1. Information We Collect
Account information. If you create an account we store your email address, and your name and profile photo if you choose to add them.
Conversations. Messages you send to Lumora AI, the replies, and the pillar (Money, Mind, Body, Learn, Create) and topic they belong to, so your chat history is available the next time you open the app.
Uploaded photos and documents. Images and documents you upload for analysis (a Premium feature). See section 6 for how long we keep them.
Voice recordings. If you use voice input, the audio is sent for transcription and is not retained by us once the transcript is returned.
Onboarding answers. The preferences you provide during onboarding, used to personalise responses.
Usage counters. How many messages you have used in each pillar, so we can apply your plan’s allowance.
Subscription status. Whether your plan is Free or Premium, and the identifiers needed to keep that in sync with the App Store or Stripe.
Technical and diagnostic data. Basic device and app information, and crash and error reports, used to keep the Services working and secure.
How we collect this information. All of it comes from you, directly through the app — there are no hidden or background collection methods:
- You type or speak it. Chat messages, voice input, and onboarding answers are collected only when you enter them.
- You choose to upload it. Photos and documents are collected only when you select them from your device and confirm the upload.
- You enter it at sign-up. Email address, and optionally name and profile photo, collected only if you create an account.
- Generated by your use of the app. Message counters and subscription status are produced automatically as you use features, and are stored against your account.
- Reported by the store. Purchase and subscription records come from Apple or Stripe when you subscribe.
We do not use tracking pixels, advertising SDKs, third-party analytics that profile you, or any device fingerprinting. We do not buy personal data from data brokers.
We do not collect your contacts, precise location, health records, or advertising identifiers. Lumora contains no third-party advertising, and we do not sell your personal information.
2. Using Lumora Without an Account
Browsing the pillars, reading topics, and a limited number of AI conversations do not require an account. In guest mode:
- we create no profile for you;
- your remaining free-message allowance is stored only on your device and disappears if you uninstall the app;
- messages you send are still passed to our AI provider in order to generate a reply, but they are not linked to any account and are not saved to your chat history.
Signing in is required only for features that are inherently tied to an account: saved chat history across devices, your profile, uploaded photo and document analysis, and an active subscription.
3. How We Use Your Information
We use the information above to:
- generate AI responses and hold a conversation with useful context;
- save and display your chat history;
- analyse photos and documents you upload, where you use that feature;
- personalise guidance based on your onboarding preferences;
- apply the message allowance of your plan;
- process subscriptions and restore purchases;
- respond to support requests you send us;
- diagnose crashes and keep the Services secure, functional, and free of abuse;
- comply with legal obligations.
Our legal bases, where the GDPR or UK GDPR applies, are: performance of our contract with you (providing the Services), your consent (optional features such as voice input and uploads), our legitimate interests (security, abuse prevention, service improvement), and compliance with legal obligations.
4. Third-Party AI Services and Data Sharing
What is sent to the AI providers:
- xAI (Grok) receives the text of the messages you send, the recent conversation context needed to reply coherently, the pillar and topic you are in, and your onboarding preferences where they are used to personalise a response.
- OpenAI receives your voice recordings when you use voice input, for speech-to-text transcription, and the contents of photos or documents you upload when you ask for them to be analysed.
What is never sent to the AI providers: your email address, your name, your profile photo, your password, your payment details, and your subscription or billing records. Messages are sent for processing without account identifiers attached.
Provider protections. We confirm that each third party we share data with is contractually bound to provide the same or equal protection of your data as set out in this Policy. Under our agreements with xAI and OpenAI, data submitted through their APIs is processed solely to return a response to you, is not used to train their models, and is retained only transiently for abuse monitoring before deletion in line with their published API data policies. We do not permit any provider to use your data for their own purposes, for advertising, or for resale.
