Privacy Policy

Last updated: 2026-11-05

Lūsis ("we", "our", "the app") is a private location-sharing app operated by Ellinor Labs LLC, a Washington State (USA) limited liability company ("Ellinor Labs", "the operator"). This policy explains what data Lūsis collects, how it's used, who it's shared with, and the choices you have.

Plain-English summary

The short version, in plain language, is:

• We do not sell your data. Ever. To anyone. This is not a "we won't for now" — this is the business model.
• We look at your data only to fix problems. During the beta, the operator can see members' recent locations and diagnostic events, and uses them only to find and fix problems with the app, such as location updates that stop. We also look at something in your account when you ask us for help with it. We never use what we see for anything else.
• We do not show you ads. No third-party advertising SDKs are in Lūsis.
• We do not run third-party analytics or tracking SDKs. No Google Analytics, no Firebase Analytics, no Segment, no Amplitude, no Mixpanel. We do log a small set of first-party diagnostic events on our own servers to find bugs and improve reliability and battery use — see "Diagnostic and product telemetry" below.
• This app is built for us too. We use Lūsis with our own loved ones. We're not looking to sell the company, and if we ever did, we would only do so in a way that preserves these privacy commitments for existing users.
• You own your data. You can view, update, or delete it at any time. Most of it is editable directly from the app's settings.
• Your location is only shared with the people you explicitly add to your shared circle. When you remove someone from your circle, they immediately lose access to your live location and any new check-ins.
• You can delete your account and everything in it at any time. Use Delete account in the app's Settings, or see our deletion page for details. If you can't sign in, email privacy@lusis.app from your account's email address with the subject "Delete my Lūsis account" and we'll wipe everything within 7 days.
• You must be at least 13 years old to use Lūsis. If you are under 18, you should have a parent or guardian's permission.

The rest of this document is the full legal version of the above.

Data we collect

Account data

When you sign up, we collect:

• Email address — for authentication and password recovery
• Display name — shown to other members of your shared circle
• Profile photo (optional) — shown to other members of your shared circle

Location data

When you enable location sharing, Lūsis collects:

• Latitude / longitude — your current position
• Altitude, speed, heading — reported by your phone along with your position
• Accuracy — how precise the position is
• Battery level and charging state — so your circle can see when your phone's battery is low
• Timestamp — when the position was recorded

Usage data

• Check-in messages — short one-tap messages (kisses, hugs, ETAs, "on my way") you send to people in your circle
• Saved places — named locations (home, school, gym) and their radii
• Place alerts — who in your circle asked to be told when you arrive at or leave a saved place

Technical data

• Device type (iOS or Android) and OS version — for compatibility
• App version — for bug triage
• Push notification token — so we can send notifications to your device; kept only while you're signed in

Activity and motion data

To save battery, Lūsis uses your phone's motion sensors to tell whether you're still, walking, cycling or driving. We don't store the sensor readings themselves. With each location point we store only the result: an activity label such as walking or driving and, on some phones, your step rate.

Crash and diagnostic reports

When the app crashes or hits an unexpected error, we collect a diagnostic report containing:

• Technical details of the error
• Device model and OS version
• App version
• Your user ID (a random identifier — not your email or name) — so we can tell whether the same user is hitting an error repeatedly

We do not deliberately include personal information in crash reports. Crash reports are handled by a crash-reporting service; see "Service providers" below.

In-app feedback

When you submit feedback through the in-app form, we store the text you typed, your user ID, and a timestamp. You can also choose to attach a screenshot. Screenshots get tighter handling than the text: any hidden information in the image, such as the place where a photo was taken, is removed before upload; the image is stored in a private area only the Lūsis team can access, and it is deleted within 7 days — or, if it's attached to a bug we are actively fixing, within 30 days at most. Before deleting a screenshot we may keep a short text note of the technical details it shows (an error message, a layout problem), written so it never includes members' names or locations.

