Effective: 16 July 2026 · Contact / Grievance Officer (DPDP §13): app.help.suppot@gmail.com, Mudit, Delhi, India
Lori ("we") is a cultural family diary app — a place for parents to record everyday baby moments and celebrate traditions. Lori is a lifestyle app, not a medical or health service, and provides no advice of any kind. This policy explains what we collect and your rights under India's Digital Personal Data Protection Act, 2023 (DPDP) and, where applicable, GDPR/UK-GDPR/CCPA.
Accounts are for adults (18+): parents, guardians and family members. Children never hold accounts. Guardians enter information about their child; by doing so you confirm you are the child's parent/lawful guardian and consent to its processing as described here (DPDP §9).
We do not collect precise location, contacts, or advertising identifiers. No ads. Personal data is never sold.
To run the service you asked for (a synced family diary, cultural content, and the AI features you trigger), to secure accounts, and to meet legal duties. Basis: consent and performance of the service (DPDP §4–7).
Cultural insights, weekly rhythm recaps, voice-note structuring and name ideas send the minimum relevant text to our AI processor (Moonshot AI "Kimi") via our server under a pseudonymous ID. Your data is not used to train models. Outputs are cultural and observational content, never advice.
Only with: (a) family members you invite by code (view-only members see diary entries and photos); (b) processors under contract — Supabase (database/storage; encrypted in transit and at rest) and Moonshot AI; (c) Google Fonts (fonts.gstatic.com), which serves the app's typefaces and, like any web request, receives your device's IP address — no account, cookies, or tracking; (d) authorities where law requires. No brokers, no advertisers.
Kept while your account is active. Delete in-app (Settings → Delete my account): access ends immediately; personal data is erased from live systems within 7 days, backups within 30. Or write to app.help.suppot@gmail.com.
Access, correction, erasure, grievance redressal, nomination — via the Grievance Officer above; statutory timelines apply; escalation to the Data Protection Board of India. GDPR/CCPA residents hold the equivalent rights; under CCPA, data is not sold or shared.
TLS 1.2+ in transit; AES-256 at rest; row-level security isolating each family; server-side AI keys; least-privilege access.
Processed only as directed by guardians, solely to run the family diary — never for tracking, advertising, or profiling of children (DPDP §9). The app is not child-directed; its users are adults.
Hosted in Mumbai (ap-south-1); contractual safeguards apply for any cross-border processing.
Material changes are notified in-app before taking effect.