LUMAVINE | Cookie Policy

1. What Are Cookies & Similar Technologies

Cookies are small text files placed on your device by a website. They are widely used to make websites work, improve efficiency, and provide reporting information. Cookies set by the website you are visiting are called "first-party cookies." Cookies set by parties other than the website you are visiting are called "third-party cookies."

localStorage is a web storage mechanism that allows websites to store key-value data persistently in your browser. Unlike cookies, localStorage data is not sent to the server with every request, making it more efficient for client-side storage. Data persists until explicitly cleared by the user or the application.

sessionStorage functions similarly to localStorage, but data is cleared when the browser tab or window is closed. Lumavine uses sessionStorage for temporary data that should not persist beyond the current browsing session.

IndexedDB is a low-level browser API for storing significant amounts of structured data, including files and blobs. Lumavine uses IndexedDB in specific features (such as SafeHaven) for offline data caching that requires more storage capacity than localStorage provides.

Service Workers are scripts that run in the background of your browser, separate from the web page. Unlike cookies, Service Workers do not store personal data themselves. Instead, they intercept network requests and manage a local cache to enable offline functionality and improve page load performance. Service Workers can be unregistered at any time through your browser settings.

First-Party vs. Third-Party: First-party cookies and storage are set directly by Lumavine (lumavine.ai) and are used for core functionality such as authentication, preferences, and offline support. Third-party cookies are set by external services we integrate with (such as Supabase for authentication). Lumavine does not permit third-party advertising or tracking cookies.

2. Essential Cookies & Storage

Essential cookies and storage technologies are strictly necessary for the operation of Lumavine. Without these, core features such as authentication and security would not function. These cannot be disabled without losing access to the platform.

Technology	Name / Key	Purpose	Duration	Category
Cookie	sb-access-token	Supabase session token used to maintain your session state	Session	Essential
Cookie	sb-refresh-token	Supabase refresh token used to renew your session automatically	30 days	Essential
Cookie	CSRF Token	Cross-Site Request Forgery protection token that prevents unauthorized actions on your behalf	Session	Essential
Service Worker Cache	safehaven-cache-*	Caches SafeHaven shelter data and resources for offline access in emergency situations	7-30 days	Essential
localStorage	lumavine_theme	Stores your selected visual theme preference (light, dark, or system) so it persists across sessions	Persistent	Essential
localStorage	lumavine_lang	Stores your selected language preference so the interface displays in your chosen language	Persistent	Essential

3. Functional Storage

Functional storage technologies enhance your experience by remembering your choices and providing features like offline data access. These are not strictly necessary for the platform to operate, but they enable important user experience improvements and data resilience. This data is stored locally in your browser to preserve your preferences and progress between visits.

Technology	Name / Key	Purpose	Duration	Category
localStorage	lumavine_wellness_*	Stores wellness data including mood entries, journal content, and wellness scores as a local fallback when offline or unauthenticated	Persistent	Functional
IndexedDB	safehaven	Caches offline shelter directory data for the SafeHaven feature, enabling access to shelter information without an internet connection	24 hours	Functional
localStorage	lumavine_game_scores	Stores game progress, high scores, and achievement data locally so your progress is preserved between sessions	Persistent	Functional
localStorage	lumavine_onboarding	Tracks whether you have completed the onboarding flow so you are not shown the welcome sequence again	Persistent	Functional
Service Worker	sw.js	Manages application-level caching for offline use, intercepts network requests, and serves cached assets to improve load performance	Version-based	Functional

4. Analytics Storage

Lumavine uses only first-party, privacy-respecting analytics. We do not use any third-party analytics services such as Google Analytics, Meta Pixel, Adobe Analytics, or any other external tracking platform. All analytics data is collected and processed by Lumavine directly.

Technology	Name / Key	Purpose	Duration	Category
localStorage	lumavine_analytics_session	Stores an anonymous daily session hash used to count unique daily visits without identifying individual users	24 hours	Analytics

No third-party analytics: Lumavine does not load Google Analytics, Meta Pixel, or any other third-party tracking scripts. We believe your browsing activity on our platform should remain between you and us.

