This policy explains how Lamplight ("the app") handles information. Lamplight is made by Sintios ("we", "us"), which is the controller of the data described here.
1. How Lamplight works
Lamplight has two roles. A protected person is someone who lives alone and wants a safety net. A contact (also called a guardian) is someone they invite to be told if they go quiet.
The protected person's phone sends our server a small "I'm here" signal from time to time (for example when the app is opened, the widget is tapped, or the phone notices movement). Every few minutes our server checks whether anyone has been quiet for longer than their chosen period (12 to 48 hours, 24 by default). If so, it first asks that person "Are you OK?" twice, an hour apart, and only if there is still no answer an hour later does it notify their contacts.
A server is needed because a phone that is switched off, or a person who cannot reach it, can't raise the alarm on its own.
2. What our server stores
This is the complete list of what our database holds about each account.
| Data | Details | Why |
|---|---|---|
| Anonymous account ID | A random ID created when you first open the app. Not linked to your name, phone number, email or Apple Account. | To tell accounts apart. |
| Device secret (hashed) | Your app holds a secret key; we store only a one-way SHA-256 hash of it. | So only your device can act on your account. |
| Role | Protected person or contact. | To run the right features. |
| Display name (optional) | A short name you choose (up to 40 characters), such as "Ayşe". You can leave it empty. | So your contacts know who an alert is about. |
| Push token | An Apple Push Notification service (APNs) token for your device, and whether it is a test or live token. | To send you and your contacts notifications. |
| Time zone and settings | Your time zone, your quiet period (12 to 48 hours), optional quiet hours, and your mode (daily, a check-in deadline such as First Date mode, or paused until a time). | To check at the right time and respect quiet hours. |
| Activity timestamps | The time of your last sign of activity, and when you created your account or resumed from a pause. Only times, never what you were doing. | The core of the service: noticing when you go quiet. |
| Alert state | Which step of an alert you are in, when each step started, and which contact tapped "I'm handling it" and when. Cleared as soon as you check in. | To run the alert steps correctly. |
| Last location (optional) | Only if you turn on location sharing. Only the most recent location, rounded to about 11 metres, with its time. Each new one replaces the old one. | So contacts know where to look during an alert. |
| Contact links and invites | Which accounts are linked as your contacts and when they accepted. Invite codes are 8 characters and expire after 48 hours; the code is removed once accepted. | To know whom to notify. |
| Alert log | For each notification sent: which account it was about, its type (check-in, alert, all clear, being handled), the recipient account, Apple's delivery status code and the time. | To show recent alert history and diagnose delivery problems. |
We do not store your phone number, email address, real name (unless you type one as your display name), contacts list, messages, health data, step counts, motion data or location history.
Like any internet service, our hosting provider necessarily sees your device's IP address when the app connects. We do not store IP addresses in our database. Short-lived technical error logs may include your anonymous account ID.
3. What stays on your iPhone
- Motion and Health (steps): if you allow it, the app uses Core Motion and HealthKit on your device only to notice that you are active. The data itself is never sent to us; the app only sends a timestamped "I'm here" signal. Health data is never used for advertising or shared with anyone.
- Location: if you turn on location sharing, the app uses significant location changes to update your single last location (see above). If you turn it off, the stored location is deleted from our server immediately.
- Notifications: used for check-in prompts and alerts.
4. Who can see what
- Your contacts (only people who accepted your invite) can see your display name, when you were last active, your current status and mode, and the last 30 days of alerts about you (alert sent, all clear, being handled).
- Your location is shown to your contacts only during an active alert, and only if you turned location sharing on. It is also included in the alert notification sent to them.
- As a protected person, you can see your contacts' display names and whether they have accepted.
- We can technically access the database to run and fix the service. We look only when needed for support or troubleshooting.
- Nobody else. We don't sell your data, and none of the data in this policy's sections 2–5 is shared with advertisers or data brokers. Ads in the free version are handled separately by Google (section 7).
5. How long we keep it
- Account data and settings: until you delete your account.
- Alert state: cleared each time you check in.
- Last location: replaced by each update; deleted immediately when you turn location sharing off or delete your account.
- Alert log: deleted automatically after 30 days.
- Unused invite codes: expire after 48 hours and are then deleted.
- Account deletion: "Delete account" in the app immediately removes your account, your contact links (in both directions) and alert logs about or sent to you. Our database provider may keep encrypted point-in-time backups for a limited period (up to 30 days), after which deleted data is gone from backups too.