We read feedback manually to triage bugs and improve the app. You can request deletion of any feedback you've submitted by emailing privacy@lusis.app.

Diagnostic and product telemetry

Lūsis logs a small set of diagnostic events on its own servers to find problems and improve reliability and battery use. These are first-party events — none of them are sent to any third-party analytics service. They cover things like the app starting and stopping, whether location sharing is working, permission settings, and errors.

Each event is stored with your user ID, the event name, a timestamp, and a small set of technical fields (typically: device state, an error message, or a location rounded to about 100 metres). We do not include the contents of check-in messages, the names of saved places, or your email in these events.

Beta waitlist signups (website)

If you ask for a beta invite on lusis.app, we store your email address, how you heard about Lūsis, the campaign tags of the link that brought you (if any), and the date. If you answer our follow-up email, we add your answers to the same record. We use this only to run the beta and to send you occasional Lūsis news. It is stored on our EU servers, separate from app accounts, and is never shared or sold. We keep it until you ask us to remove it by emailing privacy@lusis.app.

Permissions we request

• Location (foreground and background) — to share your location with your circle. Without it the app's core feature does not work. You can revoke this at any time in your phone's settings.
• Activity recognition — to tell whether you're moving, which saves battery.
• Photo library — only when you choose to set or change your profile picture. The app reads the photo you pick; it does not browse your library.
• Camera — only when you choose to take a new profile picture from inside the photo picker. The app does not record video and does not capture frames in the background.
• Notifications — to deliver check-ins and circle alerts.
• Foreground service (Android) — to keep sharing your location while the app is in the background.

How we use your data

We use the data above only to:

1. Show your location to members of your shared circle you've explicitly invited and who have accepted the invitation.
2. Deliver check-in messages from one circle member to another.
3. Send place alerts to the circle members who asked to be told when you arrive at or leave a saved place.
4. Operate the app — authentication, data sync, crash diagnostics, and minimal server-side logs required for service operation. We use a third-party crash reporter to be told when the app fails, but we do not use any analytics SDK, advertising SDK, attribution SDK, or behavioral tracker.

We do not use your data for:

• Advertising
• Profiling
• Sale to third parties
• Sharing with data brokers
• Training machine learning models

Legal basis (EEA, UK and Switzerland)

We process your data on these legal bases:

• Providing the service you signed up for (contract) — your account, sharing your location with your circles, check-ins, saved places and alerts, and emails about your account such as sign-in and password reset.
• Your consent — sharing your location in the background, which you give through your phone's location permission and the sharing switch in the app; and occasional Lūsis news if you asked for a beta invite. You can withdraw consent at any time.
• Our legitimate interest in keeping Lūsis reliable and secure — crash reports, diagnostic events and protecting the service from abuse. You can object by emailing privacy@lusis.app.
• Legal obligations — when the law requires us to keep or disclose information.

Where your data is stored

Account data, location history, check-ins, saved places, profile photos, push tokens, user-submitted feedback, and diagnostic event logs are stored by our hosting provider in data centers in the European Union. Data is encrypted at rest and in transit. Our hosting provider is our data processor: it processes data only on our instructions and does not use it for its own purposes.

Crash reports are stored separately by our crash-reporting service (see Service providers below).

Transfers outside the European Union

Your data is stored in the European Union. Ellinor Labs LLC is a US company, and some of the services we use (for example, to deliver push notifications and app updates, and to host our website) may process data in the United States or other countries outside the EU. When data leaves the EU, it is protected by the safeguards the law provides: the EU–U.S. Data Privacy Framework or the European Commission's Standard Contractual Clauses.

Service providers

Lūsis relies on a small set of third-party services to operate. Below we describe what each category of service receives.

