Legal

Privacy Policy

Last updated: 23 July 2026

This Privacy Policy explains how Lullim (“Lullim”, “we”, “us”) collects, uses, stores, and shares personal data when you use the Lullim personal organizer app and this website. We built Lullim to be a calm, private place for your day, and we collect as little as we can to make it work. If you have any questions, contact us at contact@lullim.com.

Who we are

Lullim is the data controller for the personal data described in this policy, meaning we decide how and why it is processed. You can reach us about anything in this policy, including requests to access or delete your data, at contact@lullim.com.

Information we collect

Information you give us

When you create an account, we collect your first name, your email address, and a password. Your password is never stored in readable form. We keep only a securely hashed version of it (see Security).

Content you create in the app

Lullim stores the content you choose to put into it so it’s there when you come back. Depending on which features you use, this can include:

• Tasks, subtasks, and weekly goals
• Calendar events you add
• Notebooks and their contents
• Quick-capture thoughts and notes
• Journal entries and prompts
• Focus and Pomodoro sessions
• Screen-time logs and goals
• Expenses, spending categories, and budgets
• Subscriptions you track
• Important dates such as birthdays and anniversaries
• Your preferences, such as your chosen theme and which menus you enable

Some of this can be personal or sensitive, for example journal entries, spending, or important dates. It belongs to you: we do not read it for advertising, we do not sell it, and we do not use it to build a profile of you.

Information we do not collect

Lullim does not use third-party analytics, advertising, or tracking technologies. We do not track you across other websites, and we do not log your IP address or browsing behaviour for analytics purposes.

How we use your information

We use your personal data only to:

• Provide the Lullim service and store your content across your devices
• Create and secure your account, and keep you signed in
• Verify your email address by sending you a one-time verification code
• Protect your account and the service against abuse (for example, temporarily locking an account after repeated failed sign-in attempts)
• Show your Google Calendar inside Lullim, if you choose to connect it (see Google account data)
• Respond to you when you contact us for support

Cookies and local storage

When you sign in, we set a single essential, first-party cookie that keeps you logged in. It is an httpOnlycookie (it can’t be read by scripts in your browser) and is used purely for authentication, not for tracking or advertising.

The app also stores a small amount of interface state in your browser’s local storage (your selected theme and the state of the Focus and Pomodoro timers) so the app looks and behaves the way you left it. This never leaves your device and is not used to identify you.

Because we use only strictly necessary cookies and no tracking technologies, Lullim does not display a tracking-cookie banner.

How we share your information

We do not sell your personal data. We share it only with the service providers that make Lullim work, and only to the extent needed to run the service:

• Supabase: hosts the database where your account and content are stored.
• Google: provides sign-in and the optional Google Calendar connection, if you choose to use it (see below).
• Our hosting and infrastructure providers: run the Lullim website and application servers.

These providers act on our behalf and are not permitted to use your data for their own purposes. We may also disclose data if required by law, or to protect the rights, safety, and security of Lullim and its users.

Google account data

Connecting Google is entirely optional. If you connect your Google account, Lullim requests permission to:

• See your primary Google account email address (used to identify the connected account), and
• View your Google Calendar events read-only (the calendar.readonly scope).

How we handle this data:

• We store your connected Google account email so you can see which account is linked.
• Your calendar events are read live from Google each time you view your calendar and are shown as an overlay inside Lullim. We do not copy or store your Google Calendar events on our servers.
• We store the access tokens that let us connect to Google on your behalf. These tokens are encrypted at rest.
• We never write to, modify, or delete anything in your Google Calendar since the connection is read-only.
• You can disconnect Google at any time from Account → Connections in the app. Disconnecting deletes the stored tokens and connected-account email.

Lullim’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements. We use Google user data only to provide and improve the calendar features you request, we do not transfer it to others except as needed to provide those features or as required by law, we do not use it for advertising, and no humans read it except where you explicitly permit it, for security, or as required by law.

How we protect your data

• Passwords are stored using strong one-way hashing (bcrypt), never in plain text.
• Google access tokens are encrypted at rest using AES-256-GCM.
• Your session cookie is httpOnly and, in production, sent only over encrypted (HTTPS) connections.
• Data is transmitted between your device and our servers over encrypted connections.
• We apply safeguards such as email verification and sign-in rate limiting to protect your account.

No online service can be completely secure, but we take reasonable measures to protect your data and continue to improve them.

Data retention and deletion

We keep your personal data for as long as your account is active. You can request deletion of your account and associated data at any time by emailing contact@lullim.com. When an account is deleted, the content associated with it (tasks, events, notebooks, journals, expenses, calendar connection, and so on) is removed from our database. We may retain limited information where we are required to do so by law.

Your rights and choices

Depending on where you live, you may have rights over your personal data, including the right to:

• Access the personal data we hold about you
• Correct inaccurate data
• Delete your data
• Export or receive a copy of your data
• Object to or restrict certain processing, and withdraw consent (such as disconnecting Google)

To exercise any of these rights, email contact@lullim.com. If you are in the European Economic Area or the United Kingdom, you also have the right to lodge a complaint with your local data protection authority. If you are a California resident, we do not sell or share your personal information as those terms are defined under California law.

International data transfers

Lullim relies on service providers that may store or process data in countries other than your own. Where data is transferred internationally, we rely on our providers’ safeguards for such transfers.

Children’s privacy

Lullim is not directed to children under 16, and we do not knowingly collect personal data from them. If you believe a child has provided us with personal data, please contact us and we will delete it.

Changes to this policy

We may update this policy from time to time. When we make material changes, we will update the “Last updated” date above and, where appropriate, notify you. Your continued use of Lullim after an update means you accept the revised policy.

Contact us

If you have questions about this policy or how we handle your data, email us at contact@lullim.com.

← Back to home