Experience OS Privacy Policy
Release scope. Premium, the diagnostics protections and in-app profile deletion described below are part of the current Apple app and its service. Earlier pre-release test builds did not include all of them. The app version and available controls determine which features you can use.
Experience OS controls compatible equipment on your local network and can download signed Experience packages. It does not require an Experience OS account, sell personal data, serve advertising, or track you across other companies’ apps and websites.
Who is responsible
Experience OS is published and operated by Yusuf TURAN, an individual developer based in Türkiye, who is the data controller for the personal data described in this policy. For privacy questions, or to request access to or deletion of your data, write to [email protected].
Information processed on your devices
Bridge credentials, the rooms and lights you select, local device capability information, session checkpoints, downloaded packages, and the detailed record of what your equipment did are stored or processed on your devices. Bridge credentials are protected by the platform credential store: Apple Keychain on Apple devices and Android Keystore-backed storage on Android. This information is used to operate the Experience you choose and is not intentionally included in remote diagnostics.
Not all of it stays on your devices. When you use a shared room or TV room lights, the Apple apps send our service the identifiers of the Hue bridge, Hue Sync Box, room and lamps involved, the lamp and Sync Box settings needed to restore them, the TV’s Hue room name and number of lights, and counts of light-command results. An iPhone can also send its Hue bridge credential encrypted for your TV. It sends the credential for a room check only to a service that says it can make that check, which ours currently does not; some earlier pre-release test builds send it without asking, as described below. The sections on room lights below say what is sent and how long it is kept; diagnostics carry the counts described under Crash and performance diagnostics.
Premium purchases
On Apple devices, Apple processes Premium purchases and payments. Experience OS does not receive your payment-card details or Apple Account password. The app uses StoreKit to read product prices and trial eligibility, verify purchases, and check subscription access, expiration, billing grace, and revocation on the device. Restore Purchases asks Apple to synchronize purchases for the signed-in Apple Account. These checks are separate from Apple Music access.
The app processes transaction and product identifiers, signed purchase and renewal information, expiration or revocation dates, and trial eligibility on the device. The current Premium implementation does not send Apple purchase receipts, transaction identifiers or your Apple Account identity to our synchronization service. Shared-room readiness records described below coordinate playback and show whether a device had Premium access at a given time. They contain no Apple receipt, transaction identifier, price or Apple Account identity, and they are not a transfer of an Apple purchase.
Subscription verification does not require a separate Experience OS login. Payment and purchase records held by Apple are governed by Apple’s privacy policy; uninstalling Experience OS does not remove those records or cancel a subscription. Billing, automatic renewal, cancellation and refunds are handled by Apple as described in the Terms of Use. Premium is separate from Apple Music: neither subscription includes, requires or cancels the other.
Local network
With permission, the app discovers and communicates with Philips Hue bridges and Apple TV devices on the same local network. Local-network access is optional; refusing it leaves phone-only functionality available where supported.
Downloads
The app contacts experience-os-content.luna-gipsy.com to retrieve a signed catalogue and Experience packages. Standard network metadata, including IP address and request time, may be processed by our hosting provider, Cloudflare, to deliver and protect these files.
Optional profile and TV control
Apple app versions with Profile & TV can link devices using a one-use pairing code. When room controls are set up, the app may register a generated shared profile, including while preparing a shared-room Start; a separate email/password sign-up is not required. This sends your chosen or default profile name, device names, generated profile/device identifiers, device platform and connection status to experience-sync.luna-gipsy.com. The service also stores the latest TV playback and catalogue selection state, including experience, duration, phase, progress, light mode and app volume, and command receipts needed to prevent duplicate controls. These records are associated with your shared profile and are used for device synchronization. No email, password, social login or profile is required for independent local playback. The service stores hashes of device access keys; each app keeps its own access key in Apple Keychain. It does not stream your sound or video, and profile snapshots contain no Hue application key.
