Privacy Policy
Last updated: September 14, 2026
This Privacy Policy explains how Lulori handles information when you use the mobile app and this website. For privacy requests, contact us at waadrarii@gmail.com.
This website and the app are separate
This website has no signup, no photo uploads, no payments and no product analytics package added by Lulori. The hosting provider may process ordinary technical request logs, such as IP address and user agent, to serve and secure the pages. If you email support, the email service handles the message you chose to send.
The sections below describe data handling in the Lulori mobile app.
Sign in
The app uses Sign in with Apple on iOS and Sign in with Google on Android. The identity account is used for credits, purchases, consent and account settings. Generated portraits in My Portraits stay in the app on the device where they were created and do not sync through the account.
What the app handles
- Selected parent photos, baby photos, ultrasound scans and generated result images
- An account identifier, and the name or email you choose to share through Apple or Google
- AI processing consent status and consent version
- Purchase and credit records
- Product analytics and essential diagnostics
- A random app-installation identifier and, if you turn on completion notifications, an Expo push token and notification delivery records
- Support messages you send
Apple and Google process payment details. The app does not receive full card numbers.
Face data: collection, use, sharing, storage, retention and deletion
In this policy, face data means the source face photos and visible facial information in parent or baby photos that you choose to submit, visible fetal-face information in an ultrasound scan you choose to submit, and the generated portrait. Lulori collects a prepared copy only when you select or take a photo, give separate AI processing consent and request a generation. The suitability check returns only whether the image is accepted and, if rejected, a general reason. For an accepted ultrasound, it may also return broad visual cues: whether the mouth appears open, whether a hand is near the face and general head direction. These cues are used only for that generation and are not stored separately. Lulori does not use Apple TrueDepth or Face ID data and does not create or store faceprints, face embeddings, biometric identifiers, facial geometry or persistent facial-landmark records.
Lulori uses submitted face data only to check that the photo is suitable and safe for the selected feature and to create the portrait you requested. For Future Baby, visible features from two adult photos guide a fictional baby portrait. For My Little One, the submitted child's visible appearance guides a styled keepsake portrait. For Ultrasound Reveal, broad visual cues guide a fictional newborn-style portrait and are not used to infer identity, health, anatomy, gestational age or any medical finding. Lulori does not use face data for authentication, identity recognition or matching, advertising, marketing, profiling, analytics, data brokerage or training Lulori models.
Face data is shared only with two service providers needed to complete the generation: Supabase, which holds temporary copies in Lulori's private cloud storage and runs the backend, and OpenAI, which performs photo suitability and safety checks and generates the requested portrait. Supabase and OpenAI may process the data in countries other than your own. Prepared copies are transmitted using encrypted HTTPS connections. Lulori requires each service provider that handles face data to use it only for the limited app service the user consented to and to maintain the same or equivalent protection described in this policy. Lulori does not sell face data or send it to RevenueCat, PostHog, Sentry, Expo, advertising platforms or data brokers. Images, private image links and AI request bodies are excluded from Lulori's analytics and error reports.
Submitted source photos are scheduled for deletion from Lulori's private Supabase Storage immediately after processing ends. An upload that is never submitted, or whose processing cannot finish, is scheduled for deletion within about one hour. A generated portrait is held privately only for delivery. It is deleted from the service after Lulori successfully downloads it to My Portraits on your device, or scheduled for deletion if it remains undelivered for 24 hours. A service or worker outage may delay physical deletion. Deleted Supabase Storage image objects are permanently removed and are not part of Supabase database backups.
An original image in your photo library remains under your control and is not changed by Lulori. Lulori removes its prepared local input copy after submission, replacement or discard. After delivery, the generated portrait remains in Lulori's private app storage on that device until you delete it, sign out, delete the account, clear the app's storage or uninstall the app. A portrait you save to Photos or share outside Lulori is a separate copy under your control.
OpenAI states that API data is not used to train its models by default. Lulori does not opt in to share API data for training. OpenAI may retain submitted content in abuse monitoring logs for up to 30 days by default, or longer when required by law or necessary to protect its services or others. Images flagged by its safety systems may be retained for safety review. See OpenAI data controls documentation.
You can withdraw AI processing consent in Settings to stop new face-data processing and schedule remaining input copies for deletion. You can delete local portraits individually. Deleting your Lulori account immediately blocks access to hosted images and schedules remaining source and result copies for deletion. Copies already saved to Photos or shared outside Lulori must be deleted separately.
Optional completion notifications
Portrait completion notifications are optional. Lulori asks for system permission only after you choose Notify me during generation or turn the feature on in Settings. You can keep using generation without enabling notifications.
