Privacy Policy

Last updated: August 5, 2026 · Effective: August 5, 2026

LuluCare is developed and operated by Shanghai Fluffy Cat Technology Co., Ltd. ("LuluCare," "we," "us," or "our"). This Privacy Policy explains how we collect, use, store, share, and protect information when you use the LuluCare app and related services.

1. Information We Collect

The exact information depends on your app version, device, region, and the features you choose to use.

• Account and sign-in information: LuluCare creates an internal account for you. If phone, Sign in with Apple, or Google Sign-In is available and you choose or are required to use it, we process the phone number or the stable account identifier supplied by Apple or Google. We do not receive your Apple or Google password. SMS verification codes and challenges are used only to verify the phone number and expire after a short period.
• Recovery phrase: if you create a recovery phrase, the 12 words are generated on your device and shown to you once. When you create the phrase or use it to recover an account, the words are sent to us over an encrypted connection so that we can derive an irreversible verifier from them. We store only that verifier — we never store the words themselves, and we cannot show them to you again or recover them for you. The recovery phrase is used solely to identify which account to restore. It is not an encryption key: it does not encrypt your conversations, journals, or any other content, and it does not prevent us from accessing that content as described in this policy. Anyone who obtains your 12 words can recover your account, so keep them private.
• Device and app information: device model, operating system and app version, language, time zone, storefront or installation channel, network information such as IP address, and device identifiers such as IDFV on iOS or Android ID on Android. We use these details to operate the service, secure accounts, prevent abuse, and diagnose problems.
• Content you provide: messages, images you choose to send, voice input and transcripts, journal entries, feedback, and support communications. Voice input may be transmitted to a speech service for transcription.
• Profile information: optional details such as nickname, birthday, gender, self-introduction, preferences, or topics you want LuluCare to avoid.
• Purchase information: product, order, transaction, price, currency, and entitlement status. Payments are completed by Apple, Google Play, Alipay, Huawei, or another applicable payment provider. We do not receive your full card number or payment password.
• Usage and diagnostics: feature interactions, session and event information, crash reports, performance data, and security or fraud signals.

2. How We Use Information

• provide AI conversations, speech features, journals, account continuity, and other requested features;
• create, authenticate, recover, link, and protect your account;
• process purchases, maintain entitlements, and reconcile transactions;
• operate, troubleshoot, analyze, and improve LuluCare;
• prevent fraud, misuse, and security incidents; and
• meet legal obligations and enforce our terms.

We do not sell your personal information, and we do not use your private conversations for third-party advertising.

3. AI and Sensitive Content

LuluCare is designed for private reflection and emotional support, so the content you provide may contain sensitive personal information. To generate responses or transcripts, relevant content is sent to AI model or speech service providers acting on our behalf. We limit the information shared to what is needed for the requested function.

AI-generated responses provide general emotional support and self-growth information only. They are not medical advice, diagnosis, treatment, or emergency services.

4. How We Share Information

We share information only as needed to provide and protect LuluCare, including with:

• AI model and speech providers that generate responses or transcribe voice input;
• Authentication and messaging providers, including Apple, Google, and SMS delivery providers, when you use the corresponding sign-in or phone verification method;
• Payment and app-store providers, including Apple, Google Play, Alipay, and Huawei, as applicable to your device and distribution channel;
• Hosting, security, analytics, push notification, crash, and performance providers, such as Sentry and the applicable Apple or Google notification service; and
• Authorities or other parties when required by law, necessary to protect rights and safety, or involved in a corporate transaction subject to appropriate safeguards.

These providers may process information under their own privacy terms when they act independently, such as an app store or payment provider.

5. Account Linking

Phone, Apple, Google, and recovery phrase methods are used for account access, security, and recovery. When you bind a method, its identifier — or, for a recovery phrase, the irreversible verifier derived from your words — is associated with your internal LuluCare account and the content already stored in that account. You can manage or unbind available methods in the app. Turning off a recovery phrase takes effect immediately and can leave your account without any recovery method; the device you are currently using stays signed in, but you may be unable to recover the account if you lose that device.

Recovering an account with a recovery phrase moves only the device you are using. Accounts are never merged: the content in the account you are leaving is not copied across, and other devices signed in to the recovered account are signed out.

6. Retention

• SMS verification challenges expire within minutes and are retained only as needed for verification and security.
• Account identifiers are generally retained while the method remains linked and while your account is active.
• Conversations, journals, and profile data are retained until you delete the content or delete your account.
• Limited transaction, security, fraud-prevention, backup, and legal records may be retained longer where reasonably necessary or required by law.

7. International Transfers

Your information may be processed in countries or regions other than where you live, including where our service providers operate. We use reasonable contractual, technical, and organizational safeguards for these transfers as required by applicable law.

8. Security

We use measures such as encrypted network transmission, access controls, and service monitoring to protect information. No system is completely secure, so we cannot guarantee absolute security.

9. Your Choices and Rights

• Access and correction: review and update available profile information in the app.
• Deletion: delete supported conversations, journals, or other content in the app.
• Authentication methods: manage available phone, Apple, Google, or recovery phrase bindings in account settings.
• Account deletion: delete your account in LuluCare settings or follow the instructions on our Account Deletion page.
• Other rights: depending on where you live, you may have additional rights to access, correct, delete, restrict, object to, or receive a copy of your personal information.

We may need to verify your request. We will respond within the period required by applicable law.

10. Children

LuluCare is intended for users aged 16 or older. We do not knowingly collect personal information from children under 16. If you believe a child has provided information to us, contact us so we can review and delete it as appropriate.

11. Changes to This Policy

We may update this policy as LuluCare or applicable requirements change. We will post the revised policy here and provide additional notice in the app when a change is material.

12. Contact Us

For privacy questions, complaints, or requests, contact:

• Shanghai Fluffy Cat Technology Co., Ltd.
• Email: support@lulucare.app