sexual orientation, gender identity or any health condition, and outputs outside the allowed categories are discarded.
AI providers currently used: Google LLC (Gemini API) (face reading and weekly comparison) and Google LLC (Gemini API) (projection). Your photos are processed only to provide the result to you. We do not store your photo. Under the paid Gemini API, Google does not use the content to train its models and may keep requests for a limited period (up to 55 days) only to detect abuse.
3.5 Account-linked program profile
If you link an Apple (or Google) account, a program profile is saved on our server so your program can continue on a new phone. It contains: your goal and selected face areas, your ritual time preference, your face shape category and confidence, the four face proportion numbers from section 3.1, the AI reading categories and weekly comparison results, program progress and your consent choices. It contains no photos and no landmark coordinates. It is deleted when you delete your account.
3.6 What we never do with face data
- We do not sell, lease, trade or otherwise profit from your face data.
- We do not use it to identify or recognise you, or to verify your identity.
- We do not use it for advertising, and we do not put it in analytics or crash reports.
- We do not share it with anyone other than the service providers in section 7, who act on our instructions.
- We do not use your photos in our marketing. If we ever want to feature a user's before/after, we will ask for a separate permission that you can withdraw at any time.
3.7 Retention and destruction schedule for face data
| Data | Destroyed |
|---|---|
| Landmark coordinates | Immediately; never stored |
| Daily before/after photos | Automatically after 7 days |
| Weekly photos and projection (on phone) | When you tap "Delete Face Photos" or "Delete Everything", or uninstall the app (device backups you made remain under your control) |
| Encrypted cloud copies | Together with the phone copy when pruned; immediately when you turn off Encrypted Cloud Backup, delete face photos, delete everything or delete your account |
| Photo sent to AI provider | Our server: not stored. Provider: we do not store your photo; under the paid Gemini API, Google does not use the content to train its models and may keep requests for a limited period (up to 55 days) only to detect abuse |
| Face shape, proportion numbers, readings (on phone) | When you choose "Read my face again" (replaced) or "Delete Everything" |
| Account-linked program profile (server) | When you delete your account |
3.8 Your consent and how to withdraw it
We ask for your consent on a dedicated screen before the camera is used. If you are under 18, AI reading and projection are not available and the reading stays on your phone.
You can withdraw consent at any time in Settings > Face data: turn off AI face reading (stops all AI requests) and/or Encrypted Cloud Backup (deletes your encrypted copies). Withdrawal does not affect processing that already happened.
We keep a record of your consent choices (which consent, text version, date and time, country and language, but no face data) as proof of consent. See section 9.
4. Other data we process
| Data | Details |
|---|---|
| Device identifier | A random ID created on your phone and stored in your Keychain. Used to link your consent records, encrypted backups, purchases and analytics. "Delete Everything" replaces it with a new one. |
| Your program and measurements | Goal, selected face areas, ritual time, sleep side, jaw clench answer, ritual history, measurement summaries. Stored on your phone only, unless you link an account (section 3.5). |
| Account | If you sign in with Apple or Google, we store a one-way hash of the account identifier and which provider you used, plus the device IDs linked to it. We do not request or store your name or email. |
| Consent records | See section 3.8. |
| Device integrity | Apple App Attest keys used to confirm requests come from the genuine app; short-lived request counters used to prevent abuse (expire within 48 hours). |
| Notifications | If you allow notifications: your push token, country, language, time zone, notification permission status, your "Offers" and "News" preferences, subscription status and plan, ritual time preference and hour, a coarse ritual count range, install week, last active week and app version. Used to send reminders and, if you opted in, offers. Face data is never included. |