• Backend storage and authentication. Stores everything described in "Data we collect" above (account data, location history, check-ins, saved places, profile photos, push tokens, user feedback, and diagnostic event logs). Hosted in the European Union, encrypted at rest and in transit.
• Crash and error reporting. Receives the diagnostic information described in "Crash and diagnostic reports" above (technical details of the error, device model, OS version, app version, and your user ID). We do not intentionally include your email, name, location data, or any check-in or feedback content in crash reports. As a hosted service, the crash reporter sees the network metadata of incoming requests (such as IP address) at delivery time; we configure the crash reporter not to include personal information in the reports it receives, but this transport-level metadata may still be briefly visible to its infrastructure.
• Operations alerts. When something in the service needs our attention, such as a failed background job or a feedback message you send us, a short notice goes to a private team chat. It can include your user ID or an internal label, technical details of the problem, and the text of your feedback.
• Push notification delivery. Receives the information needed to deliver notifications to your device, and the notifications' content — either a visible alert, or a silent request (no text, nothing shown on your screen) asking your app to share a fresh location. Notifications are delivered through your phone's own push notification service.
• App update delivery. When the app checks for updates, the update service sees your device's IP address, operating system and app version. No account information is sent.
• Maps. Serves the map displayed inside the app. The map service sees your IP address and which part of the map is in view. No account information is sent.
• Reverse geocoding (turning a latitude/longitude into a place name shown in the app). When the app shows a place name, the coordinates are sent to a place-name service. No account information is sent.
• Email delivery. Receives your email address and the emails we send you (for example, sign-in and password-reset emails). No location data is sent.
• Website hosting and abuse protection. Serves lusis.app and checks website forms for bots. It isn't used to track you.

We do not use any analytics, advertising, attribution, fingerprinting, or A/B-testing services.

Who can see your location

Your location is visible only to:

1. Members of the shared circle you created or joined, and only while you have location sharing enabled.
2. The operator, during the beta, only to find and fix problems with the app, and when you ask us for help with something in your account.

Your device may also receive a silent request to share a fresh location: when a member of your circle opens the map to see where you are, or when our server notices that your location has stopped updating. Nothing is shown on your screen, and your phone shares a fresh location only while your location sharing is on.

Your location stream is never sent to:

• Other users who are not in your circle
• Advertisers
• Data brokers
• Any third-party service other than the ones described in "Service providers" above (and only for the limited purposes described there).

Location history retention

Location points are retained while your account is active. You can delete your entire account and all associated data at any time using Settings → Delete account in the app (see "Account deletion" below).

Your rights

You have the right to:

• Access and export — a copy of all the data we hold about you, in a machine-readable format (JSON), on request
• Correct — most of your data (display name, profile photo, custom places) can be edited directly in the app's settings. For anything else, email privacy@lusis.app.
• Delete — your account and all associated data
• Restrict, object or withdraw consent — at any time you can turn off location sharing, leave a circle, delete your places or your account, or remove the app. For anything else, email privacy@lusis.app.

To exercise any right that isn't already self-service in the app, email privacy@lusis.app. We respond within 30 days.

You also have the right to complain to a data protection authority.

Account deletion

You can delete your account and all associated data directly in the app via Settings → Delete account. Live account data is deleted immediately; encrypted database backups may persist for up to 30 days before they are purged. If you can no longer sign in, email privacy@lusis.app with the subject line "Delete my Lūsis account" from the email address associated with your account, and we will complete the deletion within 7 days.

Upon deletion, we will remove:

• Your profile (display name, photo)
• All your location history
• All your check-ins (sent and received)
• Your place alerts: the ones you asked for, and the ones others asked for about you
• Your push notification token
• Your authentication record

Saved places belong to their circle. Places you added stay in the circle and are no longer linked to you. If you are the only member of a circle, the circle and its places are deleted too.

Changes to this policy

We will post any changes to this page and update the "Last updated" date above. If the changes are material, we will notify active users in-app before the changes take effect.

Contact

Questions or requests: privacy@lusis.app

Operator: Ellinor Labs LLC, Washington State, USA