Last updated: November 1, 2026
Chameleon Lighting ("us", "we", or "our") operates the Chameleon Lighting mobile application, the web app at app.chameleon.lighting, and the lighting controllers they connect to (together, the "Service").
This page explains what we collect, why, who else sees it, and how to get rid of it. The short version: we collect what the Service needs in order to run your lights — an account, the content you make, and the state of your controllers. The app contains no analytics, advertising, or tracking software of any kind, and we do not sell your data.
Our website, chameleon.lighting, uses Cloudflare Web Analytics to count
visits: which pages are viewed, which site sent the visitor (for example,
an ad on Facebook), and the visitor's country and type of device. It sets
no cookies, does not track you across other sites, and does not identify
you; we see only totals. Links in our ads carry labels in the address
(such as utm_source=facebook) so we can tell which ad brought
a visit. The website does not use the Meta Pixel or any advertising
tracker.
You can open the app as a guest and browse the community catalog without signing up. In guest mode nothing is sent to us: no account is created, no email or name is collected, and nothing you do is written to our servers. Our content delivery network will see your IP address and browser type as part of serving you the catalog file, as it would for any website.
Account details. Your email address, your name, a username you choose, and your password. Passwords are handled by Amazon Cognito and are never visible to us. Optionally, a profile photo — either one you upload or one you pick from our stock library.
Location. At sign-up you type a city and state. This is used to work out sunrise and sunset where you are, so schedules built around "at dusk" fire at the right time. If you use the "use my location" button instead, the app asks your device for a deliberately coarse reading, once, at that moment — we do not track your location in the background and the app never watches your position over time. That reading is rounded to about half a mile on your device, before it is sent anywhere: sunrise and sunset are the only thing a location is used for, and that is all the precision it takes. We never receive your street address, and neither does anyone we pass a location to.
The content you create. Playlists, patterns, palettes, events and your calendar, including any names or artwork you attach to them.
Your controllers. For each Chameleon controller you pair, we store what it reports and what you configure: the name you give it, its settings and zones, its schedule, its time zone and location, and which content is playing. The controller also reports diagnostics — signal strength, free memory, temperature, firmware version, its address on your local network, and the name of the Wi-Fi network it is joined to. We use these to keep the device online and to help you when something goes wrong. We do not receive your Wi-Fi password.
Household members and sharing. If you invite someone to your household, or grant them guest access to a device, we store the email address you invite. Everyone in a household can see the email addresses of the other members.
We do not sell your data or share it for advertising. Data reaches other companies only where it is needed to run the Service:
We may also disclose information if we are legally required to, or where it is necessary to protect our rights or someone's safety.
Ask Chameleon is an optional assistant for households on a free trial or with a Yearly or Lifetime plan. It can make shows from your words or a photo, read dates off a schedule photo, find out why your lights did or didn't come on, change schedules you approve, and answer questions about the app. Nothing is sent to it unless you open it and send a message.
Some simple commands, such as "lights off" or "play" followed by one of your show names, are understood on your phone and carried out directly. Those messages are not sent to any AI model.
What it receives when you send a message:
Who processes it. Ask Chameleon uses a large language model from Anthropic (Claude), sent from our servers to Anthropic's API in the United States. Anthropic states that it does not use data sent through its API to train its models, and that it deletes that data within 30 days unless it must keep it longer for safety or legal reasons. To keep the service fast and affordable, a small Amazon model (Amazon Nova, run by Amazon Web Services through Amazon Bedrock) may first read your message to decide what kind of request it is, and may write a short summary of the earlier part of a long conversation. AWS states that Amazon Bedrock does not use your prompts or responses to train its models. We do not use your conversations to train any AI model, and we never use them for advertising.
How long it is kept.
| Item | Kept for |
|---|---|
| Your conversation | 24 hours, then deleted automatically. "New chat" deletes it straight away. The app also keeps the text of your recent conversation on your phone for 24 hours so you can pick it up again; "New chat" clears that too. |
| Photos you attach | Deleted as soon as the assistant has read them, normally within seconds. |
| Notes the assistant saves ("the roofline is the Front zone", "prefers warm colors") | Until you delete them in the assistant's menu under "What Chameleon remembers", or delete your account. Notes belong to the household, so other members of your household can see them and the assistant uses them in their chats too. The assistant is told not to save sensitive personal details. |
| Usage counts (how many messages, how much processing) | Kept to enforce a weekly limit and to track our costs. They contain no message text. |
You stay in control. The assistant cannot change anything on its own. It suggests changes, and the app asks you to confirm anything that changes what your lights play, changes a schedule or default, or deletes something. Changes you confirm are the same as making them yourself: you can change them back in the app, except that deleting something cannot be undone.
AI can be wrong. The assistant can misread a photo, misunderstand a request or get a fact wrong. Check what it proposes before you confirm, especially dates read from a photo. Do not include personal information about yourself or anyone else in messages or photos that the lights don't need. Please do not upload photos where people are the subject; the assistant only needs the colors or the dates.
When a household owner deletes their account, the household's assistant conversations and saved notes are deleted with the rest of the household's data.
The Yearly subscription is bought through the Apple App Store or Google Play. Apple or Google takes the payment; we never receive your card or bank details. To confirm a purchase and keep your cloud access working, we store:
Apple (App Store Server Notifications) and Google (Google Play Real-time developer notifications) also send our servers messages when a subscription renews, is cancelled, fails to renew or is refunded, so your access stays correct without the app needing to be open. These messages are about the purchase; they do not include your payment details. We use this information only to verify and maintain your access, and keep it for as long as your account exists. See our Terms of Use for how subscriptions work.
Publishing is optional and off by default. If you choose to publish a collection or share content to the community catalog, that content becomes publicly readable on the internet — the catalog is a public file, not a members-only area — and it carries the publisher name shown alongside it. Do not put anything in a name, description or image that you would not want published. Un-publishing removes it from the catalog going forward; copies other households already made are theirs and remain with them.
The app keeps a local copy of your profile, your content and the community catalog so it starts quickly and works with a poor connection. On the web app this lives in your browser's local storage. Signing out or clearing your browser data removes it. We do not use cookies for advertising or tracking.
We keep your account information and content for as long as your account exists. Controller diagnostics are kept in an operational log so we can investigate faults; this log is keyed to the controller rather than to you.
Depending on where you live, you may have the right to see a copy of your data, correct it, or have it deleted. Deletion is built into the app. For anything else, email us at the address below and we will respond.
Accounts are protected by Amazon Cognito. Traffic between the app, our servers and your controllers is encrypted, and controllers authenticate to our systems with their own certificates. No system is perfectly secure, and we cannot guarantee absolute security, but we take reasonable measures to protect your information.
The Service is not directed to children under 13, and we do not knowingly collect personal information from them. If you believe a child under 13 has given us information, contact us and we will delete it.
We may update this policy from time to time. Changes take effect when posted on this page, and the "Last updated" date above will change. Please review it periodically.
If you have any questions about this Privacy Policy, please contact us: