Last updated: 2 October 2026 Version: 2026-10-02
This policy explains what Light Free Universe collects, why, and what you can do about it. Light Free Universe is operated by Light Free Universe, California, United States.
Questions or requests: [email protected]
| What | When | Why |
|---|---|---|
| Email address | Signing up | Logging in, account recovery, service notices |
| Password | Signing up | Stored only as an irreversible hash, never in readable form |
| Display name | Signing up | Shown publicly on your posts and profile |
| Date of birth | Signing up | Checking you meet the minimum age. Never shown publicly |
| Bio and avatar | If you add them | Shown publicly on your profile |
| Posts, replies, likes | When you create them | The core of the service |
| Images and video | If you attach them | Displayed with your posts |
| Direct messages | When you send them | Delivering them to the recipient |
| Reports and blocks | When you use them | Moderation and safety |
| Questions to the Ask feature | When you ask | Generating an answer, and limiting abuse |
We count visits ourselves, on our own server. No analytics company is involved, no script from anyone else runs on these pages, and nothing about your visit is sent to any third party.
What is stored is a set of counters: for each day, each page, each country and each referring site, a number. For example — 3 views of /terms from Germany, referred by news.ycombinator.com, on 14 June.
What is not stored:
/post/abc123 is counted as /post/:id. We can see how many people read posts; we cannot see which post you read.We don't collect your location beyond the country described above, your contacts, your browsing history outside the app, or any advertising identifier. We use no third-party analytics.
The app uses no cookies. Signing in stores an authentication token on your device — in the system keychain on mobile, or in browser storage on the web. That storage is necessary for a login you asked for, and isn't used to track you.
These companies process data on our instruction. They aren't allowed to use it for their own purposes.
| Company | What they receive | Why |
|---|---|---|
| DigitalOcean | Everything stored in the app — your account, posts, replies, messages, and the images and video you upload | Hosting the service, the database and the file storage |
| Anthropic | Your Ask question, plus the text of posts that match it | Generating the answer |
| Apple / Google push services | Notification titles, and the text of the post being notified about | Delivering notifications to your device |
Worth being explicit about the last one. A push notification is handed to Apple or Google to deliver, so whatever is in it passes through their infrastructure. That's how push works on every app.
Direct messages are the exception we made deliberately. A message notification tells you that someone sent you a message and carries none of its text — not in the notification, not in the copy we store. Replies, likes and mentions do carry a short preview, because that text is a public post already and there is nothing in it to protect.
We may also disclose information if legally required to, or to prevent imminent harm. We'll tell you when we're permitted to.
Message contents are encrypted where they're stored, using AES-256-GCM. If our database were stolen, the messages in it would be unreadable without keys held separately.
This is not end-to-end encryption. We hold the keys. In practice that means:
We built it this way deliberately. End-to-end encryption would make it impossible to act on a reported message, and app store rules require us to be able to respond to reports. If you need correspondence nobody but the recipient can read, use a dedicated end-to-end encrypted messenger.
When you read a message, we record that you did. It drives your unread count, and it is what shows the sender "Seen". You can turn read receipts off in Settings, and doing so also stops you seeing other people's — the setting works both ways, so it can't be used to watch without being watched.
Deleting a message removes its text from our database, not just from the screen. A marker stays in its place so the conversation still makes sense to whoever you were talking to.
Reactions record which of six symbols you tapped, on which message. There is no free text in a reaction.
| Data | Retained |
|---|---|
| Account and profile | Until you delete your account |
| Posts and replies | Until you or we delete them |
| Direct messages | Until either participant deletes their account |
| Push tokens | Until you sign out, or the token stops working |
| Ask questions | 12 months |
| Server logs with IP addresses | 30 days |
| Page counters (no personal data) | Kept indefinitely |
| Reports | 2 years after resolution |
Settings → Delete account. It asks for your password and then acts immediately. Specifically:
Nothing is retained after deletion.
Depending on where you live, you can ask us to give you a copy of your data, correct it, delete it, restrict or object to how we use it, or send it elsewhere in a portable format. You can also complain to your local data protection authority.
Email [email protected]. We'll respond within 30 days. We won't charge you or treat you differently for asking.
Light Free Universe is not for anyone under 13, and we refuse accounts for anyone who tells us they're younger. When that happens we don't store the attempt — the date of birth is checked and discarded without being written down.
If you believe a child under 13 has an account, email [email protected] and we'll remove it.
We're based in the United States. Our service providers may process data elsewhere, including the United States. Where required, those transfers rely on Standard Contractual Clauses or equivalent safeguards.
Passwords are hashed with argon2. Message contents are encrypted at rest. Traffic uses HTTPS. Auth tokens are short-lived and refresh tokens are stored hashed, so they can be revoked individually.
No system is perfectly secure. If we discover a breach affecting you, we'll notify you and the relevant authority as the law requires.
If we change this policy materially, we'll tell you in the app before the change takes effect, and you'll be asked to accept the updated version.