Lux Privacy Policy
This is a draft. The highlighted parts are still to fill in or confirm, and it needs a final review before Lux is submitted to the App Store.
Last updated: [date]
Lux suggests camera settings for a scene. You show it a photo of the scene and, if you like, a photo of the look you want. Lux sends them to an AI model, gets back three settings recipes, and forgets the photos.
This policy says what Lux handles, why, where, for how long, who else is involved, and what you can ask me to do about it. It applies to people using Lux in the United States, Canada, Australia and New Zealand.
Who runs Lux
Lux is made and run by me, Jack Zhao, an individual app developer, at [postal address]. I decide how and why your information is used, and I’m the person responsible for privacy at Lux.
Contact me about privacy at support@jackzhao.dev. This policy lives at https://jackzhao.dev/lux/privacy.
The short version
- Your photos are used for one request and then discarded. I don’t store them or the recipes. Lux’s AI provider, Microsoft, checks every request automatically for misuse of its service and keeps a copy only if a flagged request needs review by its staff. See “Photos and the AI model”.
- Your photos are not used to train AI models, by me or by Microsoft.
- Lux asks before it sends any photo. When you first open Lux, before the camera, it explains this and asks you to agree.
- There’s no sign-up. The app signs you in invisibly with a random guest ID. Lux doesn’t ask for your name, email or phone number.
- You can delete your data in the app, from the gear screen.
- Apple handles payment. I never see your card or your Apple Account details. I receive Apple’s confirmation of your subscription.
- No ads, no tracking, no analytics. I don’t sell or share your information for advertising, and Lux doesn’t track you across other companies’ apps or websites.
- Everything runs in the United States.
Your agreement
When you first open Lux, before the camera, a screen explains that your photos are sent to an AI model run by Microsoft and what happens to them, and asks you to tap Agree and continue. Lux sends no photo until you do. You can read that screen again from the gear screen.
By agreeing, you consent to Lux handling your information as this policy describes. You can withdraw your consent at any time by deleting your data in the app (see “Deleting your data”) and no longer using Lux. Lux can’t make recipes without sending your photos to the AI model.
What Lux handles, and why
Photos you send
When you ask for recipes, the app sends the scene photo and, if you chose one, the reference photo to Lux’s server. Before a photo leaves your phone, the app shrinks it and removes its hidden details, such as where and when it was taken and which camera took it.
The server checks the photos, shrinks them again, and sends them with Lux’s instructions to an AI model run by Microsoft. When the model’s reply comes back, or the request fails, the photos are discarded. They’re never saved to a database, file storage or logs.
Photos may show other people or places. Lux doesn’t try to recognise anyone in them.
The recipes you get
Recipes are sent to your phone and not kept on the server. The app keeps them only while you’re looking at them.
Your camera and lens
If you choose your camera and lens, the app remembers them on your phone and
sends their catalog IDs (such as canon-eos-r50) with each request, so the
recipes fit your gear. The server doesn’t store your gear against you. Its logs
record which camera and lens a request named, without your guest ID.
Gear you ask Lux to add
If your camera or lens isn’t listed and you type its name, the app sends the name, whether it’s a camera or a lens, the brand you were browsing, the camera you chose (for a lens) and the version of the app’s camera list. Lux stores that with the day it arrived and nothing else: no guest ID, no request ID, no IP address and no time of day. I can’t tell who sent it. Please don’t type anything about yourself into that field.
Your guest ID
The first time Lux needs it, the app signs in to Google’s Firebase service anonymously. This gives the app a random guest ID. Firebase App Check, using Apple’s App Attest, proves to the server that requests come from a real copy of the Lux app on an Apple device: the app sends Apple’s attestation to Firebase, which checks it with Apple and issues a short-lived token (at most 7 days) without keeping the attestation. Every request to the server carries the sign-in and App Check tokens. Lux uses the guest ID to connect your requests to your subscription and to enforce fair-use limits.