Each generation request includes a random installation identifier so a completion can be matched to the installation that created it. If you opt in, Lulori also associates that identifier and your signed-in account with an Expo push token. No push token is registered with Lulori before you opt in.
The service sends only a successful portrait-completion notice. The notification contains fixed Lulori wording and a portrait record identifier. It does not contain your photo, a private image link, generation mode, template, name or email. Lulori sends the token and this limited notification payload through Expo, which processes them on Lulori's behalf and passes the notification to Apple Push Notification service or Google Firebase Cloud Messaging for delivery. Expo states that it stores end-user push tokens to provide push notifications and does not store notification contents after the delivery process. See Expo's privacy explanation and push notification FAQ.
Service providers
- Supabase, for authentication, database, storage and server functions
- OpenAI, for photo checks and image generation
- RevenueCat, for purchase handling
- Expo, for optional portrait-completion notifications
- Apple, for identity on iOS, App Store purchases and iOS notification delivery
- Google, for identity on Android, Google Play purchases and Android notification delivery
- PostHog, for in app product analytics
- Sentry, for app diagnostics
No analytics package is installed on this website.
Why data is handled
To sign you in, to run and recover the generation you requested, to deliver its result to your device, to send an optional completion notice, to track credits and verify purchases, to understand feature usage and improve the app, and for security and support.
Product analytics runs automatically in signed beta and production builds. It uses app interaction events and an app-scoped identifier that can be linked to your account after sign-in. The app is designed to exclude images, private image URLs and AI request bodies from analytics and error reports. Session replay is disabled.
Your controls
- Withdrawal of AI processing consent
- Export of account metadata, which does not include image files
- Deletion of individual images from Lulori on that device
- Turning portrait-completion notifications on or off in Settings, plus notification controls in your device settings
- Account deletion instructions and email request
Withdrawing consent prevents new processing and schedules cleanup of input copies. It does not delete results you already saved.
Storage and retention
- Input copies are scheduled for cleanup after processing
- Abandoned inputs target cleanup within about one hour, subject to the background worker. This is a target, not a validated guarantee
- A generated result is held in private service storage only for delivery. After Lulori successfully downloads it into My Portraits on your device, the app asks the service to delete the hosted copy
- An undelivered generated result expires after 24 hours and is then scheduled for service-storage cleanup. Background-worker or provider outages can delay physical deletion
- Local drafts are removed after submission, replacement or discard. Private local state and device portraits are cleared after the service accepts an in-app account deletion request, or when you sign out. Save a portrait to Photos first if you want to keep it outside Lulori.
- While completion notifications are enabled, Lulori stores the Expo push token with the signed-in account and random installation identifier. Turning the feature off or signing out removes that active registration and cancels unfinished sends for that installation. Account deletion removes active push registrations and later removes associated delivery records with the account. Revoking system permission or uninstalling may not reach Lulori immediately; when the app next detects revoked permission it unregisters, and a provider response that the device is no longer registered disables the token. Disabled token rows and notification delivery records currently have no separate automatic expiry.
- Account deletion is asynchronous. After stored images are deleted, delivery caches may take a short time to refresh. Copies already downloaded, saved or shared outside Lulori must be deleted separately.
Limited purchase transaction identifiers are retained to prevent duplicate credit grants and handle refunds. No automatic expiry is currently configured for those records. Deletion from active service storage does not establish immediate deletion from provider backups or records retained under their own policies and legal obligations.
Photos you may upload
Only upload adult photos with the permission of the people shown. For a baby or child photo, you must be the parent or legal guardian or have authorization from the person with parental responsibility. Only upload an ultrasound scan you are authorized to use, and crop out names, dates, patient identifiers and other medical-record details before submission. Lulori is intended for parents and prospective parents and is not directed to children under 13. Users must be at least 13; users below the age of majority need a parent or guardian's permission. A child appearing in an authorized photo is not the account user.
Security
Private storage and access controls are used, but no method of transmission or storage can be guaranteed to be secure.
International processing and providers
Our providers may process information in countries other than your own. Their privacy policies explain their processing practices and contact options: Supabase, OpenAI, RevenueCat, Expo, Apple, Google, PostHog and Sentry.
Changes to this policy
We may update this policy as the service changes. Material changes will be explained here and through any notice required by applicable law.
Your rights and contact
Depending on where you live, you may have rights to access, correct, export or delete your information, or to restrict or object to processing. To exercise a right, ask about your information, or report an unauthorized child photo, contact waadrarii@gmail.com. We may need to verify account ownership before acting on a request. Do not send photos, identity documents, passwords or access tokens.