Important: deleting the app from your phone does not delete your account. Because your phone would stop sending signals, your contacts may then be alerted. Please delete your account in the app first.
6. Service providers
- Our hosting provider runs our server and database on a managed server. It processes data only to host the service for us.
- Cloudflare, Inc. provides DNS, TLS encryption and network protection in front of our server, so your connection passes through Cloudflare's network, which may process it in data centres outside your country, including the United States, under standard contractual clauses. See Cloudflare's privacy policy.
- Google provides ads in the free version through AdMob; see section 7.
- Apple delivers push notifications (APNs) and processes App Store purchases. Notification content, such as your display name, how long you have been quiet and (during an alert, if enabled) your location, passes through APNs to reach your contacts. See Apple's privacy policy.
7. Advertising (free version)
The free version of Lamplight shows ads provided by Google AdMob (Google LLC / Google Ireland Limited). Lamplight Pro removes all ads. We place ads away from the moments that matter: check-ins, "Are you OK?" prompts, alerts, and the screens your contacts use during an alert.
What the ad SDK may collect. To show and measure ads and to prevent fraud, Google's AdMob SDK running in the app may collect: device and app identifiers (including, only if you allow tracking, Apple's Advertising Identifier, IDFA), your IP address and the approximate location derived from it, device and app information (model, OS version, language, app version), ad interactions (which ads were shown or tapped) and diagnostic data about ad performance and crashes. Google processes this under its own policies: How Google uses information from sites or apps that use its services and Google Privacy Policy.
What advertisers never get. Your safety data: activity timestamps, check-ins, alerts, contacts, display name and location are never sent to Google or any advertiser, and are never used to target ads.
Your choices.
- Personalised or not: ads are personalised only if you allow tracking when iOS asks (App Tracking Transparency). If you decline, Google can't use the IDFA and you see non-personalised (contextual) ads. You can change this at any time in Settings → Privacy & Security → Tracking.
- EU, EEA, UK and Switzerland: before any ads are requested, the app shows Google's consent form (Google User Messaging Platform, certified under the IAB Transparency & Consent Framework). You can accept, reject or choose purposes, and you can reopen the form at any time from the app's Settings → Privacy & ads.
- US state privacy laws: where applicable, the consent form also lets you opt out of the "sale" or "sharing" of personal information for targeted advertising.
- No ads at all: buy Lamplight Pro.
Retention. We don't receive or store ad data ourselves. Google retains it according to its own policies; see the links above.
8. Purchases
Lamplight Pro is sold through the App Store. Apple processes payments; we never receive your payment details. Apple may provide us with aggregated, non-identifying sales reports.
9. Why we may use it (legal bases)
Where the GDPR, UK GDPR, KVKK or similar laws apply, we rely on:
- Performance of our contract with you for running the check-in and alert service you asked for.
- Your consent for optional location sharing, an optional display name, and personalised ads (collected through Google's consent form and App Tracking Transparency). You can withdraw consent at any time in the app.
- Our legitimate interests in keeping the service secure and reliable (for example, the alert log for diagnosing failed notifications), balanced against your privacy through short retention.
10. Your choices and rights
- Change your quiet period, quiet hours, mode, display name and location sharing at any time in the app.
- Revoke notification, motion, health, location or tracking permissions in iOS Settings.
- Change your ad choices in the app's Settings → Privacy & ads, or remove ads with Lamplight Pro.
- Delete your account and all server data from the app's Settings.
Depending on where you live, you may have rights to access, correct, delete, restrict or object to processing of your data, to data portability, and to complain to your data protection authority. Because accounts are anonymous, we may need you to send the request from the app or include your account ID so we can find your data. Contact [email protected].
If you email us for support, we use your email address and message only to reply, and keep them only as long as needed for that purpose.
11. Children
Lamplight is not directed at children under 13 (or under 16 in the EU/UK without parental consent). Ads are not targeted at children, and we don't knowingly collect data from children.
12. Security
All connections use HTTPS. Device secrets are stored only as hashes, invite codes are short-lived, and we keep as little data as possible so there is little to lose. No system is perfectly secure, so please keep your phone locked with a passcode.
13. Changes and contact
If we change how Lamplight handles data, we will update this policy and its effective date, and where required ask for your consent in the app first.
Sintios · [email protected] · Lamplight support