| Purchases | Subscriptions are processed by Apple. RevenueCat receives purchase receipts and subscription status linked to your device ID (or account hash, if linked). Our server receives subscription events (event type, product, price and estimated net revenue in USD, country code, cancellation reason, environment, time). |
| Analytics | Product usage events (for example, screens completed, purchases attempted, feature use), device and app version, and crash and performance diagnostics (Apple MetricKit), sent to PostHog in the United States with your device ID. IP address collection and GeoIP are turned off. No session recording, no automatic tap capture. No face data, photos or free text. |
| Ad attribution | If you installed from an Apple Search Ads campaign, the app sends Apple's AdServices token to our server, which asks Apple for the campaign. We keep only a campaign label and keyword label (and country) in analytics. We do not use the App Tracking Transparency framework and we do not track you across other companies' apps or websites. |
| Support requests | If you email us, we process your email address and message to answer you. |
5. Why we process your data and our legal bases
| Purpose | Data | Legal basis (GDPR / UK GDPR) | Legal basis (KVKK) |
|---|---|---|---|
| On-device measurement, photo storage on phone | Section 3.1, 3.2 | Explicit consent, Art. 9(2)(a) and Art. 6(1)(a) | Explicit consent, Art. 6(2) |
| AI face reading and projection | Section 3.4 | Explicit consent, Art. 9(2)(a) and Art. 6(1)(a) | Explicit consent, Art. 6(2); transfer abroad Art. 9 (see section 8) |
| Encrypted cloud backup | Section 3.3 | Explicit consent, Art. 9(2)(a) and Art. 6(1)(a) | Explicit consent, Art. 6(2) |
| Providing the app, program, account, sync | Sections 3.5, 4 | Performance of contract, Art. 6(1)(b) | Art. 5(2)(c) |
| Subscriptions and purchase records | Section 4 | Performance of contract, Art. 6(1)(b); legal obligation, Art. 6(1)(c) | Art. 5(2)(c), 5(2)(ç) |
| Reminders and renewal notices | Section 4 | Performance of contract, Art. 6(1)(b) | Art. 5(2)(c) |
| Offer notifications | Section 4 | Consent, Art. 6(1)(a) | Explicit consent, Art. 5(1) |
| Analytics, diagnostics, attribution, abuse prevention | Section 4 | Legitimate interests, Art. 6(1)(f) (improving and securing the app) | Legitimate interest, Art. 5(2)(f) |
| Proof of consent | Consent records | Legal obligation / legitimate interests, Art. 6(1)(c), (f) | Art. 5(2)(e), 5(2)(f) |
6. Automated processing and AI transparency
The face reading, weekly comparison and projection are produced by AI. They are estimates for a wellness routine, not medical advice, and they do not produce legal or similarly significant effects for you. The projection image is AI-generated and labelled as such; it keeps the provider's invisible watermark or content credentials where the provider adds them. Some movement videos in the app were also created with AI and reviewed before release. Settings > About AI lists the AI providers we use.
7. Who receives your data (service providers)
We use the following providers, who process data on our behalf under contract:
| Provider | Role | Data | Location |
|---|---|---|---|
| Cloudflare, Inc. | Server (Workers), key-value store, database, encrypted backup storage (R2) | Device ID, account hash, consent records, push tokens and segments, subscription events, encrypted photo backups; photos for AI requests pass through in memory only | Cloudflare's global network |
| Google LLC (Gemini API) | AI face reading and weekly comparison | Section 3.4 | United States |
| Google LLC (Gemini API) | AI projection image | Section 3.4 | United States |
| RevenueCat, Inc. | Subscription management | Device ID or account hash, purchase receipts, subscription status, offer preference attributes | United States |
| PostHog, Inc. (US Cloud) | Product analytics and diagnostics | Device ID, usage events, diagnostics | United States |
| Apple Inc. | App distribution, payments, Sign in with Apple, push notifications (APNs), App Attest, AdServices attribution | As needed for each service | United States |
| Google LLC | Sign in with Google (only if offered and you use it) | Sign-in exchange; we keep only a hash of the account ID | United States |
We may also disclose data if required by law, or in connection with a merger or sale of the app, in which case this policy will continue to apply to your data.
