Privacy Policy

Last updated: 12 June 2026

This explains what data Lerya collects and what we do with it. We follow the EU General Data Protection Regulation (GDPR) and Brazil's Lei Geral de Proteção de Dados (LGPD, Lei nº 13.709/2018).

Who we are

For data questions, contact privacy@lerya.app.

What we collect

Account data:

Email address (to sign in and contact you about your account)
Display name, username, optional bio, optional location, optional avatar
Date of birth (asked once at onboarding, only to confirm you're 16 or older — never shown to anyone)
If you sign in with Google, we receive your email address and basic profile (name, avatar) from Google

Content you create:

Captures (photo, extracted palette, optional title, location, tag, note)
Palettes, lists, and comments you make
People you follow, and captures you save or like

Technical data:

A session token to keep you signed in
A log of sign-in events (event type, sign-in method, timestamp), kept for security
A log of emails we sent you (address, delivery status), kept to honor unsubscribe requests

We don't collect analytics, tracking pixels, advertising IDs, or third-party trackers. We don't sell or share your data with advertisers.

Why we process it

To run the service you signed up for (legal basis: contract)
To keep your account secure (legal basis: legitimate interest)
To meet legal obligations if they arise (legal basis: legal obligation)

Under the LGPD, these correspond to the legal bases in article 7: performance of a contract, legitimate interest, and compliance with a legal obligation.

Where your data lives

Lerya runs on Supabase, hosted in the European Union. Public captures are visible to other users. Private captures are visible only to you. For users in Brazil, storing data in the EU is an international transfer under article 33 of the LGPD; it's protected by the safeguards described in this policy and by our processors' contractual commitments.

How long we keep it

Account and content: until you delete them
After account deletion: backups may persist up to 30 days, then are erased
Sign-in and email delivery logs: up to 12 months

Your rights

You can access, correct, delete, restrict, or export your data, and withdraw consent. Under the LGPD (article 18) you can also ask for confirmation that we process your data, anonymization of unnecessary data, information about any sharing, and revocation of consent.

To exercise any right, write to privacy@lerya.app — this address also reaches our data protection contact (encarregado, under the LGPD). We respond within 30 days. You can lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) or, in Brazil, with the ANPD (Autoridade Nacional de Proteção de Dados).

Children

You must be 16 or older. Your date of birth is used solely for this check. If we learn an account belongs to someone younger, we close it.

Changes

We'll tell you in the app before a change to this policy that affects you takes effect.

Contact

privacy@lerya.app