We share only what each provider needs in order to do its job:
| Provider | What it receives | Why |
|---|---|---|
| Supabase | Account details, conversations, preferences, subscription status | Database hosting and authentication |
| xAI (Grok) | Message text and conversation context | Generating AI replies |
| OpenAI | Voice recordings; uploaded content where analysis requires it | Speech-to-text transcription and analysis |
| Apple | Purchase and subscription records | Processing in-app subscriptions on iOS and iPadOS |
| Stripe | Purchase and subscription records, billing email | Processing subscription payments outside the App Store |
We never see or store your payment card details — Apple and Stripe handle those directly.
Your control. Sharing with the AI providers happens only after you grant permission in the app. You can withdraw it at any time under Settings → AI & Data. Withdrawing stops all further sharing; it does not retroactively recall messages already processed, though you can delete your stored conversations separately at any time.
We may also disclose information where the law requires it, in response to a valid legal request, or to protect the rights, property, or safety of Lumora, our users, or the public. If Lumora is involved in a merger, acquisition, or sale of assets, we will give notice before your information is transferred and becomes subject to a different privacy policy.
5. AI Responses and Your Safety
Lumora is an AI coaching and wellbeing tool. It is not a licensed therapist, doctor, financial advisor, lawyer, or other professional, and its responses are not professional advice or a diagnosis. AI output may be inaccurate, incomplete, or unsuitable for your situation. Always consult a qualified professional for medical, mental health, financial, legal, or tax matters, and never disregard or delay professional advice because of something you received through the Services.
If you are in crisis or may be in danger, contact your local emergency services or a crisis line immediately.
6. Data Retention
- Account information, conversations, and preferences are kept for as long as your account is open. Deleting an individual chat removes it from our database.
- Uploaded photos and documents are deleted after 30 days, or sooner on request.
- Voice recordings are used for transcription and are not stored by us afterwards.
- Guest usage counters live only on your device.
If you ask us to close your account, we delete your account information, conversations, and preferences within 30 days, except where we must retain records to meet a legal, tax, or accounting obligation.
7. Security
Data travels over encrypted connections (HTTPS/TLS) and is stored on managed infrastructure with access controls and row-level security, so that one account cannot read another account’s data. No system is perfectly secure, so please use a strong, unique password and tell us immediately if you believe your account has been accessed by someone else.
8. Your Rights and Choices
You can:
- use the app without an account, as described in section 2;
- view and edit your profile in the app;
- delete individual conversations at any time;
- request a copy of your data, or ask us to correct or delete it;
- request deletion of uploaded photos and documents before the 30-day period ends;
- withdraw consent by closing your account;
- manage or cancel a subscription in your Apple ID subscription settings (if you subscribed through the App Store) or through the Stripe billing portal (if you subscribed on our website).
Depending on where you live, you may have additional rights under the GDPR, the UK GDPR, or the CCPA/CPRA — including the right to know what we collect, the right to object to or restrict processing, the right to data portability, and the right not to be discriminated against for exercising a privacy right. We do not sell personal information or share it for cross-context behavioural advertising. Contact us at the address in section 12 and we will help; we respond to privacy requests within 30 days.
9. Children’s Privacy
You must be at least 16 years old (or the age of majority in your jurisdiction) to use the Services. We do not knowingly collect personal information from anyone under that age. If you believe a child has provided us with personal information, contact us and we will delete it.
10. International Transfers
Lumora operates from the United States, and our service providers may process data in countries other than yours. Where data leaves the United Kingdom or the European Economic Area, we rely on appropriate safeguards, such as the European Commission’s standard contractual clauses.
11. Changes to This Policy
We may update this Policy as Lumora changes. The “last updated” date at the top always reflects the current version, and we will notify you in the app or by email about any change that materially affects you. Continuing to use the Services after a change means you accept the updated Policy.
12. Contact
Privacy questions, data access requests, and deletion requests:
Lumora689@gmail.com
We respond to privacy requests within 30 days.
This Policy is governed by the laws of the State of Wyoming, consistent with the Lumora Terms of Service.