‹ Versions of the Privacy policy

Legal

Version 4 (16 Oct 2026) compared with version 3 (16 Oct 2026)

Privacy policy · minor change · code 2026-10-v2 replaces 2026-10-v2

What changed

The site moved to vietlume.com. Photos now load straight from Cloudflare (media.vietlume.com), so it sees your IP when a photo loads; email to @vietlume.com passes through Cloudflare. Added support@vietlume.com (contact) and security@vietlume.com (vulnerabilities).

Show changes onlyadded textremoved textAdded, removed and edited blocks carry a label at the top

01Introduction

… 1 unchanged blocks

Edited

This policy covers the vietlume.vercel.app vietlume.com website and the Vietlume app for iPhone, iPad and Android (section 08). The app is not yet on the App Store or Google Play.

11Third-party services

… 1 unchanged blocks

Edited

Vercel, Render, Neon — run the website, the application server and the database, all in Singapore. For the statistics in section 06, the part of the website running on Vercel sees your IP address while passing the request on, and gives Vietlume's application server only the country and province estimated from it; the application server does not store your IP address. Cloudflare R2 — stores the photos on Vietlume, including the ones you upload. upload, and delivers them to your browser from media.vietlume.com, so Cloudflare sees your IP address when a photo loads. Cloudflare also manages the vietlume.com domain and forwards email you send to @vietlume.com addresses to the Vietlume team’s mailbox. Google — Sign in with Google, and the site's fonts: your browser loads them from Google, so Google sees your IP address. OpenFreeMap — the base map; its servers see your IP address and the area you are viewing. Expo, Apple, Google — deliver push notifications to the app: Expo receives your phone’s notification token and passes the notification on through Apple (iPhone) or Google (Android). A notification carries a place name and where to open in the app (for a group room, the room code) — never the text of a comment or another person’s name. Your browser’s push service — Google (Chrome), Mozilla (Firefox), Apple (Safari) or Microsoft (Edge), depending on your browser: delivers notifications to the browser once you turn them on. The content is encrypted before it is sent, so the service sees only the delivery address and the time. Sentry — receives error reports when the site or app breaks: the error message, the failing code, your browser or device type, operating system, app version and the page path (without anything after a ?). Never your name, email, what you wrote or cookies. Sentry sees your IP address when it receives a report but does not store it; it keeps only the country and city estimated from it.

… 1 unchanged blocks

14Security

… 2 unchanged blocks

Added

If you find a security vulnerability, email security@vietlume.com; how to report it and what we commit to are in security.txt.

16Deleting your account

Edited

Delete it under Account → Security (web) or Me → Delete account (app), after entering your password again — or signing in again with Google/Apple if the account has no password. Deleted at once: your account, profile, every avatar you ever uploaded, star ratings, worth-going votes, hearts, saved places and their folders, your trips, every signed-in session, the role-change record if any, your phones’ notification tokens, your browsers’ notification subscriptions, your notification inbox and settings, your follows both ways (people you follow and people who follow you), group-spin invitations, and blocks (people you blocked and anyone's block of you), and your record of agreeing to the terms. Your folders that other people edit with you are deleted too, and places only those folders held are no longer saved for them. You leave every folder of someone else's that you edit, and pending invites are deleted; places you added there stay, without your name. Kept, anonymous: your comments and their photos, shown as "Ẩn*" so other people's replies keep their thread — to remove a comment for good, delete it first. This cannot be undone. A page just for this, usable without the app: vietlume.vercel.app/xoa-tai-khoan.vietlume.com/xoa-tai-khoan.

… 3 unchanged blocks

18Data outside Vietnam

Edited

Your data is stored and processed in Singapore (website, server, database) and on Cloudflare's network (photos). (photos, and email sent to @vietlume.com addresses). Signing in with Google goes through Google's servers in the United States. Error reports go to Sentry's servers in the United States. Push notifications in the app go through Expo's servers in the United States, then Apple's or Google's. Notifications to a browser go through its maker’s push service, mostly in the United States.

20Contact

… 1 unchanged blocks

Edited

Privacy contact: coming soonsupport@vietlume.com