Privacy Policy - Luana Home

1. Introduction

Convene Market LLC, doing business as Luana Home ("we," "our," or "us"), respects your privacy and is committed to protecting your personal data. This privacy policy explains how we collect, use, and safeguard your information when you use our family organization application and related services.

2. Information We Collect

Account Information

Email address (account owners)
Password (encrypted)
Household name
Family member names and profile information
Usernames for family member accounts (created by the account owner)
If you use Sign in with Apple, Apple's account identifier and any name or email Apple chooses to share

Usage Data

Routine and task information you create
Calendar events (when you connect your calendar)
Photos you upload for the screensaver feature
Device information for paired TVs

TV App Telemetry

When you open the Luana TV app, we record an initially anonymous install identifier and basic device info (platform, app version, locale, timezone, screen size) so we can measure how well our app works across different TVs. After a TV is paired, that identifier may be linked to the Luana household for product analytics and support.

Payment Information

Payment processing is handled by Stripe. We do not store your credit card information directly. Please refer to Stripe's privacy policy for information about how they handle your payment data.

Marketing Attribution Data

When you visit our site, we may collect and store the following. Some of it only exists if you arrived from an ad or a shared link:

Campaign identifiers from the URL (UTM parameters such as utm_source, utm_campaign, utm_content)
Ad-platform click identifiers (Reddit rdt_cid, Meta fbclid, Google gclid) if the referring ad platform attaches them to the landing URL
The referring site (origin only — we do not store the full referring URL)
The first page you landed on and the time of your first visit

This information is stored in a first-party cookie (luana_attribution) for up to 30 days and, if you create an account, attached to your household record. We use it to measure which marketing channels and campaigns bring new customers, not to track you across other websites. You can delete this cookie at any time via your browser settings.

Our advertising partners also set first-party cookies on this site: _fbp and _fbc for Meta (up to 90 days) and _rdt_uuid for Reddit. These identify your browser to those platforms so that a later signup or subscription can be matched to the ad you clicked. Section 5 describes what we share with each platform. You can delete these cookies at any time via your browser settings.

Referral and Creator Links

If you arrive at Luana through a friend's referral link or a creator's partner link (for example, a link shared by a family influencer we work with), we store the referral code in a first-party cookie (luana_referral) for up to 90 days. If you create an account within that window, your household is associated with the person who referred you so we can credit them (for example, with a commission on your subscription payments).

A creator who referred you can see only anonymous information about the families they referred: a pseudonymous code name we generate, whether the account is in a free trial, subscribed, ending, expired, or canceled, the date the trial started and the date it ends, how many months the account has been subscribed, and the commission they have earned from it. They never see your name, email address, location, family members, the contents of your account, or any other personal information. You can delete the referral cookie at any time via your browser settings.

3. How We Use Your Information

We use your information to:

Provide and maintain our service
Display your routines, calendar events, and photos on your TV
Process your subscription payments
Send important service notifications
Improve our application and user experience
Respond to your support requests

4. Data Storage and Security

Your data is stored securely using Supabase, which provides enterprise-grade security including encryption at rest and in transit. We implement appropriate technical and organizational measures to protect your personal data against unauthorized access, alteration, disclosure, or destruction.

5. Third-Party Services

We integrate with the following third-party services:

