Privacy Policy

Last Updated: April 1, 2026

This Privacy Policy describes how Lumetra LLC ("we," "us," or "our") collects, uses, and shares information when you use the Neon Bay service ("Service"). By using Neon Bay, you agree to the collection and use of information as described in this policy.

1. Information We Collect

1.1 Information You Provide

Account Information

When you create an account, we receive information from your chosen authentication provider:

Google Sign-In:

• Google account ID
• Email address
• Display name
• Profile picture URL

Apple Sign-In:

• Apple user ID
• Email address (if shared; Apple may provide a private relay address that forwards to your real email)
• Display name (if shared; Apple allows users to withhold their name)

Discord:

• Discord user ID
• Email address (if available)
• Username

Profile Information

You may optionally provide:

• Age
• Gender
• Gender preferences
• What you're looking for (connection type)

Conversation Data

We collect and store all messages you send to and receive from companions, including:

• Text messages
• Voice audio recordings and voice messages (duration, file location)
• Images you upload or share in conversations
• Timestamps
• Associated Neon Bay identifiers

AI Memory

We use an AI memory system (Engram) to automatically extract and store facts from your conversations to help AI companions remember details about you across sessions. Extracted facts may include personal preferences, interests, and relationship details you share during conversations. AI memory data is associated with your account and specific AI companion interactions.

Voice and Audio Data

If you use voice features, we collect and process audio data including:

• Voice recordings you send during voice calls or as voice messages
• Transcriptions of your voice input (processed by Deepgram, our speech-to-text provider)
• Audio generated by AI companions in response (synthesized by ElevenLabs or Google Cloud Text-to-Speech)

Voice audio is transmitted to third-party providers for real-time processing and is not retained by those providers after processing. Generated audio responses are stored with your conversation history.

Images and Media

If you upload images (in conversations or for Neon Bay creation), we collect and store:

• The image file
• AI-generated descriptions of images (for accessibility and content moderation, stored encrypted)
• A cryptographic hash (SHA-256) of each image for integrity verification

Uploaded images may be sent to Google Gemini for content analysis and description generation. Images you provide for Neon Bay profiles are publicly visible to other users.

1.2 Information Collected Automatically

Usage Data

We automatically collect:

• companions you interact with
• Favorites and skipped preferences
• Session duration and frequency
• Feature usage patterns

Device and Browser Information

• Browser type and version
• Device type and device name
• Operating system and app version
• IP address (for security and fraud prevention)
• Push notification tokens (for iOS, Android, and web push notifications), including associated platform and device metadata

Referral Data

If you participate in our referral program, we collect and store your personal referral code and the connection between your account and accounts you referred (or were referred by).

Biometric Authentication

If you enable biometric lock (fingerprint, Face ID, or similar), authentication is processed entirely on your device using your device's secure hardware. We do not collect, transmit, or store any biometric data.

Cookies and Similar Technologies

We use cookies for:

• Authentication (keeping you logged in)
• Security (CSRF protection)
• Session management
• Website measurement and marketing attribution (Google Analytics/Google tag and Reddit Pixel)

We also use third-party tracking technologies for analytics and attribution, including Google Analytics (Google tag) and Reddit Pixel. These providers may receive data such as page views, referral URLs, campaign parameters, device/browser metadata, and IP-based approximate location.

In consent-required regions, we present a cookie-consent banner where you can choose non-essential categories. You can also manage or block cookies in your browser settings and use ad privacy controls provided by Google and Reddit.

2. How We Use Your Information

We use collected information to:

2.1 Provide the Service

• Authenticate your identity
• Maintain your conversation history with companions
• Remember your preferences and favorites
• Personalize your experience

2.2 Improve the Service

• Analyze usage patterns to improve features
• Train and improve AI models
• Debug technical issues
• Develop new features

2.3 Ensure Safety and Security

• Detect and prevent fraud, abuse, and security threats
• Enforce our Terms of Service
• Comply with legal obligations

2.4 Communicate With You

• Respond to support requests
• Send service-related notifications, including push notifications that may contain brief conversation excerpts (truncated), AI companion names and images, engagement messages, and content generation status updates
• Send streak reminder notifications when your conversation streak is at risk of breaking (sent once daily; requires separate opt-in consent and can be disabled independently in Settings)
• Notify you of policy changes

You can manage push notification preferences per category in the app's notification settings, or disable push notifications entirely through your device settings. Certain notification types, such as streak reminders, require explicit opt-in consent and are controlled separately from other notification categories.

3. How We Share Your Information

We do not sell your personal information. We may share information in the following circumstances:

3.1 Service Providers (Subprocessors)

We use the following third-party services ("subprocessors") that may process your data:

3.2 Legal Requirements

We may disclose information if required by law or if we believe disclosure is necessary to:

• Comply with legal process or government requests
• Protect our rights, privacy, safety, or property
• Enforce our Terms of Service
• Protect against legal liability

3.3 Business Transfers

If we are involved in a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction.

4. Data Retention

4.1 Retention Period

We retain data for as long as your account is active, including:

• Account information
• Conversation history
• Preferences and settings
• Usage data

4.2 Data Use After Account Deletion

If you delete your account:

• Your profile will no longer be accessible
• You will not be able to log in or use the Service
• Your personal data (account information, conversation history, preferences, achievements, credits, and AI memory data) will be permanently deleted from our systems
• Financial records required for legal, tax, fraud, or dispute purposes (such as purchase, subscription, and dispute records) are retained in anonymized form for up to 7 years
• Anonymized and aggregated data that can no longer be linked to you may be retained for Service improvement and analytics
• User Content you created, including AI companions, descriptions, images, and other materials, will remain publicly available on the Service. This content persists to preserve the experience of other users who may be interacting with AI companions you created. The ownership link to your account will be removed. See our Terms of Service (Section 10.8) for more details.

4.3 Deletion Rights

All Users: You have the right to request deletion of your personal data. You can delete your account and all associated personal data through the Settings page in the app, or by contacting us at [email protected]. Upon deletion:

• All personal information, conversation history, relationships, preferences, achievements, and credits will be permanently removed
• Financial records that must be kept for legal, tax, fraud-prevention, or dispute reasons are retained only in anonymized form for up to 7 years
• Anonymized or aggregated data may be retained for analytics, fraud prevention, and Service improvement
• AI companions you created will remain available but will no longer be associated with your account

California Residents have additional rights under the CCPA/CPRA. See Section 12 for details.

4.4 Data Export

All users have the right to request a copy of their personal data. You can export your data through the Settings page in the app. Exports are available in machine-readable JSON format and include your profile, conversation history, relationships, achievements, and purchase records. Data export requests are limited to one per hour.

4.5 Legal Retention

We may retain and use limited data as required by law or for legitimate business purposes (e.g., fraud prevention, dispute resolution). For financial/accounting records (including purchase, subscription, and dispute history), we retain anonymized records for up to 7 years to satisfy tax and legal obligations. Such retention is limited to the minimum necessary for the stated purpose.

Error-monitoring telemetry processed by Sentry is retained for operational debugging and security purposes under our configured retention settings and contractual terms with Sentry. We do not enable default PII collection in Sentry SDK configuration.

5. Your Choices and Rights

5.1 Access Your Data

You can view your profile information and conversation history within the Service.

5.2 Update Your Information

You can update your profile preferences at any time through the Service.

5.3 Account Deletion

You may delete your account and all associated personal data through the Settings page in the app, or by contacting us at [email protected]. Account deletion is permanent and will remove your personal data as described in Section 4.

5.4 Your Rights

All users of the Service have the right to:

• Access: View your profile information and conversation history within the Service
• Export: Request a machine-readable copy of your personal data (see Section 4.4)
• Deletion: Request permanent deletion of your personal data (see Section 4.3)
• Correction: Update your profile preferences at any time through the Service
• Consent and Opt-Out Controls: Manage non-essential consent categories via our cookie banner (where shown), adjust browser cookie settings, and use provider controls for Google and Reddit advertising/measurement

California residents have additional rights under the CCPA/CPRA. See Section 12 for details.

