Privacy Policy
Effective Date: 2026-06-01
1. Introduction
This Privacy Policy describes how Wayn Inc. ("Wayn," "we," "us," or "our") collects, uses, stores, and shares information in connection with the Lume mobile applications, websites, and related services (the "Service"). It also describes the rights and choices available to parents and children with respect to that information. Lume is directed to families with children approximately 5 to 12 years old in the United States. Because the Service is directed to children, Wayn complies with the U.S. Children's Online Privacy Protection Act ("COPPA") and applicable state laws. Account creation, profile setup, payment, and management are performed exclusively by a parent or legal guardian (the "Parent Account Holder"). Children do not register for or sign in to Lume independently.
For questions about this Privacy Policy or your privacy rights, contact us at connect@wayn.co.
2. About Lume and How It Uses YouTube
Lume is a curation and child-safety service that organizes, filters, and presents video content from YouTube using YouTube's official APIs (the "YouTube API Services"). Lume uses YouTube's official embedded player to display videos. The Service relies on the YouTube API Services, and your use of YouTube content through Lume is also governed by the YouTube Terms of Service and the Google Privacy Policy.
Lume does not host, own, or control the underlying YouTube videos, ads, or recommendations. The Lume safety pipeline applies algorithmic and rules-based filters to limit kid-inappropriate content, but no filter is perfect, and YouTube serves ads through the embedded player that Wayn does not control.
3. Information We Collect from Parents
When a Parent Account Holder creates and uses a Lume account, we collect the following:
Information you provide directly. Email address, account password (stored as a salted hash, not in plain text), parent display name (optional), and the child profile information you create. If you contact us for support, we collect the content of your communications and any information you provide in them.
Payment information. Lume subscriptions are processed through Apple, Google, or another authorized payment processor. We do not receive or store full credit card numbers. We receive limited subscription metadata from the payment processor — such as subscription status, the plan you purchased, the date of purchase, the country of purchase, and a tokenized identifier — that we use to provision and manage your subscription.
Device and usage information. We collect technical information about the device and software you use to access the Service, including device model, operating system and version, app version, language preference, time zone, IP address (used to derive approximate region for service delivery and security), and crash and diagnostic data.
Communications. If you opt in to receive marketing or product communications from us, we collect your preferences and the metadata of those communications (e.g., open and click events). You may unsubscribe at any time.
4. Information We Collect from Children
We have designed Lume so that children's information collection is minimized and is controlled by the Parent Account Holder. The child information collected within the Service is limited to:
Child profile information set by the parent. A profile name (the parent may use a nickname rather than a real name), an approximate age or age range, content category preferences from Lume's onboarding taxonomy, and an avatar selection. We do not require a real name, address, phone number, photograph, or other identifying information for a child profile.
Limited in-app activity associated with the child profile. Within a child profile, we record information needed to deliver the Service and to improve Lume's curation and safety filtering for that profile. This may include: which videos were served to the profile, which videos were watched (and for how long), parent-applied likes/blocks on specific videos or channels, screen-time totals, and basic interaction events with Lume's interface (such as taps on category tiles).
We do not collect from children: persistent geolocation, contact information, photographs or video recorded by the child, voice recordings, contacts, microphone or camera input, or personally identifying information beyond what the parent enters in the child profile.
We do not allow children to: create their own account, communicate with other users through Lume, post comments, upload videos, share content publicly, or interact with social features. The Service does not provide any chat, social network, or user-generated content functionality directed to or accessible by children.
5. How We Use Information
We use the information described above to:
* provide, operate, secure, and improve the Service, including the safety pipeline that filters which videos are surfaced to a child profile;
* authenticate you, prevent fraud, enforce our Terms of Service, and protect the integrity of the Service;
* provision, bill, and manage your subscription;
* respond to your inquiries and provide customer support;
* send transactional communications (such as receipts, security notices, and service announcements) and, where you have opted in, product or marketing communications;
* understand how the Service is used in aggregate so we can improve it (for example, which content categories are most engaged with);
* comply with our legal obligations, including COPPA and applicable state laws; and
* enforce these Terms and respond to legal process.
We do not use children's information to serve behavioral or interest-based advertising, and we do not permit our third-party service providers to do so. We do not sell children's information.
6. Third-Party Service Providers
Lume relies on a limited set of third-party service providers to operate. These providers process information on our behalf, subject to contractual data-protection commitments, and only as needed to perform the services we have engaged them for.