Google Calendar: If you choose to connect your Google Calendar, we access your calendar events to display them on your TV. We only read calendar data; we do not modify your calendar. You can disconnect your Google Calendar at any time from your dashboard settings or from your Google Account permissions page at myaccount.google.com/permissions. We do not share or sell your calendar data to third parties. When you disconnect, cached calendar data is deleted within 24 hours.
Apple Calendar (iCloud): If you choose to connect your Apple Calendar, we access your calendar events via iCloud to display them on your TV. We only read calendar data; we do not modify your calendar. Connection requires an app-specific password generated from your Apple ID settings. You can disconnect your Apple Calendar at any time from your dashboard settings, or revoke access by deleting the app-specific password at appleid.apple.com. We do not share or sell your calendar data to third parties. When you disconnect, cached calendar data is deleted within 24 hours.
Microsoft Outlook: If you choose to connect your Outlook calendar, we access your calendar events via Microsoft Graph API to display them on your TV. We only read calendar data; we do not modify your calendar. You can disconnect your Outlook calendar at any time from your dashboard settings or from your Microsoft account permissions page at account.microsoft.com/privacy/app-access. We do not share or sell your calendar data to third parties. When you disconnect, cached calendar data is deleted within 24 hours.
Other Calendars (ICS): You may connect other calendar services by providing an ICS feed URL. ICS is a standard calendar format supported by most calendar applications. When you provide an ICS URL, we periodically fetch calendar events from that URL to display on your TV. We only read the data provided by the ICS feed; we cannot modify your source calendar. You can disconnect any ICS calendar at any time from your dashboard settings. We do not share or sell your calendar data to third parties. When you disconnect, cached calendar data is deleted within 24 hours.
Google Photos: If you choose to connect your Google Photos account, we use Google's Picker API to let you select photos to display on your TV screensaver. Selected photos are downloaded, optimized, and stored in your private Luana storage. We do not access your full photo library — only the photos you explicitly select. We store an OAuth token to maintain your connection; this token and all imported photos are deleted when you disconnect. We do not use your photos for advertising, analytics, or any purpose other than displaying them on your household TV. You can disconnect Google Photos at any time from your dashboard, or revoke access from your Google Account at myaccount.google.com/permissions. Luana's use of Google Photos data complies with the Google API Services User Data Policy, including the Limited Use requirements.
Sign in with Apple: If you choose this sign-in method, Apple verifies your Apple account and may provide your name, email address, or a private relay address. We store Apple's provider identifier to recognize the same sign-in without using email as the account key. We retain the provider credential needed to revoke Luana's Apple access when your account is permanently deleted; it is not returned to Luana clients and is removed after revocation.
Amazon Alexa: See Section 6 below for details on our voice assistant integration.
Stripe: For payment processing and subscription management.
Open-Meteo: For weather data displayed on your TV (no personal data is shared).
Meta (Facebook) Pixel & Conversions API: We use Meta's pixel and Conversions API to measure the effectiveness of ads we run on Facebook and Instagram. The pixel sets first-party cookies (_fbp, and _fbc if you arrived from a Meta ad) and reports your page views to Meta. These reports are not anonymous. They include your IP address, browser user agent, and those cookie identifiers, which Meta uses to recognize the visit. When you sign up or subscribe, we send a matching event from our own servers so the conversion is still recorded if the pixel is blocked, including a hashed (one-way) version of your email address and account ID. We never send Meta your name, your postal address, or your email address in readable form. You can learn more in Meta's privacy policy.
Reddit Pixel & Conversions API: We use Reddit's pixel and Conversions API to measure the effectiveness of ads we run on Reddit. The pixel sets a first-party cookie (_rdt_uuid) and reports your page views to Reddit. These reports are not anonymous. They include your IP address, browser user agent, and that cookie identifier, which Reddit uses to recognize the visit. When you sign up or subscribe, we send a matching event from our own servers so the conversion is still recorded if the pixel is blocked, including a hashed (one-way) version of your email address and account ID. We never send Reddit your name, your postal address, or your email address in readable form. You can learn more in Reddit's privacy policy.

6. Voice Assistant Integration (Amazon Alexa)

Luana integrates with Amazon Alexa through the "My Luana" skill, allowing you to check routine status, mark tasks complete, and access calendar information using voice commands.

How Voice Commands Work

When you speak to Alexa, your voice is processed entirely by Amazon's systems. Luana does not receive, process, or store any audio recordings. We only receive a text interpretation of your request (for example, "how are the kids doing") after Amazon has processed your voice.

Data Accessed by the Alexa Skill

When you use the My Luana skill, we access the following data from your Luana account to respond to your requests:

Family member names
Routine names and completion status
Calendar events and schedules

Account Linking

To use the Alexa skill, you must link your Luana account using secure OAuth 2.0 authentication. This creates a secure connection between your Alexa account and your Luana household. You can unlink your account at any time through the Alexa app, which immediately revokes the skill's access to your Luana data.

Voice Data Storage

Luana does not store voice recordings. All voice processing is handled by Amazon. We only log text-based request data (what you asked) for troubleshooting and service improvement purposes. For information about how Amazon handles your voice data, please refer to the Alexa Privacy Settings and Amazon Privacy Notice.