For new shared-room starts, the service also keeps the requested Experience and duration, request/session and device identifiers, readiness results and time limits, and action/output acknowledgements. These profile-linked records prevent duplicate commands and conflicting playback.
Premium room admission records
When a Premium Experience is prepared or started in a shared room, the service keeps an admission record, including for a request that is replaced, cancelled or never used: the requested Experience, the devices that reported valid Premium access and their short validity windows, any device that declined to start it and the reason it gave, such as that Premium is required, and, once playback starts, the device chosen to start it and the room session it started. A device reports that it is ready only while Apple confirms its own Premium access, and a device without access reports that Premium is required, so the record shows whether a device of your shared profile had Premium access at a given time. It contains no Apple purchase receipt, transaction identifier, price, payment information or Apple Account identity; each device checks its own Apple purchase. The service deletes an admission record automatically 30 days after it stops applying, that is, once its start window and every device’s readiness window have closed and the room no longer records its session as preparing or playing. The service checks every hour and counts the 30 days from the first check after the record stops applying, so deletion comes within about two hours after the 30 days. It comes later if the service was not running, or if the service cannot read the record or its room; such a record is kept until it can be read again. Deletion never happens earlier. After deletion, only the random identifier of the original request remains with the shared profile, without the Experience, devices, session or time, so that the same request cannot be replayed; it is removed when the shared profile is deleted. When a start is declined, for example because Premium is required, the Start command’s receipt records that refusal and its reason. Command receipts, including the receipt of the Start command, remain with the shared profile as described under Retention and deletion. Database journals and operational backups made before the deletion may still contain the record; this 30-day rule does not cover them.
Room lights in a shared room
When an Experience in a shared room changes Philips Hue lamps or pauses a Hue Sync Box, the device running it sends the service a restore record, so that another linked device can put your equipment back if the first one stops. For lamps, the record holds the Hue bridge identifier; the identifiers of each lamp changed, of its Hue device and of any entertainment area streaming to it; each lamp’s on/off state, brightness, colour, effects and connection status before the Experience changed it, and the states the Experience left; and which kind of device captured it, when, and for which session. For a Sync Box, it holds the Sync Box identifier, the entertainment area identifier, the settings the app paused (whether sync and HDMI were active, the mode, Hue target, HDMI input, brightness, preset, and each mode’s intensity and palette) and when it paused them. Each device that controls lights in the room also sends a fingerprint of its local light setup, so that two devices do not control the same lamps at once. These records are linked to your shared profile. A restore record is deleted when a linked device reports that it has handed the lamps or the Sync Box back; one that is never handed back remains until the shared profile is deleted. The light-setup fingerprints remain until the shared profile is deleted.
When an iPhone with Hue lights set up takes part in a shared room, it first asks our service whether it can check which room the iPhone’s Hue bridge credential controls, and sends the credential only if the service says it can. Our service is not currently set up to make that check, so the credential stays on the iPhone. Some earlier pre-release test builds send it without asking, with the bridge and chosen room identifiers, over an encrypted connection, and may send it again while retrying; our service refuses it without using or storing it.
Optional Apple Music
On app versions that include the Apple Music connection, you can choose to connect Apple Music on an iPhone or an Apple TV. Apple’s MusicKit lets that device check playback availability, browse your music library and playlists, search the catalogue, and play what you select. Each device asks for its own permission; a permission given on one device is not transferred to another. Apple handles account authorization and its own service requests. Experience OS does not receive your Apple account password. The Apple Music User Token is handled by MusicKit on that device and is never sent to our synchronization service or to your other devices. The app stores a local preference recording whether you connected Apple Music on that device.
For independent playback, the music selection stays in the app. When you choose music for a shared room, the app sends experience-sync.luna-gipsy.com the catalogue identifiers of the selected song or playlist (a library playlist may be sent as an ordered list of up to 500 catalogue song identifiers), the name of the selection, including a playlist name you wrote yourself, and the playback status and current catalogue song identifier reported by the playing device. These records are linked to your shared profile and can be read by every device linked to it, so the phone and the TV can control the same room. Our service does not receive or stream the music audio, the rest of your library, or your search text.
