Legal
Privacy Policy
Lulu does not require an account, include advertising or third-party analytics, track users, or sell personal information. Limited request metadata is temporarily retained to deliver and secure the catalog, entitlement, and audio services.
Information stored on your device
Lulu stores app preferences, onboarding choices, favorites, recently played track identifiers, saved ambient mixes, your optional bedtime reminder schedule, downloaded audio, and any Sleep Journal entries locally on your device. Journal entries may include bedtime and wake time, your self-reported sleep quality, morning feeling, and optional notes. This information is used only to provide app features and is not transmitted to us. If you enable a bedtime reminder, Lulu asks iOS to schedule local notifications for the time and days you select; the schedule is not sent to a Lulu server. You can delete individual journal entries in Lulu or remove all local information by deleting the app.
Apple Health
If you choose to connect Apple Health, Lulu requests read-only access to sleep data so it can show sleep duration, time in bed, sleep stages when supplied by your device, and sleep trends. Lulu does not write sleep data to Apple Health. Access is optional and is requested only after you choose to connect it.
Apple Health data is processed and displayed on your device. Lulu does not transmit this health data to us, Tencent Cloud, advertising services, analytics services, or other third parties. You can review or revoke Lulu's access at any time in the Health app or iOS Settings.
Purchases
Premium subscriptions are processed by Apple through StoreKit and your Apple Account. Lulu receives subscription entitlement status from Apple so the app can unlock premium features. We do not receive or store your full payment card details. Apple handles purchase information under its own privacy policy and terms.
Network access
Lulu may request a public content catalog, artwork, and audio from infrastructure operated for us by Tencent Cloud, including EdgeOne, Makers, and Cloud Object Storage. These services process technical request metadata such as the IP address, approximate region derived from the IP address, request time, user agent, requested URL and path, and standard HTTP headers. The requested path can indicate which catalog or audio asset was requested.
Tencent's Cloud Function service automatically retains request metadata and the requested URL/path for up to 24 hours. When an EdgeOne security rule is triggered, its security-event system may retain a sample containing the IP address, user agent, requested URL (including query parameters), path, and request headers for up to 30 days. We use this information only to deliver content, verify access, prevent abuse, investigate security events, and keep the service available. We do not use it for advertising, cross-app tracking, or behavioral analytics, and we do not sell it.
For premium remote content, Lulu may send an Apple-signed StoreKit transaction to our server for real-time verification. The server checks the app, product, expiration, and revocation status with Apple, then returns a short-lived access token and signed audio URL. Lulu's application code does not intentionally write the raw StoreKit request body or health and journal data to server logs. Provider security systems may temporarily retain request URLs, query parameters, or headers under the retention periods described above. We do not receive full payment card details.
Listening history, favorites, saved routines and mixes, bedtime reminders, Sleep Journal entries, and Apple Health data are not included in catalog, entitlement, or audio requests and are not transmitted to Tencent Cloud. Links to support, terms, privacy information, and Apple subscription-management pages may open outside Lulu at your request.
Children
Lulu is a general-audience relaxation and audio app. It does not knowingly collect personal information from children.
Security and retention
Lulu does not maintain an account database. Catalog and audio delivery use short-lived authorization and operational safeguards. Tencent's automatic operational metadata expires after up to 24 hours, while security-event samples may be retained for up to 30 days. COS access logging is disabled. Information stored locally remains on your device until you remove it or delete the app. If we later add accounts, advertising, analytics, crash reporting, server-side listening history, or longer-term identifiers, we will update this policy and the App Store privacy disclosure before enabling those features.
Changes to this policy
We may update this policy when Lulu's features or legal obligations change. The effective date above identifies the latest version.
Contact
For privacy questions, email support@ilovetechmon.com.