← Lymeria

Lemon Crush Privacy Policy

Last updated: July 12, 2026

1. Scope

Lymeria (“Lymeria,” “we,” “us,” or “our”) provides the Lemon Crush iOS application. This Privacy Policy explains what information Lemon Crush handles, where it comes from, how it is used and shared, how long it is kept, and the choices available to you.

Lemon Crush is designed for merchants who connect a Lemon Squeezy store. When the app handles information about your customers, you remain responsible for ensuring that you are authorized to access and process that information. To the extent required by applicable law, Lymeria processes that customer information on your behalf to provide Lemon Crush.

2. Information we handle

  • Account information. When you sign in with Apple or Google, Firebase Authentication may receive and store a unique account identifier, email address, display name, profile photo, sign-in provider, and authentication metadata, depending on what you choose to share and what the provider supplies.
  • Lemon Squeezy connection information. This can include your API key, store identifier and name, webhook identifier and URL, webhook signing secret, connection status, and related timestamps.
  • Store, customer, and transaction information.The app can retrieve store, product, order, subscription, and invoice information from Lemon Squeezy. This may include customer names and email addresses, order and subscription identifiers, product names and identifiers, amounts, currencies, statuses, billing reasons, and transaction dates.
  • Notification information. If you enable sales alerts, we handle your Firebase Cloud Messaging registration token, device platform, app version, bundle identifier, notification preferences, selected sound, delivery status, and webhook or test-notification status.
  • Subscription information. Apple processes your payment details. Lemon Crush uses StoreKit to determine product availability and whether the Apple Account has an active Plus entitlement. We do not receive your full payment-card details.
  • Local settings and cached data. The app stores preferences, setup state, goals, store display information, and a cache of order data on your device so the dashboard can load and operate efficiently.
  • Support communications. If you contact us, we receive your email address, message, and any information you choose to include.
  • Technical request information. Our service providers may process information such as IP address, user agent, request time, and security or error information when you sign in, use cloud notification features, or visit these legal pages.

3. API key handling

Your Lemon Squeezy API key is stored locally by the app, including in iOS Keychain. The app sends the key directly to Lemon Squeezy over HTTPS when requesting your store data. If you enable real-time sales alerts, the key is also sent over HTTPS to a Lymeria-operated Firebase Cloud Function solely to identify your store and create or update the required Lemon Squeezy webhook. The function uses the key for that request and does not persist the API key in Firestore.

You can revoke the key at any time from Lemon Squeezy. Revoking or removing it may prevent Lemon Crush from refreshing your store or configuring alerts.

4. Webhooks and sales alerts

When alerts are enabled, Lemon Crush creates a Lemon Squeezy webhook for order-created and successful subscription-payment events. Lemon Squeezy sends the event payload to our Firebase Cloud Function. The payload can contain customer, product, and transaction information. We verify its signature, use it to prepare the requested alert, and send the alert through Firebase Cloud Messaging and Apple Push Notification service.

We do not store the full webhook payload as an order database on our servers. We store limited event metadata used for duplicate prevention, security, and delivery diagnostics, such as the event type, external event identifier, account and store identifiers, payload hash, processing result, and timestamps.

Alert content may include a customer name or email address, product name, and transaction amount. Depending on your iOS notification settings, this information may appear on your lock screen or other notification surfaces. You control alerts in Lemon Crush and can also control previews and permissions in iOS Settings.

5. How we use information

  • Authenticate your account and keep it secure.
  • Connect to the Lemon Squeezy store you authorize.
  • Display dashboards, orders, customers, products, and goals.
  • Configure webhooks and deliver the sales alerts you select.
  • Confirm Plus access and provide subscription features.
  • Maintain reliability, prevent duplicate alerts, and diagnose failures.
  • Respond to support, privacy, and account requests.
  • Comply with law and enforce our Terms of Service.