We use this information to carry out your music controls and show the room’s current state, not for advertising, to infer your identity, or to build music recommendations. Apple processes its own service data under Apple’s Privacy Policy.
Optional TV room lights
When you enable room lights on a linked Apple TV, the iPhone encrypts the selected room inventory, exact light assignments and existing Hue bridge credential for that TV. Our service temporarily relays the encrypted setup; it does not decrypt the bridge credential. The TV stores the accepted installation in Apple Keychain and controls the bridge on your local network. The service retains profile-linked setup identifiers, public agreement keys, transfer hashes, status and device acknowledgements so interrupted setup or release can recover without competing light controllers. The encrypted transfer is removed from the live database when setup is recorded as installed or closed. Operational backups may retain earlier encrypted copies. While a TV has room lights installed, the playback state it reports to the service also includes the installation’s identifier and status, the name of its Hue room, the number of lights and, during an Experience, counts of light-command results such as confirmed or failed; this part of the state is replaced each time the TV reports a new one. You can request release from the linked apps; the TV must confirm it has stopped using the installation before the phone can resume light control.
Crash and performance diagnostics
On app versions that include Sentry, the service receives crash reports, error events, app version, device/operating-system characteristics, session health, performance traces, related technical network metadata, and the names of screens opened and controls tapped, recorded as context for errors and traces. Sentry may process the connecting IP address during delivery. We configure the app not to send default personally identifying fields and do not attach the optional shared profile identity to diagnostics. Diagnostics are used only to operate, secure, and improve the app—not for advertising or cross-app tracking.
Recent versions also send step events describing what an Experience did: when it started, changed phase or ended, how many lights accepted a colour and why any refused, and whether sound or picture started, stalled or failed. These carry identifiers generated for one app launch and one playback session, together with catalogue identifiers such as the Experience, theme and phase. The app's own playback-step identifiers rotate across launches or sessions. Sentry may also attach an installation identifier that persists across launches, so these diagnostics can be linked to an app installation. Sentry also attaches a hash derived from this app’s vendor identifier for the device, the device model and the app identifier. We do not attach the optional shared profile identity. The app’s structured step events are designed to omit light, room and bridge names, bridge identifiers, local network addresses and text you have typed. Earlier versions could nevertheless include network URLs or raw platform error details through automatic SDK diagnostics. We do not claim that all diagnostics already sent by those versions were free of that information.
The current Apple app’s diagnostics settings disable automatic network tracking, network breadcrumbs and network failure events, and remove request URLs, headers, cookies and arbitrary platform-error fields from new diagnostic events. They retain useful error categories, codes and stack traces. At upgrade, the app removes queued envelopes for its own legacy diagnostics project and uses a separate cache for new reports, so those older envelopes are not replayed. The installation identifier can remain the same. This does not erase reports already received by Sentry, and we do not describe diagnostics as anonymous.
Retention and deletion
Local app files remain until you clear the relevant setup, remove downloaded content or uninstall the app; platform credential-store records may remain until explicitly removed. Shared profile, pairing and replay-protection records remain on our service so linked devices can reconnect and duplicate commands remain blocked. Premium room admission records are the one service record with a fixed deletion period: 30 days after they stop applying, as described above. Room-light restore records are deleted when the lamps or Sync Box are handed back, as described above. Uninstalling an app does not delete its server profile. If your installed version does not offer in-app deletion, contact us about profile access or deletion; this support route does not replace the in-app deletion feature. Remote catalogue delivery logs and Sentry diagnostics have separate provider-side retention. This policy does not promise a verified fixed retention period for those logs, diagnostics, database journals or operational backups. You may also request deletion of diagnostics reasonably identifiable from information you provide; some events may not be attributable to a particular shared profile or deletion request.
