Privacy Policy
Super Light Stage
This policy explains how this application handles information and how to contact us about privacy.
Information we process
Super Light Stage stores your lighting drafts, saved scheme names, scene and format choices, lamp positions and settings, reference choices, imported photos, and display and language preferences locally on your iPhone. The optional backup sends saved scheme names, scene and format choices, lamp settings, built-in reference identifiers, and update timestamps to our server. Imported photo files are not uploaded and local photo identifiers are removed from backups. The app creates a random installation secret only when you use backup or retrieval; it is kept in the device Keychain and only its hash is stored on the server. No account, name, email address or password is requested. Requests to the API and public website expose connection information such as IP address, request time, path, status and user-agent to our hosting infrastructure. The application server records request identifiers and technical error codes, not request bodies or authorization secrets. It temporarily keeps connection addresses and request counters in memory to limit installation creation.
How we use information
Local information lets you edit lighting, reopen your work, use reference photos and export images. Optional server storage lets the same installation back up and retrieve saved schemes. Installation secrets authorize access to private backup data. Connection information, temporary request counters and technical errors support delivery, security, abuse prevention and troubleshooting. We do not use advertising or analytics SDKs, sell data, send marketing messages, or provide user accounts.
Service providers and sharing
The public API and website use Cloudflare as a reverse proxy that terminates public HTTPS and forwards requests to our Railway service. Cloudflare processes connection information, request URLs and headers, and the API data carried by those requests to deliver and protect the service. The backend and PostgreSQL database are hosted on Railway. Railway and its infrastructure providers process hosted scheme data and technical connection information to operate the service. Apple system Photos and Keychain features are used on your device; exported images are added to your photo library and may sync under your own Apple settings. The app has no advertising, social sign-in or third-party analytics recipients. We may disclose information if legally required. Opening this public policy contacts Cloudflare and the hosting service.
Data retention
Local drafts, schemes and imported photos remain until you remove them in the app, erase app storage or uninstall the app. Exported images remain in your Photos library until you delete them there. Keychain secrets may remain after uninstalling; uninstalling alone does not delete server backups. Server installations and backed-up schemes remain until the authorized installation deletes them. We have not configured an automatic expiry period for these records. Temporary request counters are held in process memory, with one-hour rate windows and a bounded map, and are lost on process restart. Infrastructure logs and any provider-managed backups follow the applicable Cloudflare and Railway settings and practices; we do not assert a fixed retention duration for them.
Deleting your information
Use Settings to delete local drafts, saved schemes and imported photo copies. This does not delete exported images in Photos or server backups. Use Delete all server data in the app to delete the installation and all its schemes from the active PostgreSQL database and remove its Keychain secret. Local saved schemes remain unless separately deleted. Deleting a single local scheme does not remove a previously uploaded backup; delete server data to remove that backup. Deletion from active storage does not promise immediate removal from infrastructure logs or existing provider backups; any residual copies follow provider retention and are not used as active records. If the installation secret is lost, we cannot recover backup access or associate an anonymous installation with you merely from an email address. Contact Thackery890@icloud.com for privacy questions or deletion concerns, without sending your installation secret.
Permissions and your choices
Import uses the system photo picker, which shares only the images you select without giving this app general library access. Selected image copies are stored locally as references. Export requests add-only Photos permission to save a lighting image. You can refuse export permission and keep editing, revoke permission in iOS Settings, remove a reference, or delete imported copies through local-data deletion. The app does not request location, camera, microphone or contacts permission. No embedded maps are used.
Your privacy rights
Depending on your jurisdiction, you may have rights to access, correct, delete, restrict or object to processing, and to complain to a data protection authority. You can review and edit your local schemes, export lighting images, retrieve backups with your installation secret, and delete local and server data separately. For privacy requests contact Thackery890@icloud.com. We may need information sufficient to identify the relevant data safely; because there are no accounts, we cannot identify your anonymous backup from your email alone. Do not include your installation secret in correspondence.
Security
Private API operations require the automatically generated installation bearer secret and are scoped to that installation on the server. Secrets are random, stored in Keychain on the device, and hashed in PostgreSQL. The app uses HTTPS for deployed communication and platform-protected local file writes. The backend validates and limits request sizes, uses parameterized database queries, and does not log authorization headers or scheme bodies. These measures reduce risk but no storage or transmission method guarantees absolute security. Losing the secret prevents access to that installation’s server data.
Children’s privacy
Super Light Stage is a creative utility intended for general creators, presenters and musicians, not a service directed to children. It does not knowingly request children’s personal information or offer social profiles. If you believe a child has provided personal information, contact Thackery890@icloud.com so we can review the concern using the information available.
Changes to this policy
We may update this policy when processing or product functionality changes. The effective date shown on this page identifies the current version. Review this policy from Settings for current practices. Material changes will be described in an updated policy and, where required, communicated through the app before the changed processing applies.