Security

How we protect LUUA and the data of the families, schools and organizations that use it. This page sums up our practices in plain language. It covers this website and shop (luuaplay.com) and the LUUA app (app.luuaplay.com and the apps for iPhone and Android).

1 Our commitments

• We encrypt your data in transit and at rest.
• We limit access: each account sees only its own data, and our team only what their work requires.
• We do not sell or rent personal data, and we do not share it for advertising.
• We notify you without undue delay if a security incident affects your data.
• We publish service status and important changes on System status and What’s new.

2 This website and shop

• HTTPS everywhere: every page of luuaplay.com is served over an encrypted connection.
• Payments: card details go straight to Stripe, our payment processor. We never see or store full card numbers.
• No accounts here: you can browse and buy without creating an account, and children are never asked to log in.
• No tracking: we run no analytics and no advertising tracking on this website. Our hosting provider keeps standard server logs for a short period, never more than 30 days.

What this website collects and why is explained in the Privacy Policy.

3 Encryption in the app

This section and the next three describe the LUUA app.

• In transit: every connection to LUUA, from the web, the apps and the API, is encrypted with HTTPS (TLS). The app tells browsers to always use HTTPS (HSTS).
• At rest: the database and files are stored encrypted with AES-256 on our providers’ infrastructure.
• Passwords: never stored in readable text. They are kept as a hash (bcrypt), which cannot be reversed.
• Videos: played through signed links that expire.

4 Access control

• Per-account isolation: rules in the database itself (row-level security) let each account read and change only its own records. It does not depend on the application alone.
• Schools and companies: an organization’s administrator only sees the people in that organization. Mood and journal entries are shown only as anonymous summaries with a minimum number of people.
• LUUA team: access follows the principle of least privilege, so each person gets only the permissions their work requires, and it is reviewed periodically.
• Security log: sign-ins and important administrative actions are recorded.

5 Account protection

• Passwords: at least 8 characters, with uppercase, lowercase, numbers and symbols.
• Repeated attempts: the account locks temporarily after several failed attempts, and there are attempt limits per IP address.
• Sessions: on the web they end automatically after a maximum of 7 days.
• Two-step verification: available for the LUUA team’s administrative accounts.
• Children under 13: they do not have their own account. They take part as a profile inside an adult’s account or through their school.

6 Secure development

• Controlled changes: code is merged through pull requests, with automated type checks and tests before release.
• Dependencies: we monitor security alerts for the libraries we use and apply the fixes.
• Separate environments: testing and production use different databases, and our policies do not allow real customer data in testing.
• Secrets: keys and credentials are kept out of the source code.

7 Providers and infrastructure

LUUA runs on managed infrastructure, with no servers of our own. These providers use the data only on our behalf.

The LUUA app

• Supabase: database, sign-in and file storage.
• Vercel: hosting of the app and its API.
• Cloudflare (Cloudflare Stream): delivery of videos.
• Resend: sending LUUA emails.
• Upstash: temporary abuse-protection counters.

This website and shop

• Vercel: hosting.
• Stripe: payments.
• Calendly: booking a call.

We assess each provider’s security before sharing data with it and review critical providers at least once a year. They may process data in the United States and in other countries where they operate. The details are in this site’s Privacy Policy and in the LUUA app Privacy Policy.

8 Incidents and continuity

• Response plan: every report is logged, classified by severity, contained and investigated until the cause is found.
• Notice: if an incident affects your data, we will notify you without undue delay and as required by law and by our contracts.
• Annual review: the plan requires that it be reviewed and tested at least once a year.
• Continuity: we have a continuity and recovery plan to restore the service as soon as possible if a provider fails.
• Transparency: service status and the incidents that affect it are published on System status.

9 Policies and compliance program

Our security policies are approved by management, apply to the whole team and to contractors, and are reviewed at least once a year. They cover, among other topics, access control, encryption, secure development, provider management, incident response and continuity.

LUUA is implementing a security program aligned with the SOC 2 criteria, with continuous monitoring of controls. The program is in progress: we do not yet have an audit report. When one exists, we will say so on this page.

10 Report a security issue

If you believe you have found a vulnerability, or you notice something suspicious in your account, write to contact@luuaplay.com with the subject “Security”.

• Tell us what you found and the steps to reproduce it.
• Do not access or change other people’s data, and do not affect the availability of the service.
• Give us reasonable time to fix it before making it public.

We review every report we receive. For now we do not offer monetary rewards.