Disabling Voice Access

You can disable voice access to Luana at any time by:

Disabling the My Luana skill in the Alexa app
Unlinking your account in the Alexa app's skill settings
Saying "Alexa, disable My Luana skill"

7. Data Retention

We retain your personal data for as long as your account is active, or as needed to provide you services.

When a primary owner requests account deletion, the household is paused immediately and enters a seven day grace period during which the owner can sign back in and restore it. Nothing is deleted during that window. After seven days the deletion is permanent and cannot be undone.

Permanent deletion removes your household's personal data from our active systems: names, email addresses, photos, messages, calendar events, family member profiles including any ages you entered, routines, rewards, device pairings, and connected calendar or photo credentials. An adult who is not the primary owner can disconnect their email login immediately; their family profile, stars, and activity history stay with the household. Children do not have a self-service deletion option.

We keep a record that the account existed, in a form that cannot be linked back to you or your family. This record contains no names, email addresses, photos, messages or other content, and no street address or precise location. It holds only aggregate facts we use to understand our business, such as the month the household signed up, how many adults and children were in it, the age ranges of children, the country, which TV platforms were used, the subscription plan and payment totals, and the reason given for leaving. We retain this indefinitely.

If you write a comment when deleting your account, we keep it for up to 180 days so we can read and act on it. It is stored separately from the record above, with no link to your household, and is deleted automatically after 180 days.

Deletion applies to our active systems. Encrypted backups are retained on a rolling schedule for disaster recovery and age out on their own. If a backup is ever restored, deleted data is removed again.

We may retain certain financial and transaction records where required for accounting, tax, fraud prevention, or other legal obligations.

8. Data Security and Breach Notification

We implement appropriate technical and organizational measures to protect your personal data. In the unlikely event of a data breach that affects your personal information, we will notify affected users within 72 hours of becoming aware of the breach, as required by applicable law. Notification will be sent to the email address associated with your account.

9. Your Rights

You have the right to:

Access your personal data
Correct inaccurate data
Request deletion of your data
Export your data
Withdraw consent for optional data processing

To exercise these rights, please contact us at support@myluanahome.com, or visit our account deletion page to request data or account deletion.

Any person whose information appears in a Luana household may request erasure by emailing support@myluanahome.com. We verify the requester's identity or, for a child, the authority of their parent or guardian, and respond within one month.

A primary owner's deletion request pauses the household immediately and can be restored for seven days before permanent deletion. An adult who is not the primary owner disconnects only their email login; their family profile and history remain with the household. Section 7 describes exactly what is deleted, what is retained in anonymized form, and for how long.

10. Children's Privacy

Our service is designed for family use, including children. We take the privacy of children seriously and comply with the Children's Online Privacy Protection Act (COPPA).

Family Member Accounts

Account owners (parents or guardians) can create login accounts for family members, including children under 13. These accounts are created and managed entirely by the parent — children cannot create their own accounts. The parent sets the child's username and password.

Information Collected from Children

When a child uses a family member account, we collect only the minimum information necessary to provide the service:

Username (created by the parent)
Display name and optional profile photo (set by the parent or child)
Routine completion activity (which tasks were marked done)
Star balance and reward history
Calendar events they assign themselves to

We do not collect email addresses, phone numbers, physical addresses, or any other contact information from children. We do not use children's data for advertising or marketing purposes.

Parental Consent

Parental consent is obtained through the account creation process. Only the account owner (parent or guardian) can create family member accounts, and doing so requires an active paid subscription with verified payment information. The parent's creation of a child's account constitutes verifiable parental consent for the collection of the child's information as described above.

Parental Rights

Parents have full control over their child's account and data. At any time, a parent can:

Review their child's activity (routines, stars, calendar) from the parent dashboard
Change their child's username or reset their password
Remove their child's login (the child can no longer sign in, but their routine history and stars are preserved)
Delete their child's family member profile entirely, which removes all associated data
Delete the entire household account, which removes all family data

To exercise these rights, parents can use the Family page in their dashboard, or contact us at support@myluanahome.com.

11. Changes to This Policy

We may update this privacy policy from time to time. We will notify you of any changes by posting the new privacy policy on this page and updating the "Last updated" date.

12. Contact Us

If you have questions about this privacy policy or our data practices, please contact us at:

Convene Market LLC
Email: support@myluanahome.com