Huluma

Huluma lets EU parents share photos of their kids without ever putting a child's face on the open internet. Open a photo, tap once, and every face Huluma finds is gone for good — the real face is destroyed first, and a soft warm shell is settled over where it was. Hidden location data comes off in the same tap. What comes back is a lovely, safe-to-share picture.

The photo stays in the EU while it's worked on, then it's gone — never stored, never used to train anything. And there's nothing to switch on: protection is the default, the way it should be.

The whole experience leans on one warm idea — a little hermit crab that tucks a soft spiral shell over your child's face. A little shell over them. The mascot is the mechanic: find the face, tuck a shell over it, carry it home safe.

• Parents who want to share family life — with grandparents far away, a friends' group chat, the occasional public post — without handing a child's face to the open web or to anyone training on scraped photos
• New and young families who haven't yet decided how to handle photos online and want the safe choice to also be the easy one
• Privacy-minded EU households, DACH-first — people who care that a photo of their little one stays in the EU and then disappears

Parents face a quiet, daily trade-off: share the photos they love, or keep their child's face off the internet. The existing options are all bad. The blunt one is "post nothing." The fiddly one is scribbling over faces by hand in an editor — slow, ugly, and easy to skip. And most "free" tools that offer to do it are exactly the services you'd least want holding a picture of your child.

The hard part was never blurring a face. It's making protection effortless, trustworthy, and lovely enough that a tired parent reaches for it every time — and doing it without a single word of fear, jargon, or "security."

Huluma makes the safe thing the easy thing. The mechanic is destroy-under-blur: the detected face is destroyed first — unrecoverable, not a filter you could peel back — and the gentle shell-blur you see is only the look, a soft warm cover left behind. One tap covers every face and strips hidden location data at the same time.

Everything runs on EU infrastructure, nothing is kept, and nothing is ever used to train a model. Protection is on by default — there are no switches to find. Sign-in is one tap with Google. Two weeks are free; after that it's a simple subscription, and anything you've already covered stays safe forever.

It's all wrapped in the gentlest brand we could build: a coastal tidepool at golden hour, a snug little hermit crab, and not one threat in sight.

• Pick — choose a photo from your phone.
• Protect — one tap. A warm shell-glow blooms and a soft shell settles over every face, the real face destroyed underneath.
• Covered — a lovely, safe-to-share photo comes back. They're covered. Location removed. You can share.

• One-tap protect — every face Huluma finds is gone for good in a single tap
• Destroy-under-blur — the real face is destroyed first; the soft shell is only the look, never reversible
• Location removed — hidden place data comes off in the same tap, so a photo never says where your child is
• Protect-by-default — no toggles, no settings to turn on; the safe path is the only path
• Stays in the EU, then it's gone — photos are worked on in the EU and discarded; never stored, never used for training
• Covered means covered — anything you protect stays safe forever, even after a subscription ends
• Mobile-first — built for the phone the photos already live on, with Google sign-in only
• Warm, jargon-free — the whole experience is the little hermit crab tucking a shell over your child

In plain words: your photo stays in the EU while it's worked on, then it's gone. We don't keep it, and we never use it to train anything. The face isn't hidden behind a filter someone could undo later — it's destroyed, and the soft shell is just the gentle look that's left.

No free tier, no ads — the model is simply you, so a picture of your child is never the product. Every new family gets two weeks free to try it, then a simple monthly subscription. Anything you cover stays safe forever, whatever happens to your plan.

• Server-rendered, near-zero client JS — Fastify v5 + TypeScript, rendered with fluent-html (our type-safe HTML builder) and updated through HTMX morphing swaps, so the app feels instant on a phone without shipping a framework
• RenderBox protection pipeline — face detection and destroy-under-blur run on our own EU rendering engine; the original face is destroyed in-pipeline and never persisted
• EU-only data path — photos are processed on EU infrastructure and discarded after; nothing is stored long-term or used for training
• Protect-by-default architecture — there is no "unprotected" code path to opt out of; safety isn't a setting, it's the default flow
• Warm design system in code — the tidepool-at-golden-hour palette, Fredoka + Mulish type, and the hermit-crab mascot, all expressed through fluent Tailwind methods for type-safe styling
• Google SSO + Prisma — one-tap sign-in over a deliberately small data model that holds as little about a family as possible