Your subscription
Apple sells the Lux subscription and takes payment. When you start, restore or change a subscription, the app sends Lux’s server Apple’s signed proof of your purchase, and the server asks Apple for its current status. Lux keeps:
- an identifier Apple gives your Apple Account for Lux (
appTransactionId), so your subscription works on your other devices and after reinstalling; - a random Lux subscriber number, which the app also gives Apple with new purchases so Apple’s records and Lux’s match;
- for each subscription: Apple’s transaction IDs, the plan (monthly or annual), whether you’re in the free trial, when it renews or expires, whether it will renew, and any billing grace period, refund or revocation;
- which guest IDs are connected to your subscription.
Apple also sends Lux’s server notifications when a subscription changes. Each one is kept until it’s processed; then its contents are deleted and only its ID and processing time are kept, so it isn’t processed twice.
Apple’s signed records also contain details such as your storefront country and the price you paid. The server reads them to check the proof but doesn’t store them.
Request records
For each recipe request, Lux records: your guest ID, your subscriber number, a random request ID, when it started, whether it succeeded or why not, how long it took, how many attempts it needed, how much of the AI model it used (in “tokens”), the model and instructions version, and whether a reference photo was included. Not the photos and not the recipes.
These records are used to enforce limits (one request at a time, and at most 15 a minute, per subscriber), to stop duplicate requests, and to understand failures. Lux also adds up, per subscriber and per day, how many requests you made and how much of the model they used, to see costs and spot misuse.
Service logs
The server writes a short log line when a recipe request finishes: the request ID, the outcome, timings, model usage, whether a reference photo was used, and the camera and lens IDs. Error logs record only the kind of error. Logs don’t include photos, recipes, your guest ID, purchase proofs or your IP address.
Analytics
Lux doesn’t use an analytics service, and the app contains no analytics or advertising code. If that changes, I’ll update this policy first.
Your IP address and device
Like any internet service, Lux’s server and its providers see the IP address your request comes from, and the app’s requests include standard technical details such as the app version. Lux doesn’t store your IP address, and its hosting is set up so that it isn’t logged either [confirm once prod is deployed]. Lux’s hosting provider, Microsoft, processes IP addresses for Lux to deliver and secure its service. Google’s Firebase keeps sign-in IP addresses for a few weeks for security. See “Who else is involved”.
On your phone
The app stores on your phone: your chosen camera and lens, the gear names you asked Lux to add (up to 10), and the Firebase sign-in, which iOS keeps in your phone’s keychain. Deleting the app removes the first two. [Check: whether the keychain sign-in survives reinstalling. “Delete my data” removes it either way.]
Photos and the AI model
Lux uses Microsoft’s Azure OpenAI service, running an OpenAI model hosted by Microsoft in its United States data zone, so your photos are processed only in the United States. Lux tells the service not to store its replies. Microsoft doesn’t use your photos or Lux’s requests to train AI models or to improve its products, and doesn’t share them with OpenAI.
To stop its service being misused, Microsoft automatically checks every request, photos included, for harmful content as it’s processed. If a request is flagged, Microsoft’s automated systems review it first and store nothing. Only if they can’t decide does Microsoft store the request, in the United States and separate from other customers’ data, so that authorised Microsoft staff can review it. Microsoft doesn’t publish how long it keeps such requests. It doesn’t know who you are: it sees only that the request came from Lux.
Who else is involved
Lux shares information only with these providers, who handle it for Lux under contracts that limit what they can do with it, and with Apple:
| Provider | What it does for Lux | What it handles | Where |
|---|---|---|---|
| Microsoft (Azure) | Hosts Lux’s server and database; runs the AI model | Everything the server handles, including photos during a request | United States (Central US region; US data zone for the AI model) |
| Google (Firebase Authentication and App Check) | Anonymous sign-in and app verification | Guest ID, sign-in tokens, IP address, App Attest data (checked with Apple, not kept) | United States for sign-in; App Check may use Google’s facilities elsewhere |
| Apple | Sells the subscription and takes payment | Your purchase; Apple’s own privacy policy applies | Apple’s systems |
Apple acts on its own account, not for Lux: its privacy policy covers your purchase and payment.
I may also disclose information if the law requires it, to protect people’s safety, or to a buyer of Lux if Lux is sold, who would have to follow this policy.