Privacy-respecting by design: Our first-party analytics collect only aggregate, anonymized data such as page view counts and feature usage patterns. We do not track individual user journeys, create behavioral profiles, or use fingerprinting techniques.

SafeHaven analytics: Analytics for the SafeHaven feature are fully anonymous and do not record any personally identifiable information. SafeHaven analytics are automatically disabled when your browser sends a Do Not Track (DNT) signal.

5. Third-Party Cookies

Lumavine integrates with a limited number of third-party services that may set cookies or access storage on your device. We select these providers carefully and only integrate services that are necessary for platform operation. Lumavine does NOT use advertising, targeting, or marketing cookies of any kind.

Supabase (ztcagfgaeprdfmttwpzb.supabase.co) — Our backend service provider. Supabase may set cookies to manage session state. Supabase's privacy practices are governed by their Privacy Policy.

Google Fonts (fonts.googleapis.com, fonts.gstatic.com) — We use Google Fonts to deliver the Instrument Sans, Sora, and IBM Plex Mono typefaces. Google Fonts does not set tracking cookies. Font files are served with cache headers that allow your browser to cache them locally, reducing subsequent page load times. Google's privacy practices regarding Fonts are described in their Google Fonts Privacy FAQ.

Leaflet / OpenStreetMap (tile.openstreetmap.org) — The SafeHaven feature uses OpenStreetMap tiles via the Leaflet library to display maps. OpenStreetMap tile servers do not set cookies on your device. Map tile requests include your IP address as part of standard HTTP requests, but OpenStreetMap does not use this for tracking purposes.

6. Managing Your Preferences

Do Not Track (DNT)

Lumavine honors Do Not Track browser signals. When DNT is enabled in your browser, we automatically limit analytics collection and disable non-essential data gathering. SafeHaven analytics are fully suppressed when DNT is detected. You can enable DNT in your browser's privacy or security settings.

Browser Cookie Settings

You can manage cookies through your browser settings. Here is how to access cookie controls in common browsers:

Google Chrome: Settings > Privacy and Security > Cookies and other site data
Mozilla Firefox: Settings > Privacy & Security > Cookies and Site Data
Apple Safari: Preferences > Privacy > Manage Website Data
Microsoft Edge: Settings > Cookies and site permissions > Manage and delete cookies and site data

localStorage and sessionStorage

Data stored in localStorage and sessionStorage can be cleared through your browser's developer tools (typically accessible via F12 or Ctrl+Shift+I) under the Application or Storage tab. You can also clear all site data by navigating to your browser settings and selecting "Clear browsing data" or "Clear site data" for lumavine.ai specifically.

Service Workers

Service Workers can be unregistered through your browser's developer tools under the Application tab, or through your browser's site settings. In Chrome and Edge, you can also navigate to chrome://serviceworker-internals or edge://serviceworker-internals to view and unregister Service Workers.

Essential Cookies

Essential cookies and storage (listed in Section 2) cannot be disabled while continuing to use Lumavine. These are required for the platform to function correctly. If you block essential cookies, some features may not work as expected.

Impact of Disabling Cookies and Storage

If you choose to disable or delete cookies and storage technologies, the following features will be affected:

Session state: Your session preferences may be lost and need to be reconfigured
Theme and language preferences: Your settings will reset to defaults on each visit
Offline access: SafeHaven and other offline features will not be available
Wellness data fallback: Local data storage for mood, journal, and game progress will be lost
Onboarding: You may be shown the welcome flow again on subsequent visits

7. Legal Basis

PIPEDA (Canada)

Under Canada's Personal Information Protection and Electronic Documents Act (PIPEDA), organizations must obtain meaningful consent for the collection, use, and disclosure of personal information. Lumavine's cookie practices comply with PIPEDA as follows:

Essential cookies: Implied consent. These cookies are necessary for the provision of the service you have requested. By using Lumavine, you implicitly consent to the use of essential cookies required for platform functionality and security.
Functional cookies: Implied consent. These cookies enhance your user experience by remembering preferences and enabling offline access. Their use is a reasonable expectation within the context of the service you have chosen to use.
Analytics cookies: Implied consent with opt-out via Do Not Track. Our first-party analytics collect only anonymized, aggregate data and do not create individual profiles. You may opt out at any time by enabling Do Not Track in your browser.
Marketing cookies: Not applicable. Lumavine does not use marketing, advertising, or targeting cookies, so express consent for such cookies is not required.