YouTube API Services (Google LLC). Lume uses the YouTube Data API and YouTube IFrame Player API to discover, filter, and display videos. When a video is played, YouTube serves the video stream and any associated ads directly to the user's device through its embedded player. Your use of YouTube content through Lume is also subject to the YouTube Terms of Service and the Google Privacy Policy. Lume registers as a "Child-Directed API Client" with YouTube and instructs YouTube not to serve personalized or behavioral advertising to kid profiles.
AppsFlyer (Mobile measurement and attribution). Lume uses AppsFlyer's SDK to measure app installs, track in-app events, and understand campaign attribution. AppsFlyer is configured as a child-directed app and does not serve behavioral advertising to child profiles. Data sent to AppsFlyer includes:
- In-app events: video watched, content preferences selected, trial started, registrations completed, and parent PIN setup
- Device technical data: device model, operating system version, app version, language, and time zone
- Campaign source: which ad or channel led to the app install
- IP address: masked before transmission (not used for precise location tracking)
AppsFlyer does not receive the child's name, profile information, or personally identifying data. AppsFlyer acts as our data processor under a binding data protection agreement and does not sell this data to advertisers or use it for behavioral targeting. See AppsFlyer's Privacy Policy at https://www.appsflyer.com/privacy-policy.
Anthropic (Claude API). Lume uses Anthropic's Claude API as part of its content-safety pipeline to evaluate video metadata (titles, descriptions, and where permitted, transcripts) against Lume's seven-question safety screen. To screen each video, we send Anthropic the search query along with the video's title, description, and transcript. We do not send your child's name, profile, or account details. Anthropic acts as our data processor under binding data-protection commitments, does not use this data to train its models, and does not sell it.
App stores and payment processors. Apple's App Store, Google Play, and any other authorized payment processor handle subscription billing. Their handling of payment information is governed by their respective privacy policies.
Hosting, monitoring, and analytics. We use standard commercial hosting providers (e.g., for our backend servers and databases), error-monitoring tools to detect and diagnose crashes, and aggregated analytics to understand usage. Where used in kids' contexts, analytics tools are configured to disable personalized advertising features and to minimize the data collected.
We will list the specific service providers we use in this Section and keep the list current. The current list as of the Effective Date is:
* Google (YouTube API Services, Firebase for crash reporting in a configuration that disables advertising features)
* Apple (App Store billing and TestFlight)
* Google Play (Android billing)
* AppsFlyer (mobile measurement and attribution)
* Anthropic (Claude API for safety pipeline)
* [Hosting provider, e.g., Render / AWS / Fly.io — confirm and update]
* [Email service provider, if used]
7. When We Share Information
We share information only as described below.
With service providers as described in Section 6, to operate and improve the Service.
With legal authorities when we have a good-faith belief that disclosure is necessary to comply with a valid legal process (such as a subpoena or court order), to protect the safety of any person, to address fraud, security, or technical issues, or to protect Wayn's rights or property.
In connection with a corporate transaction. If Wayn is involved in a merger, acquisition, reorganization, financing, or sale of assets, information may be transferred as part of that transaction, subject to the protections described in this Privacy Policy. We will notify you (and where required, obtain consent) before any material change in how your information is handled.
With your consent. We may share information for other purposes with your consent or at your direction.
We do not sell or rent personal information of parents or children, and we do not share personal information for cross-context behavioral advertising.
8. Children's Privacy and COPPA
Wayn is the "operator" with respect to the Service for purposes of COPPA. This section sets out the rights of the Parent Account Holder under COPPA.
Notice to parents. This Privacy Policy serves as our COPPA notice. We collect from a child profile only the limited information described in Section 4. Profile creation, content settings, and any account changes are performed by the Parent Account Holder.
Verifiable parental consent. Before any child profile is created or used, the Parent Account Holder must create and authenticate a Wayn account and accept these Terms and this Privacy Policy. We treat the parent's authenticated account, combined with payment-method verification through Apple, Google, or another authorized payment processor, as verifiable parental consent for the limited information collection described in Section 4. We will request additional verifiable parental consent if we ever change our practices in a way that would require it under COPPA.
No conditioning of participation. A child's use of Lume is not conditioned on the disclosure of more personal information than is reasonably necessary to participate.
