Privacy Policy

1. Information We Collect

Depending on how you use Lux, we may collect:

• Account information: email address, optional name, and a hashed password. If you sign in with Google or Apple, we receive the identifier and email those providers share with us. We also store your representation that you are at least 13, and, for web Stripe checkout, the time you agreed to the Terms.
• Lux companion conversations: standard conversations are stored on our servers, including messages, titles, summaries, and retrieval records, so you can reopen them and (when enabled) use your own prior chats for continuity. You can delete a conversation or turn off cross-chat recall in chat settings. Temporary conversations are also processed and stored on our servers, are excluded from cross-chat recall, and are scheduled to expire 24 hours after their most recent activity. Expired temporary conversations are permanently removed when the conversation cleanup runs. Browser storage may also hold chat interface state on that device.
• Community chat and admin chat: messages are stored on our servers so they can be shown to other participants and moderated. Admin chat messages may be visible to the user and support administrators. Community content can be reported, blocked, or moderated on the web.
• Explore: a limited no-account preview. We do not keep an Explore chat transcript. We store a cookie and a device fingerprint (including IP address and user agent, plus a hash) so the 24-hour / 5-message limit cannot be endlessly reset.
• Prayer: some prayer replies use the same AI processing as companion chat; some gated replies do not call the model. Prayer UI state may stay in memory on that page and is not a separate saved transcript unless you use a mode that stores messages (such as Friend Lab).
• Study and usage data: reader position, notes or highlights when you use those features, suggestions, bug reports, and AI usage counts.
• Lux Create: when you use image creation, we store the request or prompt and job details such as status, provider, timing, and generated-media references so the feature can run and we can troubleshoot it. A generated image may remain in your private gallery until you delete or hide it; related job telemetry may remain in the account records.
• Payment information: web payments are processed by Stripe (we do not store full card numbers). Apple and Google Play process mobile subscriptions; we store purchase status, product identifiers, and tokens needed to verify the subscription — not payment card details.
• Technical and security data: IP address, browser or app version, device information, session identifiers, and device signals used to prevent fraud, trial abuse, and Explore-pass abuse. Device fingerprints may include a hash plus plaintext IP address and user agent. We may store the IP used at registration.
• Notifications: if you opt in, a push subscription so we can send a daily verse or similar service notices. You can turn this off in Account settings.
• On-device preferences: bookmarks, voice, and playback speed may be stored in your browser or app and are not always copied to our servers.
• Voice input (optional): Chat voice typing is optional and, when offered, asks for your permission each time before the microphone is used. On supported browsers, Lux may use the browser or operating system speech recognition service (for example the Web Speech API). In that mode, speech processing is handled by your browser or OS provider; Lux does not upload a microphone recording to Lux servers for that path. Where server transcription is enabled for the product and available on your device, Lux may record a short clip (up to about 60 seconds), transmit that audio securely to Lux servers, and send it to OpenAI solely to create a text transcript for your Chat draft. That transcript is placed in the draft and is not sent as a chat message until you press Send. You can cancel before or during capture or upload. You may also decline the per-use prompt and continue typing instead.
• Price Audit System (PAS): When PAS usage logging is enabled for the product, Lux may record per-call AI provider cost-measurement metadata for account-linked auditing. That metadata may include the internal account identifier (user id), model name, operation or stage (for example chat completion, image tool step, or vision image-input), success, failure, or retry status, provider-reported or partial token counts (and image-attempt counts where applicable), and calculated provider cost estimates in integer USD micros when derivable from provider usage; otherwise cost is recorded as unknown (never invented as $0). PAS metadata excludes prompts and conversation text, media bytes (images or audio), payment card data and Stripe customer charges, and complimentary or retail customer image credit charges (Create charge ledgers remain separate). PAS events describe usage of HRB-operated routes and, when Premium/OpenAI routes are used, OpenAI-processed requests under OpenAI’s service terms. Lux does not control provider-side operational retention. PAS admin reports are limited to authenticated accounts with administrator privileges (User.isAdmin) and are not a customer subscription or billing statement. This notice does not claim that PAS logging is currently active, and it does not make retroactive claims about past collection.

2. How We Use Your Information

• Provide and operate Lux (reading, listen-aloud, AI companion, optional voice typing, music, community, accounts)
• Process payments and manage subscriptions and trials
• Send service email (password reset, verification, important notices)
• Prevent fraud, abuse, and overlapping trials
• Understand site traffic in aggregate (first-party page views; Google Analytics only if configured)
• Comply with legal obligations

HRB does not use your chat content to train public foundation models. Standard chat processing runs on HRB-operated infrastructure; when the Premium/OpenAI route is enabled and used, chat content is sent to OpenAI as described below.

3. Data Storage and Security

Passwords are hashed (bcrypt). We use HTTPS for data in transit. No method of transmission or storage is 100% secure. Account sessions may be limited to one active login at a time.

4. Data Sharing

We do not sell your personal information. We share data only as needed with:

• Payment processors: Stripe (web), Apple (App Store), and Google Play (Android), under their privacy policies.
• Sign-in providers: Google and/or Apple if you choose those sign-in methods.
• HRB-operated AI and speech services: the Lux companion runs on infrastructure we operate. Lux may use HRB-hosted speech synthesis; some app versions may use device-native speech services. Public-domain KJV audio may be cached (keyed to verse text and voice, not to your account) so playback is faster. Chat listen-aloud audio may also be cached for about 14 days. That cache is content-addressed (a hash of the spoken text and voice), not keyed by user ID, but it can contain personal phrasing from a chat.
• OpenAI: when the Premium chat route is enabled and used, the chat content and any attached image sent with the request are processed by OpenAI to generate a response. The request asks the API not to store the response, but OpenAI processes the request under its own service terms and operational policies; Lux does not control any provider-side retention. Separately, when optional server voice transcription is enabled and you choose to use it, a short microphone recording you submit is transmitted to Lux and then to OpenAI’s audio transcription API to produce draft text. Lux holds that audio in memory for the transcription request and does not write the recording to Lux disk storage as a permanent archive; Lux zeros the in-memory copy after the request finishes. OpenAI still processes the audio under its own service terms and operational policies, and Lux does not control or guarantee any fixed provider retention period.
• Email: account verification and welcome messages are sent with Resend. Password-reset messages are sent with IONOS SMTP.
• Analytics: first-party traffic counts (page-view beacons to our servers). Google Analytics loads only if a real measurement ID is configured; placeholder IDs are treated as unset.
• Error monitoring: if Sentry is enabled, it may receive diagnostic data. Session Replay, if turned on, can record a masked view of the page around errors (text is masked; this is not a full chat archive).
• Legal requirements: when required by law or to protect our rights or users.

5. Cookies and Similar Technologies

We use cookies and similar storage to keep you signed in, remember Explore-pass status, store a visitor id for first-party traffic counts, and remember preferences. Blocking cookies may prevent login or Explore from working. Voice input is separate from cookies: browser or OS speech recognition (when used) is handled by that provider, while optional server transcription (when enabled and you consent for that use) uploads a short recording to Lux for OpenAI transcription as described in Sections 1 and 4.

6. Your Rights

Subject to applicable law, you may:

• Access or correct account information
• Request deletion of your account and associated personal data
• Request a copy of personal data we hold (we do not currently offer a self-serve export button)
• Opt out of optional notifications such as the daily verse

If you are signed in, you can delete your account from Account on the website. iOS and Android app versions that include the Delete account control can do the same in-app. You can also email support@hrblux.com or use the public delete-account page. Self-serve deletion removes the server account and database records related through that account. The current deletion handler does not itself remove separately stored files, such as generated Create media. It cannot wipe data stored only on your device (for example local chat, bookmarks, or voice settings), Apple or Google Play billing records, shared Scripture audio caches, or copies held in backups and operational systems. Contact support for other data requests; response timing depends on the request and applicable requirements. Some records may need to be retained for legal, security, or fraud-prevention purposes.

7. Children's Privacy

Lux is not intended for children under 13. We do not knowingly collect personal information from children under 13. If you believe we have, contact us and we will delete it. At signup we require a representation that you are at least 13; that is not an identity check. Users 13–17 should use Lux with a parent or guardian’s consent, as described in the Terms of Service.

8. Data Retention

Standard saved conversations and their transcripts, summaries, and retrieval records expire after 30 days without a new message. Expired conversations are excluded from history and recall immediately, then hard-deleted with their related records when cleanup runs on chat-history access, such as when the conversation list loads. This does not promise deletion exactly at the 30-day mark. New messages reset that window. Temporary conversations keep their 24-hour inactivity expiry and are removed when cleanup runs; the application triggers cleanup on chat-history access, such as when the conversation list loads, so expiry does not promise deletion at the exact 24-hour mark. Turning off cross-chat recall prevents future retrieval from prior chats but does not delete stored conversations. Account deletion removes the account and database records linked to it through the account relationships, but does not itself delete separately stored files. If a legacy conversation ledger was imported, its source file is left in operational storage separately from database chat history; that legacy file ledger remains under its existing policy until explicit review, with no automatic deletion period defined here. We may retain limited records when needed for security, abuse prevention, legal obligations, or backups and operational recovery. Security and abuse-prevention records include signals such as IP address, user agent, registration IP, and device identifiers; these help protect accounts and enforce usage limits. Operational and error-monitoring logs may also contain request diagnostics, subject to the services and logging configuration enabled. The application does not define a general retention period for account records, security and abuse records, analytics, or backups; those durations depend on operational configuration and owner policy. Cached Scripture audio is shared content and is not tied to an account. Chat listen-aloud cache files are kept for about 14 days. Explore-pass records support its 24-hour / 5-message limit; no separate cleanup period is configured here. Optional server voice-transcription audio is processed for the request and is not kept by Lux as a permanent recording file; Lux does not promise that every intermediate copy in transit, logs, backups, or a transcription provider’s systems is erased on a fixed schedule. Resulting draft text follows ordinary Chat draft and conversation storage rules once you send a message.

When PAS retention enforcement is enabled, account-linked PAS detail events are retained for 90 rolling days, then rolled into anonymized monthly totals (UTC month, attempt counts, known cost micros, and unknown-cost attempt counts) with no user id, prompts, or media. Those anonymized monthly summaries are retained up to 12 full UTC calendar months after the source month, then deleted. Anonymized monthly totals are not linked to a user id, but in small user populations statistical re-identification risk cannot be ruled out. The 90-day PAS detail window does not mass-delete separate Create provider ledgers (LuxCreateProviderUsage and related job or charge records), older AIUsage quota or forensics rows, or other financial or forensic records; those follow separate lifecycle and financial controls. Copies in backups and operational recovery systems may persist beyond application-level PAS retention until those backups age out under ordinary operational lifecycle. Collection, reporting, and retention enforcement remain subject to product flags and any required consent after this notice is live.

9. International Data Transfers

Your data may be processed in the United States or other countries where we or our processors (Stripe, Apple, Google, Resend, IONOS, OpenAI when Premium chat or optional server voice transcription is used, and Sentry if enabled) operate. By using the Service, you understand that your information may be transferred to those locations.

10. Changes to This Policy

We may update this Privacy Policy. The “Last updated” date shows when it changed. For significant changes we will notify you by email or in the Service when practical.

11. Contact Us

Privacy questions: support@hrblux.com.