Lumlu Privacy Policy

Version 2026-08-14 · Effective 2026-08-14

This Privacy Policy explains what information Lumlu LLC ("we", "us", "our") collects through Lumlu (the "Service"), how we use it, and the choices you have. It is part of our Terms of Service.

Our guiding principle: Lumlu works locally first. Your documents and study material live on your device unless you choose a feature — backup/sync, sign-in, or sharing — that needs our servers.

1. Information we collect

Account & device. When you first use the Service we create an anonymous device account identified by a device identifier the app generates on your device; we also store your platform (iOS/Android), app version, and activity timestamps. We do not require a name, email, or sign-up to use the app.

Optional linked identity. If you choose to sign in (to sync across devices or to share), we store the identity from your sign-in provider — typically your email address, display name, and profile picture — linked to your account. The link is durable for the life of the account; deleting your account removes it.

Your content. Documents (such as PDFs) you import and the study material you create or generate — flashcards, notes, highlights, and document anchors. This stays on your device unless you enable online backup/sync or publish a share, in which case the relevant content (and, for public shares, the study layer only — never the source document) is stored on our servers.

AI study features. To generate notes and flashcards from your documents, we send the relevant document text (and any passages you select) to a third-party AI gateway — currently OpenRouter, which selects among filtered upstream hosts for the configured model (DeepSeek V4 Flash). We record metered usage (an AI-credit ledger and coarse token counts) to operate and meter the feature.

Sharing & moderation. When you publish a public study share, its study layer becomes accessible to anyone with the link — and discoverable by anyone if you choose to list it in the public Explore gallery. To keep public surfaces safe, text you publish publicly (titles, flashcard text, notes) may be automatically scanned by an AI moderation classifier; we store the resulting category scores and, for flagged content, a short excerpt for human review. Images you upload may be automatically checked against hash databases of known child sexual abuse material. If you or others report content, we record the report, the reason, and the reporter's account or IP address to review it and prevent abuse.

Service notices. If your account has a linked email address, we may send you service emails about your account — for example a notice when content is removed for a policy violation or your account is suspended or reinstated. We keep delivery metadata (recipient, subject, delivery status) but not copies of message bodies.

Subscriptions. Purchases are processed by the Apple App Store or Google Play — we never receive your full payment details. We store minimal subscription status (product, status, expiry, platform) to grant entitlements.

Technical data. We process your IP address and request metadata for security, abuse prevention, and rate limiting, and may record first-party analytics events about feature usage to improve the Service. We do not use third-party advertising trackers.

2. How we use information

• Provide and operate the Service (store, sync, and display your content).
• Generate AI study material at your request.
• Process subscriptions and grant entitlements.
• Keep the Service safe: prevent abuse, enforce our Acceptable Use Policy, moderate public content with automated tools and human review, rate-limit, and respond to reports.
• Notify you of important account events (such as enforcement actions) if you have a linked email address.
• Understand and improve how features are used (aggregate analytics).
• Comply with law and respond to lawful requests.

3. How information is shared

We do not sell your personal information. We share it only with service providers that process it on our behalf, and only as needed:

• Cloudflare — hosting, database, file storage, and edge compute.
• Apple App Store / Google Play — payment and subscription processing.
• OpenRouter — AI gateway for study-material generation and automated text moderation; receives the document text you submit and publicly shared text, and routes it to an upstream host that serves the configured model (DeepSeek V4 Flash by default; the specific host can change for availability and quality).
• Microsoft PhotoDNA — receives images you upload to check them against hash databases of known child sexual abuse material.
• Cloudflare Email Service — to deliver service notices to your linked email address.
• Your sign-in/identity provider — if you choose to link an account.

We may also disclose information to comply with law, enforce our terms, or protect the rights, safety, and security of our users and the Service.

4. What becomes public when you share

A public study share publishes the study layer — flashcards, notes, anchors, and any images or audio attached to them, plus the share's title, subject, and the source document's title — to anyone with the link. The source document itself is never included, and share pages do not display your name or any account identity. By default a share is unlisted (reachable only by its link) and share pages ask search engines not to index them; if you list a share in the public Explore gallery, anyone can discover it there and it may appear in search results. Link-preview services can read any share from its link. Only publish content you intend to be public. You can revoke a share at any time, though copies others made may persist.

5. Data retention

We keep your content for as long as your account is active or as needed to provide the Service. Public shares persist until you revoke them or they expire; expired shares are removed automatically, except that content under an unresolved report is preserved until review completes. Records of moderation scans and enforcement actions are retained — including after the related content or account is deleted — to address abuse, keep enforcement auditable, and meet legal obligations; material preserved under a legal hold (for example suspected child sexual abuse material) is retained as required by law. When you delete content or your account, we delete the associated data promptly, subject to the retention described above and routine backups.

Residual anti-abuse fingerprints after account deletion. Deleting your account removes your library, documents, study material, reading progress, AI credit balances, and linked sign-in profile data from the product. To prevent repeated claiming of free AI credits or promotional offers (for example by deleting and re-creating an account with the same sign-in or payment proof), we may retain a minimal one-way fingerprint (a cryptographic hash) derived from those proofs for a limited time (about 18 months). That residual is purpose-limited to anti-abuse, is not used for marketing or advertising, and is not your documents, reading history, or plaintext email. When the retention period ends, those fingerprints are deleted automatically. Account deletion therefore means we erase your product data; it does not mean every technical record of a free-gift claim is wiped if that would let the same free gift be re-farmed.

6. Your choices and rights

• Access & deletion. You can delete individual content in the app at any time, and you can delete your account — including your content, credits, and any linked identity — directly in the app (or via the account portal when you are signed in). Product data is erased as described above; residual anti-abuse fingerprints may remain for a limited time. You can also request deletion by contacting legal@lumlu.app.
• Optional sign-in. You can use the Service without linking any identity. A linked identity cannot be unlinked in the app; deleting your account removes the product link and the identity profile data we store for the account.
• Regional rights. Depending on where you live, you may have rights to access, correct, delete, or port your personal data, or to object to or restrict certain processing (for example under GDPR or CCPA/CPRA). To exercise them, contact legal@lumlu.app.

7. Security

We use reasonable technical and organizational measures to protect your information, including encryption in transit. No method of transmission or storage is completely secure, so we cannot guarantee absolute security.

8. Children

The Service is not directed to children under 13, and we do not knowingly collect personal information from them. If you believe a child has provided us personal information, contact legal@lumlu.app and we will delete it.

9. International processing

We operate on Cloudflare's global network, and the AI providers and app stores we use may process data in various countries. By using the Service you understand your information may be processed outside your country of residence.

10. Changes to this policy

We may update this Privacy Policy. Material changes take effect on the new effective date above; your continued use of the Service constitutes acceptance.

11. Contact

Privacy questions or requests: legal@lumlu.app.