Parental rights. As the Parent Account Holder, you have the right to:
* review the personal information we have collected about your child;
* request that we delete that information;
* refuse to permit further collection or use of your child's information; and
* revoke any consent previously provided.
You can exercise these rights at any time through the in-app parent dashboard or by contacting connect@wayn.co. When you delete a child profile or your account, we will delete the associated child profile data from our active systems within 30 days, except where retention is required by law or to protect our legal interests.
Schools and educators. If Lume is used in a school or other educational context where a school provides COPPA consent on behalf of parents under the school-consent exception, the school's authorization is limited to the school's use of the Service and does not authorize commercial use. We do not currently offer a paid school product; this section is informational.
9. No Behavioral Advertising to Children
We do not, and we do not permit our service providers to, serve behavioral or interest-based advertising to children. Where the Service shows advertisements (for example, ads served by YouTube within the embedded player), Wayn registers Lume as a Child-Directed API Client with YouTube and instructs YouTube not to serve personalized advertising to kid profiles. Wayn does not control the specific ads served by YouTube; while YouTube applies its own ad filtering for content marked Made for Kids, no ad system is perfect, and we cannot guarantee that every ad shown by YouTube will be age-appropriate.
10. Data Retention
We retain information only as long as needed for the purposes described in this Privacy Policy or as required by law:
* Parent account information: retained while your account is active and for a limited period afterward to handle billing inquiries, fraud prevention, and legal obligations.
* Child profile information: deleted from active systems within 30 days of profile deletion or account closure, except as required by law.
* YouTube API data (cached metadata): refreshed or deleted at least every 30 days, in compliance with the YouTube API Services Developer Policies.
* Aggregated and de-identified data: may be retained indefinitely for analytics and product improvement.
11. Data Security
We use reasonable administrative, technical, and physical safeguards to protect the information we collect, including encryption in transit, restricted server-side storage of API credentials, hashed password storage, and access controls limiting employee access to personal information. No system is perfectly secure. If we become aware of a security incident affecting your personal information, we will notify you in accordance with applicable law.
12. Cookies, SDKs, and Similar Technologies
The Lume mobile app uses limited device identifiers and SDKs for specific purposes. The AppsFlyer SDK is used for analytics and attribution measurement and is configured with child-directed privacy controls, including IP masking, and does not enable behavioral advertising. The Lume website may use cookies and similar technologies for essential site functionality, basic analytics, and to remember your preferences. We do not use third-party advertising cookies or SDKs that enable behavioral or interest-based advertising. Where the Service uses cookies that are not strictly necessary, we provide a cookie control in the website footer.
13. Your Choices and Rights
Account information. You can review or update your parent account information and child profiles through the in-app parent dashboard.
Subscriptions. You can manage or cancel your subscription through Apple, Google, or other applicable payment processor as described in the Terms of Service.
Marketing communications. If you opted in to marketing emails, you can unsubscribe at any time through the link in any marketing email or by contacting us.
Access and deletion. You may request access to the personal information we hold about you or your child, or request deletion, by contacting connect@wayn.co. We will respond within the timeframes required by applicable law. We may need to verify your identity (and where the request relates to a child, your status as the Parent Account Holder) before fulfilling the request.
California residents. If you are a California resident, the California Consumer Privacy Act ("CCPA") may give you additional rights, including the right to know what personal information we collect, use, and disclose; the right to request deletion; the right to correct inaccurate personal information; and the right not to be discriminated against for exercising these rights. We do not sell personal information and do not share personal information for cross-context behavioral advertising. You may exercise CCPA rights by contacting us at connect@wayn.co.
14. United States Only
The Service is currently offered only in the United States and is intended only for use by parents and children located in the United States. If you are accessing the Service from outside the United States, please be aware that your information may be transferred to, stored, and processed in the United States, where data-protection laws may differ from those in your country.
15. Changes to This Privacy Policy
We may update this Privacy Policy from time to time. If we make material changes, we will notify you through the Service or by email at the address associated with your account, and we will update the "Effective Date" above. We will not apply a material change retroactively to information previously collected. Where a change requires verifiable parental consent under COPPA, we will obtain that consent before applying the change to existing child profiles.
16. Contact Us
If you have any questions about this Privacy Policy or want to exercise any of the rights described above, please contact us:
Wayn Corporation
Attention: Privacy
connect@wayn.co
For more information about the Google services Lume relies on, see the Google Privacy Policy.