6. Legal bases where applicable

Depending on where you live, we rely on one or more of the following legal bases: performing our contract with you; your consent, such as when you enable notifications; our legitimate interests in operating, securing, and improving the service; compliance with legal obligations; and your instructions when we process merchant customer data on your behalf. You can withdraw notification consent by disabling alerts, although withdrawal does not affect earlier lawful processing.

7. Service providers and disclosures

We disclose information only as needed to operate Lemon Crush:

  • Apple for Sign in with Apple, StoreKit, App Store subscriptions, and push-notification delivery. See Apple’s Privacy Policy.
  • Google and Firebase for Google Sign-In, Firebase Authentication, Cloud Firestore, Cloud Functions, and Firebase Cloud Messaging. See Google’s Privacy Policy and Firebase privacy information.
  • Lemon Squeezy as the store platform you choose to connect and the source of store and webhook data. See Lemon Squeezy’s Privacy Policy.
  • Infrastructure and professional providers when reasonably needed for hosting, security, support, legal compliance, or a business transaction, subject to appropriate obligations.

We may also disclose information when required by law, to protect rights and safety, or in connection with a merger, financing, acquisition, or sale of assets, subject to applicable law.

8. No sale, advertising, or third-party analytics

We do not sell personal information, share it for cross-context behavioral advertising, or use it to serve third-party ads. Lemon Crush does not currently use Firebase Analytics or a third-party advertising SDK. If these practices change, we will update this policy and provide any notice or choice required by law.

9. Retention and deletion

  • Local settings, credentials, and cached store data remain on your device until you clear them, disconnect the store, delete your Lemon Crush account, or otherwise remove them through the app.
  • Firebase Authentication account data is retained while your account remains active and is deleted when the account-deletion process is completed, subject to limited legal or security exceptions.
  • Push tokens, notification preferences, connection records, and webhook event metadata are retained while needed to provide alerts, prevent duplicate delivery, maintain security, and diagnose service issues. We delete or de-identify them when they are no longer reasonably needed or after a verified deletion request, unless retention is required by law.
  • Support communications may be retained while needed to resolve the request, maintain business records, or meet legal obligations.

You can initiate account deletion in Lemon Crush under Settings → Accounts. After you confirm your sign-in, Lemon Crush deletes the Firebase Authentication account and associated server records, including push tokens, notification preferences, Lemon Squeezy connection records, and webhook event metadata. It also clears local Lemon Crush data and API credentials from the device. For accounts created with Sign in with Apple, the app revokes Lemon Crush's Apple authorization as part of deletion. Deleting a Lemon Crush account does not cancel an Apple subscription; manage the subscription separately through Apple.

10. Security

We use reasonable technical and organizational safeguards, including HTTPS in transit, signed webhook verification, authentication and access controls, iOS Keychain for credentials, and service-provider encryption at rest where available. No method of storage or transmission is completely secure, so we cannot guarantee absolute security.

11. International processing

Lymeria and its providers may process information in the United States and other countries where they operate. Where required, we rely on contractual, organizational, or other legally recognized safeguards for international transfers.

12. Your choices and privacy rights

You can choose not to connect a live store and use demo data. You can disable notifications, revoke notification permission in iOS Settings, revoke your Lemon Squeezy API key, sign out, or delete your Lemon Crush account.

Depending on your location, you may have rights to request access, correction, deletion, restriction, objection, or portability of personal information, and to appeal or complain to a data-protection authority. California residents may also have rights to know, correct, and delete covered information and to receive non-discriminatory treatment. We do not sell or share personal information as those terms are defined by the CCPA.

Email us to exercise a right. We may need to verify your identity and authority before completing a request. Some rights are subject to exceptions under applicable law.

13. Children

Lemon Crush is a business analytics tool and is not directed to children under 13 or the minimum age required by local law. We do not knowingly collect personal information from children for their own use of the app. Contact us if you believe a child has provided personal information improperly.

14. Changes to this policy

We may update this policy to reflect changes to Lemon Crush, our providers, or legal requirements. We will post the revised version here and update the date above. We will provide additional notice when required by law.

15. Contact

Questions, privacy requests, and complaints can be sent to hello@lymeriaholding.com.