Privacy Policy
Lamplight is a quiet place to sit and work. We built it to know as little about you as possible. This page says what the app does with data, in plain words.
The short version
- You can use Lamplight without signing up or sharing an email.
- Other people in a room see a lamp and, if they tap it, a name. There are no profiles, no chat, and no social graph.
- We keep no diary of your focus. Your desk stores simple totals, like how far your plant has grown.
- We don't sell data, show ads, or track you across other apps and websites.
- You can delete your account and its data from inside the app.
What the app stores, and why
An anonymous account. When you first open Lamplight, our backend creates an anonymous account with a random ID. It exists so your desk can remember you between visits. It carries no email. It does carry the name your lamp shows in shared rooms (see below).
Your email address, only if you choose to sign in. Signing in is optional. If you do, we store your email and use it for exactly two things: sending you a one-time sign-in code, and letting you return to your desk from a new phone. No marketing email, ever.
Your desk. The state of your desk in each room: how far the plant has grown (a total that reflects time spent in that room), the species you chose, and small personalizations. Stored against your account ID so it's there when you come back. Each desk also carries the date it was created and the date it last changed, so we know roughly when you were last in that room. There is no session history stored with your desk: no start times, no durations, no calendar. When Lamplight Plus arrived, we also kept a one-time list of which rooms each account had sat in, so those rooms stay open; it is deleted with your account.
Presence. While you sit in a shared room, the room shows others an anonymous occupied desk, a lit lamp, and whether you're at a laptop, a book, or a journal. Underneath, your device shares your random account ID and the time you sat down with the other people in the room, so everyone's desk stays in the right place. That ID is a string of random characters. The app uses it to look up the name your lamp shows, and nothing else. While you sit, our server keeps one row saying which room and seat you are in and what you work at, so everyone sees the same room. It is deleted within a couple of minutes of leaving. In private rooms, the display name you enter is shared the same way, only with the people in that room, only while you're there.
Your name in a room. The first time you sit in a shared room, the app gives your lamp a two-word name from our lists. You can pick another or type your own; a typed name is checked against a word list by the app and our server. After that, it can change three times in seven days. The name is stored on your account, and anyone sitting in a room with you, signed in or not, can tap your lamp to see it. A typed name can be a real name, so it is personal data: its only purpose is recognition in a room, and it is kept as long as your account. The house rules say what a name may not be.
Reports and blocks. A report stores your account ID, the other account's ID, the name you saw, the name on our server, and your chosen reason. Reports are emailed to us through Resend so a person reads them. If you block someone, the pair of account IDs is stored, and neither of you sees the other's lamp or name until you unblock. Deleting your account removes your name, your blocks, and reports about you. Reports you filed stay without your account ID, as do report emails already sent, and reports are deleted after twelve months. A typed name we reset under the house rules stays on the word list.
Private room codes. Codes are how friends find each other's rooms. We treat them like secrets: they are never recorded in our analytics.
Purchases. Lamplight Plus and the tip jar are bought through the App Store. To know whether Plus is active on your device, the app uses RevenueCat, a purchase service. RevenueCat holds your App Store receipt under a random ID it makes up for your install; that ID is not your account ID, your email, or your name, and we never join the two. Whether you pay is never shown to anyone in a room. When you first open the app, RevenueCat also asks Apple whether this install came from an Apple Ads campaign on the App Store, using a token Apple issues for that one purpose. Apple answers yes or no and, if yes, which campaign, ad group, keyword and country it was. Apple says the answer does not identify you or your device. It does not track you across other apps or websites, so the app never asks for tracking permission.
Notes you send us. The app has a "Send us a note" form in Settings. A note stores what you wrote, the reply address if you chose to give one, the room you were in, the app version, and which update of the app you were running. A plain-text copy is emailed to our inbox through Resend so a person reads it. If you gave an address, we use it only to reply to you. Notes are deleted after twelve months. To have a note removed sooner, including the copy in our inbox, write to hello@lamplight.place.
Anonymous usage signals. We count things like "a room was opened" or "a session finished" so we can tell whether the app is healthy. These events carry no account ID, no device identifier, and no advertising identifier, so there's nothing in them that points back to your account. What they do carry is the event name, the room (private rooms are counted simply as "private"), the length of a session preset when there is one, the plan chosen when someone starts Plus, the room whose music you picked and the weather, your phone's OS version, the app version, and a random ID that groups one run of the app together. We use Aptabase, an analytics service built for exactly this kind of minimal counting. Like any internet request, sending these shares your device's IP address with Aptabase. It isn't used to identify you.
What never leaves your phone
- Photos you place in the desk frame. Picking a photo copies that one photo into the app's own storage on your device. It is never uploaded anywhere, and the app never reads the rest of your library.
- The way you hold your phone. Lamplight reads the motion sensor to turn the room the way you turned the phone. That reading stays on the device.
- Music you've already downloaded, your sound mix, room and weather choices, and app settings.
Music and sounds
Music streams from our content server, hosted on Cloudflare. Like any internet request, fetching a track shares your device's IP address with the server for the duration of the request. We don't use IP addresses to identify or profile you. The list of available tracks comes from our Supabase database when the app opens. By default, downloading new tracks waits for Wi-Fi. On cellular, the app plays the music it already has, unless you turn on cellular downloads.
Who processes data for us
- Supabase hosts accounts, presence, the desk database, and the music track list.
- Cloudflare stores and delivers the music files.
- Aptabase counts the anonymous usage signals.
- Resend sends your one-time sign-in code to your email address, and delivers name reports and your notes to us.
- RevenueCat keeps the App Store receipt that says whether Plus is active, under its own random ID.
- Apple handles every payment and, through RevenueCat, the one-time ad attribution check described above.
These providers process data only to run the service. Each of them is bound to protect that data at least as carefully as this policy does. We don't sell personal data, and we don't share it for advertising.
What Lamplight doesn't do
There are no ads and no tracking software in the app, so it never asks to track you across other apps and websites. The one ad-related thing it does, the Apple Ads check, is described under "Purchases" above and does not identify you. It doesn't use push notifications, crash reporting, or your location.
Deleting your account or your data
Open the lobby, tap the gear at the top right, and use the control at the foot of "Your account". If you're signed in it reads "Delete my account"; as a guest it reads "Erase my desks", because a guest has no account to delete, only desks and the anonymous record behind them. Either way it removes everything stored on our side, including your desks (the exceptions: reports you filed and report emails, described in "Reports and blocks"; the emailed copy of any note you sent us, which we remove when you ask; and the purchase record that Apple and RevenueCat keep, which carries none of your account details), and clears the app's own data on this device: your frame photos, downloaded music, and settings. The control appears once there is something to clear, so a fresh install shows it after your first sit. If anything goes wrong, email us at hello@lamplight.place and we'll take care of it.
Children
Lamplight is not directed at children under 13, and we don't knowingly collect personal information from them.
Changes
If this policy changes, the current version will always live at this page, with its effective date above.
Contact
Questions about any of this: hello@lamplight.place