8. International transfers
Our service providers may process data outside your country, including in the United States. Where data from the EEA, UK or Switzerland is transferred to a country without an adequacy decision, we rely on the European Commission's Standard Contractual Clauses (and the UK Addendum), or the EU-U.S. Data Privacy Framework where the provider is certified. For users in Turkey, transfers abroad are made under Article 9 of the KVKK on the basis of your explicit consent and the providers’ standard contractual terms.
9. How long we keep data
| Data | Retention |
|---|---|
| Face data | Section 3.7 |
| Program, measurements, readings on your phone | Until you delete them or the app |
| Account record (hash, provider, linked devices) | Until you delete your account; the deleted account entry is permanently erased 30 days after deletion |
| Account program profile | Until you delete your account |
| Consent records | 3 years from the last change |
| Push token and segments | Until you delete everything or your account, or 180 days after the last update |
| Subscription events on our server | 13 months |
| Notification campaign logs | 90 days |
| App Attest keys | Until you delete everything |
| Abuse prevention counters | Up to 48 hours |
| Analytics (PostHog) | up to 1 year |
| RevenueCat records | for the life of the subscription and afterwards as long as legal retention duties require |
| Support emails | 2 years from the last message |
10. Your rights and choices
Depending on where you live, you may have the right to access, correct, delete, restrict or object to processing of your data, to data portability, to withdraw consent and to complain to a supervisory authority.
In the app (Settings):
- Delete Face Photos: deletes weekly photos, daily photos and the projection from your phone and our cloud storage. Your measurement history and program stay.
- Delete Everything: resets the app on your phone, deletes your encryption key, and deletes your encrypted backups, App Attest keys, push token and device link from our server; a new device ID is created.
- Delete Account (if you linked one): deletes your account link, program profile, encrypted backups and push tokens for all linked devices from our server.
- Export My Data: a file with your measurement summaries, program, consent records and face profile, plus your weekly photos and projection.
- Delete My Analytics and Purchase Record: opens an email to us with your device ID. We delete your PostHog and RevenueCat records within 30 days.
- Turn AI face reading, Encrypted Cloud Backup, notifications and offers on or off at any time.
By email: [email protected]. Because we do not know your name or email, we may ask you for the device ID shown in the app so we can find your data. We answer within one month (GDPR) or 30 days (KVKK).
Please note: purchases are tied to your Apple Account. Deleting data in the app does not cancel your subscription; cancel it in your Apple Account settings.
Complaints: you can complain to your local data protection authority. In Turkey: Kişisel Verileri Koruma Kurumu. In the EU: the authority in your country of residence. In the UK: the Information Commissioner's Office.
11. Children
The app is rated 13+ and is not intended for children under 13. AI face reading and projection are not available to users who are under 18 according to Apple's age range signal or who do not confirm that they are 18 or older. If you believe a child under 13 has used the app, contact us and we will delete the data we hold.
12. Security
Photos on your phone are protected by iOS Data Protection. Cloud backups are encrypted on your phone before upload and we do not hold the key. All network traffic uses TLS. Requests to our server are checked with Apple App Attest. API keys for AI providers are kept on our server, not in the app. Our server logs do not contain request bodies, photos or email addresses. No system is completely secure; if a breach affects your data, we will notify you and the authorities as required by law.
13. United States residents
- Illinois, Texas, Washington and other states with biometric laws: section 3 is our written policy and retention schedule. We obtain your consent before any face data is collected, and we do not sell or profit from it.
- California and other state privacy laws: we do not sell or "share" (for cross-context behavioural advertising) personal information, and we do not use sensitive personal information to infer characteristics about you.
14. Our website
Our website lulie.app does not use cookies or local storage. We measure page views with PostHog in memory-only mode with IP collection turned off.
15. Changes to this policy
We will update the "Last updated" date when we change this policy. If a change expands how we use face data, we will ask for your consent again in the app before applying it.
16. Contact
Bünyamin Mete, Istanbul, Türkiye, [email protected]