LightPlay Privacy Policy

Effective date: October 18, 2026

LightPlay ("we", "us") is a video app operated by Browser by Fulldive Co. This policy explains what information the LightPlay app for Android and the web version at lightplay.ai handle, and why.

1. The short version

2. Information stored on your device

The app stores the following on your device so it can remember your place and your preferences:

Unless you sign in, the app does not upload these lists themselves, except that each request to Lumi includes the identifiers of up to 20 shows you saved, 10 you are part-way through and 8 you watched recently (section 3). However, the usage events described in section 3 tell us when you add or remove a favorite, what you play and how far you get, so this activity is also on our servers. If you sign in, your favorites and watch history are also saved to your account (section 3). Your settings, kept moments, reactions, votes, creations, Lumi's notes and keepsakes are not stored on our servers; Lumi's notes and your recent chat are sent with each request to Lumi (section 3). Signing out leaves this information on your device. You can delete what is on your device at any time by clearing the app's data or uninstalling the app.

3. Information our servers receive

When the app loads certain content — for example, media we host — it asks our servers for that content by its identifier (such as a video ID). These content requests do not include an account or a device identifier.

To show the catalogue and play videos, the app asks our catalog service for the lists and titles you open, by their identifiers, and for what it needs to start the video you chose. After a video starts or fails to start, the app tells the catalog service which video it was, whether it played and which platform you use (Android, iOS or web), so we can stop showing videos that do not play. These content requests do not include an account or a device identifier. Our network provider works out from your IP address which country a request comes from, which is your approximate location at the level of a country, and tells the catalog service, so that we only show videos available there. The app also uses this country to decide whether to ask before collecting usage statistics (see below), and our Lumi service uses it to choose which AI model provider answers (section 5) and, if you are in the United States, Puerto Rico, Guam or the U.S. Virgin Islands, to tell the AI model so that Lumi can point you to the 988 Lifeline. We use the country only while handling the request; we don't store it with usage events or with your account. (See section 5 for how long model providers may keep requests.)

Usage events. The app records what happens in it — for example, opening the app and its screens and how long you stay on them, which titles and rows you see and tap, how long you spend on a title's page, starting, progressing through, finishing or failing to play a video and how many seconds you watched, the text of searches you submit and how many results they returned, favorites you add or remove, language and screen-orientation changes, and app errors — and sends these events to our servers in batches. Each event includes a random identifier created when the app is first opened (it changes if you reinstall the app or clear its data), a random session identifier, the app version, platform and language, and the time. Usage events do not include your name, email, phone number, account, advertising ID, contacts or location. Before storing search text we remove anything that looks like an email address or phone number. Error messages are shortened, web addresses in them are cut down to the site and path, and email addresses and phone numbers are removed. We use usage events to understand which content and features work, to find problems such as videos that don't play or searches that find nothing, and to improve the app. We don't sell usage events or use them for advertising. We share them only with service providers that process them for us: the providers that host our servers and database, and the AI model providers behind the tools our team uses to analyse this data, which may process query results on our behalf.

If you are in the EU or EEA. If the country of your connection is in the European Union, Iceland, Liechtenstein or Norway, or we can't tell which country you are in, the app asks whether you allow usage statistics. Until the app knows your country, it keeps usage events only in its memory (at most 200), without creating or reading the random app ID, and it discards them if it then needs to ask you. It creates the app ID and records usage events only after you allow them. The legal basis for this is your consent. You can withdraw it at any time with the Usage statistics switch in the app's Settings; turning it off deletes the app ID and any events not yet sent from your device. Events already sent are deleted when their retention period ends (section 6). For this we use the country only to decide whether to ask, and we don't store it. Everywhere else, usage events are collected as described above.

Your account. Signing in is optional; LightPlay works without it. Sign-in uses Google Sign-In through Google Firebase Authentication. When you sign in, Google tells us your Google account's email address and whether it is verified, and gives the app your name and profile picture to show on your device. Our servers keep:

Our servers don't store your name or profile picture; your sign-in record at Firebase Authentication does, and it is deleted with your account (section 6). Firebase Authentication also receives your IP address and device details (user agent) when you sign in. We use this information to run your account, to keep your list the same across your devices, and to recognize you as the same person if you use more than one of our services. Your sign-in can be used for other Light apps in the future; each app keeps its own data, and signing in to LightPlay doesn't give another app your LightPlay data. Your usage events stay linked only to the random app ID; we don't link them to your account. We don't use your email address for advertising, and if we want to send you marketing we will ask you first.

Lumi. Lumi is an AI companion in the app. It replies when you chat with it. Once you have opened Lumi's chat at least once (where it tells you it is an AI and what it sends), it may also speak up on its own: when you open the app or come back after a few minutes away, after you finish or stop watching an episode, and when you stay on a show's page for a few seconds. Every request, whether you wrote something or Lumi spoke up on its own, sends our Lumi service: anything you wrote and your recent chat; the identifiers of up to 20 shows you saved and 10 you are part-way through; up to 8 shows you watched recently, with the moments and moods noted for them; Lumi's notes about you (made from what you told Lumi in the chat) and what Lumi has already said; the show on your screen; your local day and time, and, when Lumi greets you, how long you were away from the app; and a summary of what you did in the app recently (for example, shows you left quickly or searches that found nothing). Our service looks titles up in our catalogue and sends this, through OpenRouter, to an AI model provider, which writes the reply (section 5). If you are in the United States, Puerto Rico, Guam or the U.S. Virgin Islands, we also tell the AI model, so that Lumi can point you to the 988 Lifeline. If you are signed in, the request also carries a code derived from your account that does not reveal it, which the model provider can use to detect abuse. Before you have opened Lumi's chat, Lumi uses only lines built into the app and sends nothing. When the show on your screen is made for children, Lumi doesn't reply, and shows made for children are left out of what we send.

People on our team read saved chats only to handle a report, or, with internal approval, to fix a specific problem. We keep technical records of each reply (such as the model used, how long it took and what it cost) without the chat text or your account. For signed-in users, each saved message keeps the identifier of its technical record, so while the message is kept (up to 90 days) that record can be linked to your account. We don't use your chat for advertising.

Push notifications. On Android you can turn on notifications in the app's Settings. Notifications are sent through Google Firebase Cloud Messaging. Only after you turn them on does the app create a Firebase installation ID and a messaging token and register them with Google, together with the app version and Firebase's software details (user agent). It then subscribes your device to two topics: one for all LightPlay users and one for your app language. We send notifications to these topics only, so our servers don't receive or keep your token. We use this only to tell you about LightPlay itself — for example, new shows, new On & off screens and app updates — never for ads. These identifiers are separate from the random app ID used for usage events. You can turn notifications off in the app's Settings or in your device's settings. Turning them off in the app unsubscribes your device and deletes both the messaging token and the Firebase installation ID. Deleting your account in the app, or signing out while notifications are on, deletes them too. If notifications stay on, the app then creates new ones so that you keep receiving them. Deleting your account on the web or by email can't reach your device, so before you do that, turn notifications off in the app.

Like any internet service, our servers receive your IP address and basic request details (such as the time and the page requested) when your device connects. We don't keep request logs with your IP address: request logging is turned off for our services on Google Cloud, and our servers use your IP address only in memory, for example to limit requests. The hosting and network providers that run LightPlay (Cloudflare and Google Cloud) may keep standard access logs, including IP addresses, under their own policies.

4. Permissions

The Android app asks for network access and, only when you turn on notifications, for permission to show them. It also declares the standard system permissions that the libraries it uses need, such as receiving push messages. It does not access your camera, microphone, location, contacts or files. Read-aloud features use the text-to-speech engine already on your device.

5. Third-party services

YouTube. LightPlay uses YouTube API Services to show and play videos. When you watch a video, YouTube's embedded player loads in the app and YouTube may collect information according to its own policies. By using LightPlay you agree to be bound by the YouTube Terms of Service. Google's handling of your information is described in the Google Privacy Policy.

Google Firebase. Sign-in (Firebase Authentication) and push notifications (Firebase Cloud Messaging) are provided by Google through LightPlay's own Firebase project. Google processes this information on our behalf as a service provider. Firebase Authentication processes data only in the United States. See Google's Firebase privacy and security information.

AI model providers. Lumi's replies are written by AI models that we reach through OpenRouter, which passes each request to a model provider. We don't use Google's models for Lumi. Lumi normally uses one model provider and keeps a backup; in Hong Kong and Macau, and when we can't tell which country you are in, it uses only the backup. We ask OpenRouter to use only providers that, according to OpenRouter, do not use our requests for training. OpenRouter does not use our requests to train models. We have turned off OpenRouter's input and output logging, and the option that lets OpenRouter use our inputs and outputs in exchange for a discount, so OpenRouter does not keep the text of requests or replies after routing them. Some model providers may keep requests and replies for up to 30 days to detect abuse. OpenRouter and the model providers are based in the United States and may process Lumi requests in the United States or in other countries. They process what we send them on our behalf, under their own terms and privacy policies.

TMDB. Some artwork is loaded from The Movie Database (image.tmdb.org). When your device loads these images, TMDB receives your IP address. This product uses the TMDB API but is not endorsed or certified by TMDB.

Links and sharing. If you open an external link or use your device's share sheet, the destination you choose handles that information under its own policy.

Where information is processed. Our servers and database are in Taiwan, and our hosting provider keeps backups elsewhere in Asia. The service that keeps the technical records described in section 3 runs in Japan. Our service providers may process your information in other countries; for example, Firebase Authentication processes data only in the United States, and Firebase Cloud Messaging runs on Google's global infrastructure. When we transfer personal information about people in the EU or EEA to a country that the European Commission has not found to protect it adequately, we rely on safeguards such as the Commission's Standard Contractual Clauses where our providers offer them; Google, for example, includes them in its data processing terms. You can contact us (section 10) for more about these safeguards.

6. How long we keep information

Usage events. We keep usage events for up to 90 days and then delete them. Database backups are taken daily and deleted automatically within about 8 days, so deleted or expired information can remain in a backup for up to about 8 more days. Usage events are linked only to a random app ID, not to your name, email or account, and the app does not show that ID, so we cannot look up or delete a particular person's events on request. Clearing the app's data or reinstalling it gives the app a new ID, and the events sent under the old one are deleted automatically within 90 days. In the EU and EEA, turning off Usage statistics also deletes the ID from your device. We plan to add a way to delete your usage events from within the app.

Your account. We keep your account information, favorites and watch history until you delete your account. Saved Lumi messages are deleted after 90 days, or earlier once there are more than 80 in a language (the oldest go first). Reports of Lumi's replies that are linked to your account are kept until we handle them and for one year after that, and are deleted with your account. Reports not linked to an account (sent while you weren't signed in, or when the app couldn't confirm your sign-in) are kept for one year after they are sent, whether or not they have been handled. Because they aren't linked to you, we can't find or delete them on request. The daily count of your Lumi requests is kept until you delete your account. The technical records of Lumi's replies (section 3) don't include the chat text or your account; once the saved message that points to one is deleted, at most 90 days later, we no longer keep anything that points from your account to it. How long OpenRouter and the model providers may keep Lumi requests is described in section 5. Firebase Authentication keeps the IP addresses it logs for a few weeks, and keeps your sign-in details (including the name and profile picture Google provides) until your account is deleted; Google then removes them from its live and backup systems within 180 days.

