Privacy Policy

1. Introduction

LumiList ("we", "our", or "us") respects your privacy and is committed to protecting your personal data. This privacy policy explains how we collect, use, and safeguard your information when you use our Chrome extension bookmark manager.

By using LumiList, you agree to the collection and use of information in accordance with this policy.

2. Information We Collect

Bookmark Data

We collect and store the bookmarks, boards, and pages you create within LumiList. This includes:

• Titles, URLs, and descriptions of bookmarks
• Structure and organization of boards and pages
• Custom backgrounds or icons associated with your items

Google User Data

To provide cloud synchronization features, we use Google OAuth for authentication. When you choose to sign in, we collect:

• Your email address
• Your basic profile information
• An authentication token to verify your identity

Trial Eligibility Data

To enforce the one-trial limit, we create pseudonymous identifiers using a keyed cryptographic transformation of your verified email address and, where available, your Google account identifier. We do not store the original email address or Google identifier in the trial eligibility record. The record also contains the relevant trial or paid-access dates.

Technical Data

We may collect anonymous technical information about how the extension is performing, such as crash reports or sync errors, to help us improve the Service.

3. How We Use Your Information

We use the collected information for the following purposes:

• To provide and maintain the Service
• To synchronize your bookmarks across devices (if cloud sync is enabled)
• To notify you about changes to our Service
• To provide customer support
• To monitor the usage of the Service
• To detect, prevent, and address technical issues
• To prevent repeated free-trial abuse and protect the subscription service

Where applicable, we rely on our legitimate interests to prevent abuse, protect the integrity of the subscription service, and keep the trial available on fair terms. You may object to this processing by contacting us. We will consider your circumstances and any applicable overriding legitimate grounds.

4. Data Storage

• Local Storage: All bookmark data is stored locally in your browser using IndexedDB
• Cloud Sync: When signed in, data is synced to our secure cloud servers hosted on Supabase
• Third-Party Services: We use Supabase for database hosting and Google for authentication

5. Third-Party Services

LumiList uses the following third-party services:

• Google OAuth: For secure authentication without password handling
• Supabase: For secure cloud database storage
• Razorpay: For payment checkout, saved payment-method management, and subscription recovery when you choose a paid plan
• Meta and Reddit: For optional advertising measurement on website marketing pages only when you allow analytics

6. Cookies and Similar Technologies

Our website uses cookies, local storage, session storage, pixels, and similar browser technologies for the following purposes:

• Essential website functions: We use necessary storage for security, contact-form spam prevention, admin sessions, extension handoff, subscription checkout, and requested payment flows.
• Marketing measurement: If you choose "Allow analytics" on website marketing pages, we may load Meta Pixel and Reddit Pixel to measure ad performance, install clicks, and subscription conversions.
• Marketing attribution: If you allow analytics, we may store campaign parameters such as UTM or ad click identifiers in browser storage so we can understand which marketing pages led to installs or purchases.

Marketing pixels and marketing attribution storage are not loaded before you allow analytics. If you reject analytics or your browser sends a Global Privacy Control signal, LumiList keeps marketing pixels disabled. You can reopen the cookie banner from the "Cookie choices" link on pages that use marketing measurement.

Third-party services such as Razorpay may use their own cookies or similar technologies when you interact with their checkout or payment-management flows. Their use is governed by their own policies.

7. Chrome Extension Permissions

LumiList requires certain browser permissions to function. Here's why we need each:

We only use these permissions for the stated purposes. We do not track your browsing history or collect data from websites you visit.

8. Data Retention

• Active Accounts: Your data is retained as long as your account is active
• Deleted Items: When you delete bookmarks, boards, or pages, they move to Trash and are automatically permanently deleted after 30 days
• Account Deletion: You can delete your account in the extension or contact our support team for help with account deletion requests. To delete your account in the extension, open LumiList, go to Settings, then Account, then choose Delete Account. Your bookmark workspace, sync data, profile, and active subscription record are deleted. Limited billing and tax records may be retained where legally required. A pseudonymous trial eligibility record may be retained under our legitimate interests for 24 months after the later of your trial end date or latest successfully paid access end date.

Local data stored in your browser's IndexedDB can be cleared at any time through your browser settings or by uninstalling the extension.

9. Your Rights

You have the following rights regarding your data:

• Access: All your bookmark data is visible directly in the extension. You have complete visibility into what data we store.
• Deletion: Delete individual items through the extension, delete your account in the extension by opening LumiList, going to Settings, then Account, then choosing Delete Account, or contact support for help with deletion requests.
• Export: Signed-in users can download a JSON bookmark portability export from the extension. This export includes bookmark titles, URLs, descriptions, page and board context, ordering, and item timestamps.
• Correction: Edit any of your bookmarks, boards, or pages directly within the extension.
• Objection: You may object to processing based on legitimate interests, including the limited trial eligibility record, by contacting support.

For full account, billing, or legal-retention data requests, contact support. We will respond to valid privacy requests in accordance with applicable law.

10. Security

We implement appropriate security measures to protect your data:

• Encryption in Transit: All data transmitted between your browser and our servers uses HTTPS encryption
• Database Security: Row Level Security (RLS) ensures users can only access their own data
• No Password Storage: We use Google OAuth for authentication, so we never store or handle your passwords
• Secure Infrastructure: Our database is hosted on enterprise-grade cloud infrastructure with regular security updates

11. Children's Privacy

LumiList is not intended for use by children under the age of 13. We do not knowingly collect personal information from children under 13. If you are a parent or guardian and believe your child has provided us with personal information, please contact us so we can delete such information.

12. Changes to This Policy

We may update this privacy policy from time to time. We will notify you of any significant changes by:

• Posting the new policy on this page with an updated "Last updated" date
• Displaying a notice within the extension for material changes

We encourage you to review this policy periodically for any changes.

13. Contact Us

If you have any questions about this Privacy Policy or our data practices, please contact us: