Effective date: October 15, 2026
Infinite Token ("we," "us," or "our") operates the Lumber logging platform, including the Lumber mobile application, REST API, and Node.js SDK (collectively, the "Service"). This Privacy Policy explains what information we collect, how we use it, and what rights you have over it.
When you register, we collect your name, email address, and a hashed password. We never store plaintext passwords.
Subscription payments are processed by Stripe. We do not store credit card numbers or other financial details directly - Stripe handles all payment data under their own privacy policy.
We collect metadata about your use of the Service: the number of apps, API keys, and team members you create, monthly log ingestion counts, and your subscription tier. This is used to enforce plan limits and generate billing records.
Your application logs are end-to-end encrypted using AES-256-GCM before they leave your device or server. We store only:
We cannot read, access, or decrypt your log content. Your encryption key is generated on your device and never transmitted to or stored on our servers. Even in the event of a data breach, your log content is unreadable without your key.
Our servers generate standard access logs (IP address, request path, HTTP status, timestamp) for security monitoring and incident response. These are not end-to-end encrypted and are retained for up to 90 days.
We do not sell your personal information to third parties.
| Provider | Purpose | Policy |
|---|---|---|
| Stripe | Payment processing and billing | stripe.com/privacy |
| Vercel | API hosting | vercel.com/legal/privacy-policy |
| Supabase | Database hosting | supabase.com/privacy |
| Amazon Web Services | Hosting for real-time and background services | aws.amazon.com/privacy |
| Google Firebase Cloud Messaging | Push notification delivery | firebase.google.com/support/privacy |
We do not use third-party advertising networks or data brokers.
| Data type | Retention period |
|---|---|
| Account data | Until account deletion |
| Encrypted log ciphertext | Per subscription plan (7 days on Hobby, longer on paid plans) |
| Payment records | As required by applicable law |
| Server access logs | 90 days |
When you delete your account, all associated data - including encrypted log ciphertext - is permanently deleted within 30 days.
You may at any time:
To exercise any of these rights, contact us at privacy@infinitetoken.com. We will respond within 30 days.
Your log content is protected by AES-256-GCM end-to-end encryption - the same standard used by Signal and WhatsApp. For account data, we use bcrypt for password hashing and TLS for all data in transit.
No method of transmission over the internet is 100% secure. We cannot guarantee absolute security of account metadata, but we take commercially reasonable precautions to protect it.
The Service is not directed to children under 13. We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, contact us and we will delete it promptly.
We will notify you of material changes to this policy by email at least 30 days before they take effect. The effective date at the top of this document reflects when the current version was adopted.
For privacy questions, data requests, or concerns:
Email: privacy@infinitetoken.com