Privacy Policy

1. Introduction

Start ("we," "us," or "our") is a habit-building and personal-growth application. This Privacy Policy explains what information we collect, how we use it, who we share it with, and the choices you have about your data. By using Start, you agree to the practices described in this policy.

This policy applies to all users of the Start web application at startwithlumi.com and any associated domains we operate.

2. Information We Collect

2.1 Account Information

When you sign in via email (OTP), we collect your email address. We do not collect passwords — authentication is handled through one-time codes sent to your email.

2.2 Profile & Onboarding Data

During onboarding, you may provide: your name, life stage, country, primary goal category, a personal goal description (your "2 AM realization"), your biggest obstacle, and self-reported daily energy and focus levels. This data is used to personalize your habit plan and coaching experience.

2.3 Usage Data

We store the habits we generate for you and your daily completion records (which habits you checked off and on which date). We store messages you send to Lumi (our AI coach) and Lumi's replies, to enable conversation history. Your current streak and last-active date are computed from your completion records.

2.4 Payment Information

Paid subscriptions are processed by Stripe. We never see or store your card number or full payment details. We receive a Stripe customer ID and subscription status that we store to determine your access level. Stripe's privacy policy governs how Stripe handles your payment data: stripe.com/privacy.

2.5 Push Notification Subscriptions

If you enable push notifications, we store your browser's push subscription token (endpoint URL and encryption keys) to deliver daily habit reminders. You can revoke this at any time in your browser settings or in the Start app settings page.

2.6 Technical & Log Data

Our hosting provider (Netlify) and database provider (Supabase) may automatically collect standard server log data such as IP addresses, browser type, and timestamps as part of normal infrastructure operations. We do not use this data for advertising or profiling.

3. How We Use Your Data

We use your information solely to operate and improve the Start service:

• To authenticate you — your email is used to send your one-time sign-in code.
• To personalize your habit plan — your goal, life stage, and country are sent to our AI model to generate habits tailored to you.
• To power Lumi — your goal context, current habits, and energy level are included in the prompt sent to our AI provider when you send a message.
• To track your progress — completion records are used to compute your streak and today's goal-completion percentage.
• To send reminders — if you opt in, we send push notifications at scheduled times (07:00, 13:00, 19:00, and 22:00 UTC) to remind you of your habits.
• To manage your subscription — Stripe webhook events tell us whether your Premium subscription is active.
• To send transactional emails — we use EmailJS to deliver OTP codes, welcome messages, and subscription confirmations to your email address.

We do not sell your data, use it for advertising, or share it with third parties for their own marketing purposes.

4. AI and Third-Party Processing

4.1 Primary AI Provider (OpenRouter)

When you use Lumi or generate a habit plan, your goal text, profile context, and chat messages are sent to OpenRouter (an AI routing API). OpenRouter may route requests to underlying models from providers such as Meta, Mistral, or others. OpenRouter's privacy policy applies to data sent through their API.

4.2 Fallback AI Provider (Pollinations.ai)

If our primary AI provider is unavailable, requests automatically fall back to Pollinations.ai, a free AI inference service. The same contextual data (goal, habits, message) is sent to Pollinations in this case. Pollinations.ai operates their own privacy policy. You can avoid this fallback by retrying your request after a short delay.

We do not send personally identifying information (name, email) to AI providers — only your goal description, life stage, country, and the content of your messages.

4.3 Database (Supabase)

All user data — profiles, habits, completions, chat messages, and OTP codes — is stored in Supabase (PostgreSQL). Supabase is hosted on AWS infrastructure. Data is encrypted at rest and in transit. Supabase's privacy policy is available at supabase.com/privacy.

4.4 Email Delivery (EmailJS)

Transactional emails (OTP codes, welcome messages, upgrade confirmations) are delivered via EmailJS. Your email address is shared with EmailJS solely to deliver these messages.

4.5 Hosting (Netlify)

The Start application is deployed on Netlify. Netlify may log standard request metadata as part of their infrastructure. Netlify's privacy policy is available at netlify.com/privacy.

5. Data Retention

We retain your data for as long as your account is active. OTP verification codes are deleted immediately upon successful verification or after expiry (typically 10 minutes). Chat messages are stored indefinitely to maintain your conversation history with Lumi, but you can request deletion at any time.

If you wish to delete your account and all associated data, please email us at info@mystarup.com. We will process deletion requests within 30 days.

6. Push Notifications

Push notifications are entirely optional. If you enable them, your browser push subscription token is stored in our database and used only to deliver habit reminders at the scheduled notification times (4 times per day). You can disable notifications at any time:

• In your browser settings (revoke notification permission for this site)
• In the Start app Settings page (toggle "Daily Reminders" off)

Revoking notification permission in your browser immediately prevents any further notifications. We will also remove your push token from our database when a notification delivery fails.

7. Cookies and Local Storage

Start uses browser local storage to remember minor UI preferences such as whether you have dismissed the daily recovery card. We use a Supabase authentication session cookie to keep you signed in between visits. We do not use advertising cookies or third-party tracking cookies.

8. Your Rights

Depending on your location, you may have the following rights regarding your personal data:

• Access — request a copy of the data we hold about you.
• Correction — request correction of inaccurate data.
• Deletion — request deletion of your account and all personal data.
• Portability — request your data in a portable format.
• Objection — object to certain types of processing.

To exercise any of these rights, contact us at info@mystarup.com. We will respond within 30 days.

9. Children's Privacy

Start is not directed at children under the age of 13. We do not knowingly collect personal data from children under 13. If you believe a child under 13 has provided us with personal data, please contact us at info@mystarup.com and we will delete it promptly.

10. Security

We implement reasonable security measures including encrypted data transmission (HTTPS/TLS), encrypted data storage (Supabase), and short-lived OTP codes for authentication. However, no system is completely secure. We encourage you to use a strong, unique email address and to revoke access if you believe your account has been compromised.

11. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will update the "Last updated" date at the top. For material changes, we will notify active users via email. Continued use of Start after a policy update constitutes acceptance of the revised policy.

12. Contact Us

If you have any questions or concerns about this Privacy Policy or how we handle your data, please contact us: