Privacy Policy

1. Who We Are

Luminara Spark ("we," "us," or "our") is operated by Luminara Spark, developed by Christopher Canavan and Nick Howe. We provide an AI-powered children's story generation service for ages 6–11, accessible at luminaraspark.com and associated applications. The Service generates original stories with text, expressive narration audio, cinematic video scenes (in select story worlds), and AI-generated illustrations, available in English and Spanish.

Questions about this policy: support@luminaraspark.com

2. Our Architecture and Children's Privacy

Luminara Spark is designed specifically to protect children's privacy. Our service operates on a parent-pays, parent-controls model:

• Parents and guardians create accounts, manage subscriptions, and control all settings.
• Children consume stories only. Children do not create accounts, do not submit personal information, and do not interact with our systems independently.
• We do not knowingly collect personal information directly from children under the age of 13.
• All account holders must be 18 years of age or older.

This architecture is intentional. It means Luminara Spark is not subject to COPPA's verifiable parental consent requirements in the traditional sense — because the child is not the user of our service. The parent is. If you believe a child under 13 has submitted personal information directly to us, please contact us immediately at support@luminaraspark.com.

3. Information We Collect

Information you provide to us

• Account information: Email address and password (hashed) when you create an account.
• Payment information: Billing is processed entirely by Stripe, Inc. We store only a Stripe customer ID and subscription status — never your raw card number, CVV, or bank details.
• Story inputs: Character names, child age ranges, story world selections, and any situation descriptions you enter. These inputs are transmitted to our AI providers (Anthropic) for story generation and are temporarily stored on our servers during the generation process, then automatically deleted once your story is delivered to your browser. We do not permanently retain story inputs.

Information collected automatically

• Server logs: Standard web server logs including IP address, browser type, pages accessed, and timestamps. These are managed by our hosting provider (Netlify) in accordance with their retention policies, and are used for security and debugging purposes only.
• Subscription status: Whether your subscription is active, trial, or cancelled — communicated to us by Stripe webhooks.

Information stored on your device

• Authentication token: A session token stored in your browser's localStorage to keep you signed in. This is removed when you sign out.
• Preferences: Your selected language and narrator voice are stored locally in your browser so they persist between visits. These never leave your device.

What we do NOT collect

• We do not use advertising cookies or tracking pixels.
• We do not install third-party analytics SDKs (no Google Analytics, no Facebook Pixel, no Mixpanel).
• We do not collect device fingerprints, persistent device identifiers, or behavioral profiles.
• We do not record or store audio playback sessions.
• We do not permanently retain the full text of generated stories on our servers. Story content is temporarily stored during generation and automatically deleted once delivered to your browser.

4. How We Use Your Information

We use the information we collect solely to operate the service:

• To authenticate your account and manage your subscription.
• To generate stories using your provided inputs (character name, age, lesson, situation).
• To process payments and send receipts through Stripe.
• To respond to support requests you initiate.
• To detect and prevent fraud or abuse.
• To comply with legal obligations.

We do not use your information to build advertising profiles. We do not sell, rent, or share your personal information with third parties for their marketing purposes.

5. Third-Party Services

We use a small number of third-party services to operate Luminara Spark. Each receives only the minimum data necessary:

Anthropic (Claude AI)

Story text is generated using Anthropic's Claude API. Story prompts (character name, age, lesson, and any Craft Mode inputs) are transmitted to Anthropic's servers to generate story content. Anthropic's API data handling is governed by Anthropic's Privacy Policy. We do not send identifying parent account information to Anthropic.

fal.ai (Image and Video Generation)

Story climax illustrations are generated using fal.ai's API (Flux Pro Ultra model). Cinematic video scenes in select story worlds are also generated via fal.ai. Image and video prompts describing story scenes are transmitted to fal.ai. No personal account information is sent. Governed by fal.ai's Privacy Policy.

Google (Text-to-Speech)

Story narration audio is generated using Google's Gemini API. Story text is transmitted for voice synthesis. No personal account information is sent. Governed by Google's Privacy Policy.

Stripe (Payments)

All payment processing is handled by Stripe, Inc. We do not store credit card numbers or sensitive financial data on our servers. Stripe is PCI DSS Level 1 certified. Governed by Stripe's Privacy Policy.

Netlify (Hosting)

Our application is hosted on Netlify. Standard server logs may be processed by Netlify. Governed by Netlify's Privacy Policy.

6. Data Retention

• Account data: Retained for the duration of your subscription. You may request deletion of your account and all associated data at any time by emailing support@luminaraspark.com. We will process deletion requests within 30 days.
• Payment records: Stripe retains transaction records as required by financial regulations. We retain only subscription status.
• Story content: Temporarily stored during generation and automatically deleted once delivered to your browser. Not permanently retained on our servers.
• Server logs: Managed by our hosting provider (Netlify) in accordance with their standard retention policies.

7. Your Rights

Depending on your location, you may have the following rights regarding your personal data:

• Access: Request a copy of the personal data we hold about you.
• Correction: Request correction of inaccurate data.
• Deletion: Request deletion of your account and associated data.
• Portability: Request your data in a machine-readable format.
• Objection: Object to certain processing of your data.

To exercise any of these rights, email support@luminaraspark.com. We will respond within 30 days. We do not charge fees for these requests.

California residents (CCPA): You have the right to know what personal information we collect, the right to delete it, and the right to opt out of its sale. We do not sell personal information.

EEA/UK residents (GDPR): Our lawful basis for processing is contractual necessity (to provide the service you subscribed to). You may lodge a complaint with your local supervisory authority.

8. Security

We implement industry-standard security measures including HTTPS encryption for all data in transit, hashed password storage, and access controls limiting who can access production systems. No system is perfectly secure. If you discover a security vulnerability, please report it to support@luminaraspark.com.

9. Children Under 13 — COPPA Statement

Luminara Spark does not direct its service to children under 13 and does not knowingly collect personal information from children under 13. Our service is directed to parents and guardians who are 18 years of age or older.

The stories generated by Luminara Spark are consumed by children, but children do not interact with our service, create accounts, or submit data. The account holder — a parent or guardian — is the sole user of our platform from a data perspective.

If we become aware that we have inadvertently collected personal information from a child under 13, we will delete it promptly. Contact us at support@luminaraspark.com.

10. Changes to This Policy

We will notify active subscribers by email at least 14 days before any material changes to this Privacy Policy take effect. Continued use of the service after that date constitutes acceptance of the updated policy.

11. Contact