I don’t sell your personal information or share it for targeted advertising.
Where your information goes
Lux’s server, its database and the AI model are all in the United States, and so are Lux’s providers’ systems that handle your information. If you use Lux from Canada, Australia or New Zealand, your information is sent to and stored in the United States, where it may be accessible to US courts, law enforcement and national security authorities under US law. Lux’s providers are bound by contract to protect it.
How long Lux keeps it
| Information | How long |
|---|---|
| Photos | Only while your request is processed (seconds). Microsoft keeps a copy only of a request flagged for human review, for a period it doesn’t publish |
| Recipes | Not kept on the server |
| Request records (with guest ID and subscriber number) | 24 hours |
| Daily usage totals per subscriber | 90 days |
| Connection between a guest ID and a subscription | 30 days after that guest ID was last used |
| Subscription records | While your subscription is active, then 90 days after it ends. If you never subscribe: 90 days after you last used Lux |
| Apple notification contents | Until processed (normally seconds), then deleted |
| Apple notification IDs | 180 days after processing |
| Gear names you asked Lux to add | Kept, not linked to anyone |
| Service logs | 30 days |
| Firebase guest ID | Until you delete your data in the app [or: deleted automatically after [90] days unused] |
| Sign-in IP addresses (Google Firebase) | A few weeks |
| Database backups | Deleted records can remain in encrypted backups for up to 7 days |
If I need to keep something longer to deal with a legal claim, a legal duty or a security investigation, I keep only what’s needed, for as long as it’s needed.
Deleting your data
On the gear screen, tap Delete my data. It deletes what Lux’s server keeps for your phone and your invisible guest account. [Confirm against the delete contract: what’s kept about your subscription itself, rather than this phone, then expires on the schedule above.]
If you subscribe, deleting your data doesn’t cancel your subscription: it keeps billing through Apple until you cancel it. The screen links to Apple’s Manage Subscriptions, where you can cancel. If you use Lux again later, Restore Purchases brings your access back.
Deleting the app alone doesn’t delete what’s on the server, but it expires on the schedule above.
Your rights
You can ask me to:
- tell you what information Lux holds about you and give you a copy;
- correct it if it’s wrong;
- delete it;
- stop using it, by withdrawing your consent.
Email support@jackzhao.dev. I reply within 30 days (20 working days in New Zealand). Because Lux has no accounts and doesn’t know your name or email, I can only find your information if you give me something that identifies it, such as the receipt Apple emailed you for Lux [or your guest ID, if the app shows it]. “Delete my data” in the app works without that.
If you’re unhappy with how I’ve handled your information, contact me first and I’ll respond within 30 days. You can also complain to the privacy regulator where you live:
- Canada: the Office of the Privacy Commissioner of Canada (in Quebec, the Commission d’accès à l’information);
- Australia: the Office of the Australian Information Commissioner;
- New Zealand: the Office of the Privacy Commissioner.
Cancelling or refunding a subscription is done with Apple, in your Apple Account settings.
Children
Lux isn’t directed at children under 13 (under 14 in Quebec), and I don’t knowingly handle their information. If you think a child has used Lux, use “Delete my data” on their phone or contact me.
Security
Everything travels encrypted (HTTPS). Lux’s database and providers encrypt data at rest. Access to Lux’s systems is limited to me and anyone I authorise to help run it. Photos are held only in memory while a request is processed.
If a breach of Lux’s data is likely to cause you serious harm, I’ll tell you and the relevant regulator as the law requires.
Automated processing
Recipes are generated automatically by an AI model. They’re suggestions about camera settings; they aren’t decisions about you that affect your rights or interests.
United States residents
I don’t sell or share personal information for targeted advertising and haven’t done so in the past 12 months. Lux doesn’t respond to browser “Do Not Track” signals because it has no website tracking to turn off. [Add state-specific wording if a lawyer says any state law applies.]
Changes
If I change this policy, I’ll update the date above. If a change is significant, I’ll tell you in the app before it takes effect.
Contact
Jack Zhao, [postal address], support@jackzhao.dev.