Lumehush

Privacy policy

Last updated 11 November 2026

Draft: this policy is written in plain language and has not yet been reviewed by a lawyer.

This policy explains what information the Lumehush website (lumehush.com) collects, why, and what you can do about it. "We" and "us" mean Lumehush, based in Alberta, Canada. We aim to follow Alberta's Personal Information Protection Act (PIPA) and Canada's Personal Information Protection and Electronic Documents Act (PIPEDA).

The short version

What we collect

When you join early access: your email address and the date and time you signed up.

To stop abuse of the sign-up form: a one-way hashed form of your IP address, kept for no more than 24 hours, so we can limit how many sign-ups come from one place. We don't keep your raw IP address with your email.

When you visit any page: our hosting provider, Cloudflare, processes standard technical information (such as your IP address, browser type and the page requested) to deliver the site and protect it from attacks. We don't use this to identify you.

What we don't collect: this site sets no advertising or analytics cookies, uses no third-party trackers, and loads no fonts or scripts from other companies.

How we use your email

We won't use it for anything else without asking you first. Every email we send includes a way to unsubscribe.

Consent

By entering your email and pressing "Notify me", you agree to us using it as described here. You can withdraw that consent at any time by unsubscribing or emailing us. This also meets Canada's anti-spam law (CASL): we only email people who asked to hear from us.

Who can see it

Only us, and the service providers that run the site for us:

These providers may store or process information outside Canada, including in the United States, where it may be accessible to authorities under local law. They may use it only to provide their service to us. We never sell or rent your information.

How long we keep it

We keep your email until you unsubscribe or ask us to delete it, or until 12 months after Lumehush launches, whichever comes first. Then we delete it. Hashed IP addresses used for rate limiting are deleted within 24 hours.

How we protect it

The site is served only over HTTPS, the database is not publicly accessible, and access is limited to us. No system is perfectly secure, but we take reasonable care and will tell you and the relevant regulator if a breach puts you at real risk of significant harm, as the law requires.

Your choices and rights

You can ask us to show you the information we hold about you, correct it, or delete it. Email us at privacy@lumehush.com and we'll reply within 30 days. If you're not satisfied with our answer, you can contact the Office of the Information and Privacy Commissioner of Alberta or the Office of the Privacy Commissioner of Canada.

The Lumehush app

This policy covers the website. The Lumehush desktop app, when it's released, has no account and no usage tracking: your library, profiles and watch history stay on your PC. The app only goes online to look up artwork and details (for example from TMDB, if you add your own key, or from music artwork services) and to check for updates. Those requests go straight to those services and don't include your library.

Children

This site isn't directed at children under 13, and we don't knowingly collect their information. If you think a child has signed up, email us and we'll delete it.

Changes

If we change this policy, we'll update the date at the top. If a change affects how we use your email, we'll tell you by email before it takes effect.

Contact

Questions or requests: privacy@lumehush.com.