For Apple Music in a shared room, the service keeps the current music selection and output state as one record per shared profile, overwritten as the room changes, rather than a track-by-track listening history. The selection can remain while music is paused or a queue has ended. It is cleared when the service accepts your command to return to Experience audio, to stop, or to start a different Experience, or when the service ends the room after its participants leave or expire; a service that is not running cannot clear anything until it runs again. Playback-capability flags and the command receipts that prevent duplicate actions remain with the shared profile; a receipt holds a request fingerprint, not a copy of the playlist or song list. Database journals and operational backups may hold earlier copies, and we do not state a fixed deletion interval for them. These records are linked to your shared profile; they are not anonymous.
Deleting a shared profile
In Apple versions with the deletion control, the in-app flow applies to the entire shared profile and every device currently linked to it, not just the device making the request. Playback must stop, pending controls must finish and any equipment restoration must complete before deletion can be confirmed. A refused or interrupted request is not confirmation of deletion. If confirmation is lost, the app keeps the result unconfirmed and does not silently create a replacement profile. If the service confirms deletion but local cleanup fails, the app distinguishes the confirmed service result from the unfinished cleanup on that device.
A confirmed deletion removes the profile’s room, playback settings, music/provider selections and status, encrypted room configuration, room-light records, pairing and control records from the live service, clears its profile/device names and revokes its current device access keys. It does not delete another room’s records just because a device used to belong to that room. Records belonging to a previous or formerly linked profile are not automatically treated as records of the current profile being deleted.
On the service, minimal opaque identifiers and coordination records can remain where another room still needs them to prevent replay of an old pairing, duplicate controls or conflicting equipment writes. These retained references cannot authenticate as the deleted account. Cleanup occurs when the service can establish that the references are no longer needed; there is no fixed time limit, and some security references may remain for as long as another room depends on them. This technical retention is not a claim that retaining every historical record is legally required.
Separately, on Apple devices, the app preserves any matching pending room-import and Stop recovery record when it retires device access after confirmed deletion or revoked authentication. It copies the complete stored record into a separate, device-only Apple Keychain archive before removing it from the active recovery slot. This includes profile, device, request and session identifiers, the selected Experience, saved playback settings and the original recovery and pending Stop request bodies; it is not an identifiers-only record. The archive is kept unchanged and is not automatically imported into a new profile. An authentication refusal can trigger this local preservation without confirming that the server deleted the profile.
The current implementation has no automatic expiry or in-app removal control for this local archive. It may remain after uninstalling the app. The archive is separate from the limited server-side references described above, and retaining it is not a claim that every stored field must be retained by law. Contact us about this retained data; this policy does not promise a removal deadline or an already available archive-deletion control.
Profile deletion does not erase every local file, downloaded Experience, Hue credential or equipment-recovery record. It also does not automatically erase operational backups, provider logs or diagnostics already transmitted to Sentry. Contact us about data reasonably identifiable from your request. Deleting a profile does not cancel Premium or Apple Music, delete an Apple Account, or remove Apple’s purchase records. Manage Apple subscriptions separately before confirming deletion if you do not want further renewals.
Providers and protection
The shared profile service runs on our managed infrastructure. Cloudflare provides content delivery and secure routing to that service and may process IP addresses and request metadata. Sentry provides diagnostics. These providers process information on our behalf under their security and privacy terms. We do not authorize them to use Experience OS data for advertising or cross-app tracking.
Children
Experience OS is not directed to children under 13 and does not knowingly collect information from them.
Your choices
You can deny Local Network access in system Settings, remove Hue pairing inside the app, delete downloaded Experiences, uninstall the app, or contact us about access or deletion requests.
Disconnecting Apple Music inside Experience OS stops that device’s player and forgets its local connection preference. It does not cancel your Apple Music subscription, revoke the permission in Apple’s system settings, disconnect your other devices, or clear the shared room’s records. Use the device’s privacy settings to change the system permission, and the room controls to stop or clear shared music.
Contact
Yusuf TURAN, Türkiye · [email protected]
Experience OS home · Terms of Use · Support · Gizlilik Politikası (Türkçe)