Last updated: 15 August 2026 · Applies to Lumba for iPhone
Lumba is developed and published by Alperen Çiftlikçi, an independent developer. For any privacy question or request, write to lumba.app.support@gmail.com. We answer within 30 days.
The following never leaves your iPhone. It is written to the app's private storage and is encrypted by iOS while your device is locked.
Deleting the app removes all of it. You can also delete individual scans, or erase everything, from inside the app.
You take one side-profile photo. The app uses Apple's Vision framework, which runs entirely on your iPhone, to locate body landmarks (ear, shoulder, hip, knee, ankle) and calculate four angles from them. Those angles become your score. The score is arithmetic, not a guess: the same photo always produces the same number.
Very little, and none of it is health data:
| What | Why | Where |
|---|---|---|
| Anonymous user ID | So your subscription can be restored on a new device | Firebase (Google) |
| Account creation date | Support and abuse prevention | Firebase (Google) |
| Subscription status | To unlock paid features | Firebase (Google) · Apple |
| Your data-processing consent flag | So you are not asked again on a new device | Firebase (Google) |
| Your four measured angles and questionnaire answers | To write your personalised reading (section 4a) | Google Gemini, via Firebase AI Logic |
| One scan photo — only if you ask for a before/after preview | To generate that image (section 4b) | Google Gemini, via Firebase AI Logic |
We use Firebase Anonymous Authentication. That means no email, no password, no name and no sign-up — the app generates a random identifier for your device. We cannot tell who you are from it.
Analytics are disabled in this app. We do not use advertising SDKs or trackers.
After a scan, Lumba turns your four measured angles into a short personalised explanation. To do that it sends the numbers only — the four angles, your total score, your programme week and the questionnaire answers you gave — to Google's Gemini model through Firebase AI Logic. Your photo is not part of this request. If the request fails or you have AI turned off, the app falls back to its built-in text and nothing is sent.
If you ask for a before/after preview, Lumba sends that single scan photo to Google's Gemini image model, again through Firebase AI Logic, to draw what corrected posture could look like. This is the only place in the app where a photo leaves your device.
The camera is used only when you take a posture scan, and only for that photo. It is never used in the background. iOS asks for your permission the first time; you can change it any time in Settings → Lumba.
If you allow notifications, we send session reminders at the time you choose, and optional reminders to stand up if you told us you sit for long stretches. These are scheduled locally on your device — we do not run a push server, and we do not know whether you opened them.
Subscriptions are sold through Apple. Apple processes the payment; we never see your card details. We receive from Apple only whether an active subscription exists. Manage or cancel any time in iOS Settings → your name → Subscriptions.
Before your first scan is analysed, the app asks you to confirm that you understand how the photo is handled. You can decline — the scan simply will not run, and the rest of the app still works. If you later want to withdraw consent, contact us and we will clear the stored flag.
Depending on where you live, you may have the right to access, correct, delete or export your data, and to object to processing. Because almost everything is on your device, you can exercise most of these yourself: delete scans in the app, or delete the app to remove everything.
For the anonymous record on our servers, write to lumba.app.support@gmail.com. Please tell us your anonymous ID (Profile → About) so we can find it. If you are in the EEA or UK you may also complain to your local data protection authority.
Lumba is intended for people aged 13 and over. Forward head posture is common among teenagers, so the app lets you choose an "under 18" age band, and the programme starts one step gentler for that group — a spine that is still growing should not be loaded like an adult's.
We do not direct the app at children under 13 and we do not knowingly collect their data. If you believe a child under 13 has used it, contact us and we will remove any associated record.
If you are under 18, please go through the programme with a parent or guardian's knowledge, and speak to them and a healthcare professional before starting if you have any back pain that worries you.
Local files are written with iOS complete file protection, meaning they are encrypted while your device is locked. Traffic to our servers uses TLS. We use Firebase App Check to reduce abuse of our backend.
If we change how we handle data, we will update this page and the date at the top. Material changes will also be announced in the app.
