Your data, explained.

Lulume is a social place-discovery platform operated from Manila, Philippines. References to “Lulume”, “we”, “us”, or “our” in this policy refer to the Lulume platform and its operators.

This Privacy Policy explains what personal information we collect when you use Lulume, how we use it, and what choices you have. It applies to all users of the Platform regardless of location, though users in certain jurisdictions (such as the EU or Philippines) have additional rights described below.

2.1 — Information you give us directly

Account

Email address, display name, and handle when you register. Optionally: profile photo and bio.

Places

Title, location (latitude/longitude), category, description, tags, and photos you upload for each place you share.

Journals & lists

Title, description, cover photo, and the places you add to each.

Comments

The text you write in comments on places.

Reactions & saves

Which places you have liked or saved.

Messages

The content of direct messages you send to other users. Messages are stored to enable the messaging feature — we do not read them unless required by law.

Recreations

Photos and captions you upload as recreation posts at a place.

2.2 — Information collected automatically

Usage data

Pages you visit, features you use, search queries, and interactions within the Platform.

Device data

Browser type, operating system, and approximate time zone.

Location

If you grant permission, your device's location is used to sort places by proximity. We do not continuously track or store your location history.

Cookies

Session tokens and preference cookies necessary for the Platform to function. See Section 7.

2.3 — Information from third parties

We do not currently purchase or import data about you from third-party data brokers. If you authenticate via a third-party provider (e.g. Google), we receive the profile information that provider shares with us according to your privacy settings there.

We use the information we collect to:

• Provide the Platform — create your account, display your content, enable the feed, search, messaging, and all core features.
• Personalise your experience — show you relevant places, surface content from people you follow, sort by proximity when you grant location access.
• Communicate with you — send account-related emails (password reset, security alerts). We do not send marketing emails without your explicit opt-in.
• Ensure safety and integrity — detect and prevent abuse, spam, fraud, and violations of our Community Guidelines.
• Improve the Platform — analyse usage patterns to understand what features are useful and where we should invest effort. This analysis uses aggregated, anonymised data wherever possible.
• Comply with law — respond to legal requests, enforce our Terms of Service, and protect the rights and safety of our users.

We do not sell your personal data. We do not use your data to serve you advertising.

4.1 — Public content

Places, journals, lists, comments, and your public profile (name, handle, bio, avatar, follower count) are visible to anyone — including people who are not logged in. Think carefully before sharing precise locations of sensitive or private places.

Your saved places and direct messages are private by default and are not visible to other users or to the public.

4.2 — Service providers

We use Supabase as our database, authentication, and file-storage provider. Your data is stored on Supabase infrastructure located in Singapore (ap-southeast-1). Supabase processes data on our behalf and under our instructions. You can review Supabase’s privacy practices at supabase.com/privacy.

We use map tile services to render the map view. Map tile requests may include your approximate viewport but do not include your account identity.

4.3 — Legal requirements

We may disclose your information if we believe in good faith that doing so is necessary to: comply with a legal obligation or court order; protect the safety of any person; prevent or investigate fraud or abuse; or protect the rights and property of Lulume or our users.

4.4 — Business transfers

If Lulume is involved in a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction. We will notify you via the Platform or email before your data is transferred and becomes subject to a different privacy policy.

Your data is stored on servers managed by Supabase in Singapore. We implement industry-standard security measures including encryption in transit (TLS), encrypted storage, access controls, and regular security reviews.

No system is perfectly secure. While we work hard to protect your data, we cannot guarantee that unauthorised third parties will never defeat our security measures. If you suspect your account has been compromised, change your password immediately and contact us.

Uploaded photos are stored in Supabase Storage with public read access for content you share on the Platform (places, recreations, journal covers, profile avatars). Private content (e.g. draft places not yet published) is stored with restricted access.

Depending on your location, you may have the following rights regarding your personal data. To exercise any of them, contact us at privacy@lulume.com.

Access

Request a copy of the personal data we hold about you.

Correction

Ask us to correct inaccurate or incomplete personal data. You can also update most of this directly in your profile settings.

Deletion

Request deletion of your account and associated personal data. Note that content you have posted publicly (places, comments) may be anonymised rather than deleted to preserve the integrity of the atlas. Direct messages are deleted.

Portability

Request your data in a structured, machine-readable format.

Restriction

Ask us to limit how we process your data in certain circumstances.

Objection

Object to processing based on legitimate interests, including for direct analysis of your usage patterns.

Withdraw consent

Where processing is based on consent (e.g. location access), you can withdraw consent at any time via your device settings or account preferences.

Users in the Philippines have rights under the Data Privacy Act of 2012 (RA 10173), including the right to lodge a complaint with the National Privacy Commission.

Users in the European Union / EEA have rights under the GDPR, including the right to lodge a complaint with your local supervisory authority.

We aim to respond to all requests within 30 days.

We use a small number of cookies and browser storage mechanisms to operate the Platform:

Session cookie

Stores your authentication token so you stay logged in. Required for the Platform to function. Deleted when you sign out.

Preference storage

Saves UI preferences (e.g. map view state) in local storage. Does not contain personal data.

We do not use advertising cookies, cross-site tracking cookies, or third-party analytics cookies. We do not use Google Analytics or similar services. Our analytics are limited to server-side aggregate counts.

Most browsers allow you to control cookies through their settings. Disabling the session cookie will prevent you from staying logged in.

Lulume is not directed at children under 13. We do not knowingly collect personal information from children under 13. If you believe a child under 13 has created an account, please contact us at privacy@lulume.com and we will promptly delete the account.

Users aged 13–17 may use the Platform with parental or guardian consent. We encourage parents to talk with their children about online safety and privacy.

Lulume is operated from the Philippines. If you access the Platform from outside the Philippines, your data will be transferred to and processed in Singapore (where our database infrastructure is located) and potentially other countries where our service providers operate.

For users in the EU/EEA, these transfers are made under appropriate safeguards as required by GDPR, including standard contractual clauses where applicable. For users in the Philippines, transfers are conducted in accordance with the Data Privacy Act of 2012.

We retain your personal data for as long as your account is active or as needed to provide the Platform. When you delete your account:

• Your account credentials and private data (saves, messages) are deleted within 30 days.
• Public content (places, comments) may be anonymised (author attribution removed) rather than deleted, to preserve the atlas for other users.
• Uploaded photos are deleted from our storage within 90 days.
• Aggregate usage logs may be retained for up to 12 months for security and fraud-prevention purposes.

We may retain certain data longer if required by law or to resolve disputes.

We may update this Privacy Policy from time to time. When we make material changes, we will notify you by posting a notice on the Platform or sending an email to your registered address at least 14 days before the changes take effect.

The “Last updated” date at the top of this page always reflects the most recent revision. We encourage you to review this policy periodically.

For privacy-related enquiries, data access requests, or to file a complaint:

We aim to acknowledge all privacy requests within 5 business days and resolve them within 30 days.

See also: Terms of Service · Community Guidelines