Under PIPEDA, no express consent banner is required for non-marketing cookies where implied consent is appropriate, provided that the purposes of collection are made clear (as described in this policy) and a reasonable person would consider the collection appropriate in the circumstances.

GDPR (EU/EEA)

For users in the European Economic Area, the United Kingdom, and Switzerland, we process cookie-related data under the following legal bases as defined by the General Data Protection Regulation (GDPR) and the ePrivacy Directive:

Essential cookies (Strictly Necessary): No consent required. These cookies are strictly necessary to provide you with the service you have requested, as permitted under Article 5(3) of the ePrivacy Directive. They include authentication and security cookies.
Functional cookies: Legitimate interest (Article 6(1)(f) GDPR). We have a legitimate interest in providing an enhanced, personalized user experience. These cookies do not process sensitive personal data and users can opt out by clearing site storage.
Analytics cookies: Legitimate interest (Article 6(1)(f) GDPR). Our first-party, anonymized analytics serve the legitimate interest of improving our services. We limit data collection, anonymize all analytics data, and honor Do Not Track signals as an opt-out mechanism.
Marketing cookies: Consent required (Article 6(1)(a) GDPR). However, Lumavine does not use any marketing or advertising cookies, so this category does not apply to our platform.

CCPA / CPRA (California)

Under the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA), Lumavine provides the following disclosures regarding cookies and similar technologies:

Notice at collection: This Cookie Policy serves as notice at collection for all categories of personal information gathered through cookies and similar technologies, as required under Civil Code section 1798.100.
No sale of data: Lumavine does not sell personal information collected through cookies or any other means, as "sell" is defined under CCPA section 1798.140(ad). We do not share personal information for cross-context behavioral advertising.
Opt-out available: Although we do not sell personal information, you may exercise your right to opt out of analytics data collection by enabling Do Not Track in your browser or by clearing your site data through browser settings.
Right to delete: You may request the deletion of personal information collected through cookies by contacting us at support@lumavine.ai.

Quebec Law 25 (Loi 25)

Under Quebec's Act Respecting the Protection of Personal Information in the Private Sector, as modernized by Law 25 (formerly Bill 64), cookies and similar technologies are considered "technological means" for collecting personal information. Lumavine complies with Law 25 as follows:

Consent basis: We obtain consent appropriate to the sensitivity of the information collected. Essential cookies operate under implied consent as they are necessary for service delivery. Analytics data is anonymized and collected under implied consent with DNT opt-out.
Privacy by default: Lumavine applies the privacy by default principle. We collect the minimum amount of data necessary, use first-party analytics only, do not engage in profiling, and do not use marketing cookies. All analytics are anonymous by default.
Transparency: This Cookie Policy provides clear information about the cookies and storage technologies we use, their purposes, and how you can manage them, as required under Law 25's enhanced transparency obligations.
Privacy Impact Assessment: Lumavine conducts privacy impact assessments for any new use of cookies or storage technologies that could affect user privacy, in compliance with Law 25 requirements for technological projects involving personal information.

8. Contact & Updates

If you have questions about this Cookie Policy, our use of cookies and similar technologies, or wish to exercise your rights regarding cookie-related data, please contact us.

Cookie Policy Contact

@

Privacy & Cookie Questions

support@lumavine.ai

#

Response Time

Within 30 days of verified request

Policy Updates: We may update this Cookie Policy from time to time to reflect changes in our practices, the technologies we use, or applicable legal requirements. When we make changes, we will update the "Last Updated" date at the top of this policy. For material changes that significantly affect how we use cookies or similar technologies, we will provide additional notice through the platform or via email.

Related Policies: This Cookie Policy should be read together with our other policies that govern your use of Lumavine:

Privacy Policy — How we collect, use, and protect your personal information
Terms of Service — The terms governing your use of the Lumavine platform

Cookie Policy

Minimal Cookie Usage

Table of Contents