6. Data Security

We implement reasonable security measures to protect your information, including:

• Encrypted data transmission (HTTPS/TLS)
• Secure authentication tokens
• Access controls and authentication for our systems
• Regular security assessments

However, no method of transmission or storage is 100% secure. We cannot guarantee absolute security of your data.

6.1 Data Breach Notification

In the event of a security breach affecting your personal information, we will notify affected users without unreasonable delay via email and/or in-app notification. For California residents, notification will be provided in accordance with California Civil Code § 1798.82. Breach notifications will include a description of the incident, the types of information involved, and steps you can take to protect yourself.

7. Children's Privacy

Neon Bay is strictly for users 18 years of age and older. We do not knowingly collect information from anyone under 18. If we learn that we have collected personal information from a user under 18, we will delete that information promptly. If you believe a minor has provided us with personal information, please contact us immediately.

8. Third-Party Links and Services

The Service may contain links to third-party websites or services. We are not responsible for the privacy practices of these third parties. We encourage you to read the privacy policies of any third-party services you access.

9. International Data Transfers

This Service is intended for users in the United States. While we do not actively block access from other countries, the Service is designed for and governed by United States law.

Your information may be transferred to and processed in countries other than your country of residence. These countries may have different data protection laws. By using the Service, you consent to the transfer of your information to the United States and other countries where we operate.

Users outside the United States access the Service at their own risk and are responsible for compliance with their local laws. We do not represent that the Service is appropriate or available for use in locations outside the United States.

10. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes by:

• Posting the updated policy on our website
• Updating the "Last Updated" date
• Sending you an email notification (for material changes)

Your continued use of the Service after changes constitutes acceptance of the updated policy.

11. Contact Us

If you have questions about this Privacy Policy or our data practices, please contact us at:

Lumetra LLC
c/o Scarff Law Firm, PLLC
3035 Island Crest Way Ste 201
Mercer Island, WA 98040
Email: [email protected]

12. California Privacy Rights (CCPA/CPRA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA).

12.1 Right to Know

You may request disclosure of the categories and specific pieces of personal information we have collected about you in the preceding 12 months.

12.2 Right to Delete

You may request deletion of your personal information. Upon receiving a verified request, we will delete your personal information from our records, except where retention is permitted by law, including:

• Completing a transaction or providing a service you requested
• Security and fraud prevention
• Compliance with legal obligations
• Internal uses reasonably aligned with your expectations
• Anonymized or aggregated data for research and AI training

12.3 Right to Correct

You may request correction of inaccurate personal information we maintain about you.

12.4 Right to Opt-Out of Sale/Sharing

We do not sell your personal information for money. We use third-party measurement and attribution tools (including Google Analytics/Google tag and Reddit Pixel) for analytics and marketing performance reporting.

To submit a “Do Not Sell or Share My Personal Information” request under the CPRA, contact us at [email protected] (opens in new tab) with “Do Not Sell or Share” in the subject line.

12.5 Right to Limit Sensitive Data Use

You may request that we limit our use of sensitive personal information (such as conversation content) to purposes necessary to provide the Service.

12.6 Non-Discrimination

We will not discriminate against you for exercising your CCPA rights. You will not receive different pricing or quality of service for making a request.

12.7 How to Submit a Request

To exercise your California privacy rights, contact us at:

Email: [email protected] (include "CCPA Request" in the subject line)

Please provide sufficient information to verify your identity (we will confirm the email address associated with your account). We will respond to verified requests within 45 days. If we need additional time, we will notify you of the extension.

12.8 Authorized Agents

You may designate an authorized agent to submit requests on your behalf. Authorized agents must provide written permission signed by you and may be required to verify their own identity.

12.9 Categories of Personal Information

In the preceding 12 months, we have collected the following categories of personal information:

By using Neon Bay, you acknowledge that you have read and understood this Privacy Policy.