Comunidy Privacy Policy

About this policy

Comunidy is operated by Lumen Core LLC ("Comunidy," "we," "us," or "our"). This policy describes how we handle information in the Comunidy mobile application and related services for private communities.

Information we process

We process information used to provide the service, including:

• account and profile information, such as name, email address, account identifier, profile photo, authentication information, and selected community;
• community memberships, roles, invitations, organizer assignments, and administrative actions;
• family information entered and managed by adults, including family relationships, child names, birth month and year, optional profile photos, guardian relationships, participation history, and parent or guardian confirmations of a child's age-band eligibility for a selected Event or the first Class session. The age-band confirmation does not collect the child's full birth date. Historical child gender values may remain in existing records, but the current app does not collect or edit that field;
• messages, attachments, voice messages, polls, announcements, Event and Class descriptions, Resources and files, and related moderation records;
• participation information, such as RSVPs, selected attendees, enrollments, waitlists, cancellations, and organizer actions;
• an adult or guardian contact number for Event and Class registration, saved on the registering account and shared with authorized activity roster managers, including their roster exports. It is not used for SMS sign-in or displayed in the general member directory;
• transaction information, such as payment and subscription status, Member+ status, Contributions and their optional private notes, refunds, disputes, amounts, currencies, and payment-provider references. Full payment-card numbers entered on Stripe-hosted payment pages are not received or stored by Comunidy;
• payment-recipient information supplied during community payment setup, including the recipient's name and entity type, authorized payment operators, connected Stripe account identifiers, and account-readiness status. Stripe collects information through its hosted verification process; Comunidy uses account and status information to operate the connection and show appropriate next steps to authorized payment operators;
• push-notification tokens, device identifiers used for delivery, app interactions, delivery status, and security or abuse-control events;
• Resource Activity records linked to the acting account, community, and Resource, used to provide authorized community usage information; and
• support, privacy, safety, and deletion communications that you send to us.

Security and abuse controls may process network information, including IP-related information, and retain one-way fingerprints and limited records of blocked or limited activity. These controls protect accounts, communities, and service availability; they are not advertising profiles.

How we use information

We use information to authenticate users; operate private communities; provide family, Event, Class, Resource, messaging, notification, Member+, Contribution, payment, refund, and deletion features; handle privacy requests; provide Resource Activity information; maintain safety; prevent abuse and fraud; provide support; meet applicable legal and accounting obligations; and maintain service reliability.

We do not sell personal information. We do not use uploaded resource files, private messages, or family records to build advertising profiles. We do not use advertising or cross-app tracking SDKs.

Who can see information

Access depends on account, community, role, household, conversation, content-visibility, and participation permissions. Community owners, administrators, organizers, and assigned managers can see information available for their authorized responsibilities. Members may see identity and content shared with an authorized community or conversation. Leaving a community ends ongoing access to that community; it does not necessarily erase historical records already shared there or end separate household access.

Household relationships and child profiles are managed at the account level and can be used by authorized adults when registering in communities they are permitted to access. Participation and payment records remain associated with the relevant community. Child profiles are managed through authorized adult household relationships, not separate child sign-in accounts. A community administrative role or Member+ status alone does not grant household authority over child profiles or their private photos. Child identity can appear in authorized household, roster, participation, safety, and community-management contexts; it is not intended for public discovery.

Guardian invitations are bound to the intended recipient's email and the relevant household. Accepting an invitation requires the matching account and an eligible invitation. Current household invitations grant household access, not community membership. Earlier community-bound invitations may also require access to that community. Adults should provide only information they are authorized to share.

Service providers

Comunidy uses:

• Supabase for authentication, database, realtime communication, and private file storage;
• Railway for application hosting and background services;
• Cloudflare for public website delivery, API-edge security, and sign-in bot checks on Web and in the app. These services can process requests, network information (including IP addresses), browser/device signals, and security metadata. The bot-check page does not receive your email, account profile, messages, or family records;
• Resend for transactional email delivery and delivery events;
• Stripe for hosted payment-account setup and verification, checkout, community payments, subscriptions, refunds, disputes, and related payment records;
• Expo for push-notification delivery; and
• Apple and Google platform services for app distribution and operating-system capabilities, including notifications and links.

These providers process information for the services they supply, including security and compliance, under their applicable terms and privacy commitments. Comunidy's Resource Activity feature is separate from advertising or cross-app tracking.

Notifications and email

Comunidy sends service communications for authentication, account or community access, safety, guardian invitations, participation, important Event or Class changes, waitlists, payments, refunds, Contributions, and Member+ status. Communications needed to provide or secure the service are separate from optional alerts.

Users can manage optional new-Event, new-Class, message-push, and Resource alerts for each active community. Comunidy does not currently send marketing email.

Payments

Eligible paid Events, paid Classes, Contributions, and Member+ subscriptions use Stripe-hosted checkout for the community's connected Stripe account. Comunidy's current platform fee is 0%. Stripe processing fees and other provider charges are separate and are the connected account's responsibility under its provider agreement.

Refund availability depends on the purchase, community, and payment status. Cancellation does not guarantee a refund. Refunds can reduce the community's connected-account balance, and original provider processing, Connect, or currency-conversion fees may not be returned.

Retention and account deletion

Retention varies by record and purpose. Information may remain for service operation, security, fraud prevention, safety, accounting, disputes, legal obligations, and community history.

To delete your account, open Account → Account Actions → Delete account in Comunidy. The app shows any requirements that must first be resolved. These can include community or payment-account ownership, family responsibility, active Member+ or subscriptions, Event or Class participation, or unfinished payment and refund work. Follow the displayed requirements and confirmations. Contact Comunidy Support if you cannot access your account or need help.

Completed account deletion permanently ends your Comunidy sign-in and access. Your profile name is replaced with "Deleted member," and your profile photo, device tokens, and account-specific read and delivery state are removed. Your messages, attachments, announcements, and uploaded resources are permanently deleted, including from other members’ views. Family and child records can remain for other authorized guardians and safety history. Payment, refund, dispute, participation, invitation, and audit records may also remain for the purposes described above. Retained financial and other records are not a promise that every associated identifier or piece of information has been erased or anonymized.

After you request account deletion, Comunidy works to end your subscriptions and access and cancel eligible individual registrations. Required handoffs and unfinished payment obligations can delay completion. Do not assume billing has ended until cancellation is confirmed. Account deletion does not guarantee a refund. Leaving a community is different: your account remains active while access to that community ends. Archiving a child profile removes it from new registration choices, but preserves historical participation and related records. Deleting a conversation from your view is also separate from deleting your account.

Your choices and privacy requests

You can edit your account name and photo, manage supported family details and notification preferences, leave communities where permitted, and request account deletion in the app.

For access, correction, export, deletion assistance, or other privacy questions, use Comunidy Support. The current app does not offer a self-service data-download control. A request for information must account for the rights and privacy of other people, including children, other guardians, and conversation participants; it is not a promise to provide every shared message, file, roster, or provider record. We may need to verify your identity and authority before handling a request.

Do not send passwords, sign-in links, payment-card numbers, or unnecessary child information in a support request.

Security

Comunidy uses authenticated access, community- and role-based permissions, private storage controls, encrypted transport supplied by its providers, provider-hosted payment entry, and abuse controls. No system can guarantee absolute security.

Changes and contact

We may update this policy as the service changes. The public page identifies its update date. Privacy questions and requests should use Comunidy Support.