Push notifications. Turning notifications off in the app, deleting your account in the app, or signing out while notifications are on deletes the messaging token and the Firebase installation ID (section 3). If notifications stay on, the app then creates new ones so that you keep receiving them. Deleting your account on the web or by email doesn't reach your device, so turn notifications off in the app first. After the installation ID is deleted, Google removes it from its live and backup systems within 180 days.

Deleting your account. You can delete your account in three ways:

Deleting your account deletes, together, your LightPlay account, your favorites and watch history, your saved Lumi chat, the reports linked to your account and your daily request counts, and the record of the terms you accepted. Unless you use another Light app with the same sign-in, it also deletes your email address and then your sign-in at Firebase. We keep one record that a deletion happened, with only the product, how it was requested and when, and no identifier or personal information. If you asked by email, we also record which of our staff handled the request and the outcome, without your email address. Until Google confirms it has deleted your sign-in, and for 65 minutes after that, we keep the identifier Firebase gave your sign-in, so that the deletion can be retried and an old sign-in can't recreate the account. Copies in our backups are deleted within the backup period above, and Google removes your sign-in from its backups within 180 days. Usage events are not linked to your account, so deleting your account does not delete them; they are deleted after 90 days as described above. Signing out does not delete your account.

Our hosting and network providers keep their own logs under their own policies, as described above. Information on your device stays until you delete it.

7. Children

LightPlay is for people aged 13 and over and is not directed to children under 13; the app asks you to confirm your age before you start. Accounts and Lumi are also for people aged 13 and over. In the EU and EEA, where we rely on your consent (usage statistics, and notifications you turn on), if you are under the age at which your country lets you give that consent yourself (between 13 and 16), a parent or guardian must give or approve it. Videos made for children are offered for parents and guardians to choose and watch with their children. We do not knowingly collect personal information from children under 13. If a child under 13 has used the app, clearing the app's data or uninstalling it stops new usage events from being linked to the same app ID, and the events already sent are deleted automatically within 90 days (see section 6). If a child under 13 has signed in, the account can be deleted in the app, on the web, or by an email request confirmed from the account's email address (section 6). A parent or guardian who can't use the account's email address can delete the account in the app on the child's device (in Settings, after signing in with the child's Google account), or contact us (section 10). If you have other concerns about a child's information, contact us.

8. Security

The app connects to our servers and to third-party services over encrypted connections (HTTPS).

9. Changes to this policy

If we start collecting new information — for example, saving Lumi's notes to your account, or using your email address for marketing — we will update this policy and the effective date before that feature is released, and ask for your consent where required.

10. Contact

Questions about this policy, or requests about your information (such as access, correction or deletion): [email protected], or by mail to Browser by Fulldive Co., Attn: Privacy Operations, 644 W Remington Dr, Sunnyvale, CA 94087, USA.

If you are in the EU or EEA, you also have the right to access, correct or delete your personal information, to restrict or object to how we use it, to receive it in a portable form, to withdraw your consent at any time, and to complain to your local data protection authority. We rely on these legal bases: providing the service you ask for (your account, keeping your list in sync, and Lumi's replies); our legitimate interests in keeping LightPlay safe and working (handling reports, keeping signed-in users' Lumi chats to handle reports and fix problems, limiting requests and security); and your consent (usage statistics in the EU and EEA, and notifications you turn on). We have not designated a representative in the EU under Article 27 of the GDPR; you can contact us directly as described above.

California. We don't sell your personal information or share it for cross-context behavioral advertising. If you are a California resident, you can ask us what personal information we have about you, and ask us to delete or correct it, for information we can link to you (see section 6), by contacting us as described above; we won't treat you differently for doing so.

Indonesia. If you are in Indonesia, you have the rights given by the Personal Data Protection Law (Law No. 27 of 2022), including to access, correct and delete your personal data that we can link to you (see section 6) and to withdraw your consent, by contacting us as described above.