Lumlu Privacy Policy

Version 2026-10-22 · Effective 2026-10-22

This Privacy Policy explains what information Lumlu LLC ("we", "us", "our") collects through Lumlu (the "Service"), how we use it, and the choices you have. It is part of our Terms of Service.

Our guiding principle: Lumlu works locally first. Your documents and study material live on your device unless you choose a feature — backup/sync, sign-in, or sharing — that needs our servers.

1. Information we collect

Account & device. When the app first starts, it registers the device with our service. It sends a randomly generated device identifier, a device secret the app creates to secure that registration, and the device platform. This is necessary to provide the service (credits, sync and sign-in), so there is no opt-out. We keep a device account identified only by that random identifier, with no name or email. We also store your platform (for example iOS, Android, macOS, Windows or Linux), app version, and activity timestamps. We do not require a name, email, or sign-up to use the app.

Optional linked identity. If you choose to sign in (to sync across devices or to share), we store the following from your Lumlu sign-in account (the one you manage on your account page) with your account: that sign-in account's user ID, your email address and whether it's verified, and your name. We use this to connect your devices to your account, show which account you're signed in with, send you service emails, prevent abuse (such as claiming free credits more than once), and handle support and moderation. The link is durable for the life of the account; deleting your account removes it.

Your content. Documents (such as PDFs) you import and the study material you create or generate — flashcards, notes, highlights, and document anchors. This stays on your device unless you enable online backup/sync or publish a share, in which case the relevant content (and, for public shares, the study layer only — never the source document) is stored on our servers.

When you read an EPUB, the reader shows only what's inside the book file: it blocks the book from loading images, fonts, styles, scripts or anything else from the internet. Reading-progress and study sync never sends where a file is stored on your device or what it's called: each book is identified by a key computed from its contents, plus your position, bookmarks and study progress.

AI study features. To generate notes and flashcards from your documents, we send the relevant document text (and any passages you select) to an AI service. We've set up that service so your text goes only to AI providers that, according to their published policies, don't keep it after answering and don't use it to train AI models. We record how much of the feature you use (including a credit balance) so we can operate and meter it. The generated study content is cleared after 90 days, and the generation record is deleted after 180 days. For AI study features, the app labels each document with a random ID it creates on your device and stores in your local library; that ID isn't derived from the file's name, location or contents.

Sharing & moderation. When you publish a public study share, its study layer becomes accessible to anyone with the link — and discoverable by anyone if you choose to list it in the public Explore gallery. To keep public surfaces safe, text you publish publicly (titles, flashcard text, notes) may be automatically scanned by an AI moderation classifier; we store the resulting category scores and, for flagged content, a short excerpt for human review. Images you upload may be automatically checked against hash databases of known child sexual abuse material. If you or others report content, we record which content was reported, the reason, any comment the reporter adds, and the reporter's IP address, plus their account when they report from it (reports about a share never include an account). We use reports only to review the reported content and to limit how many reports one account or IP address can send.

Service notices. If your account has a linked email address, we may send you service emails about your account — for example a notice when content is removed for a policy violation or your account is suspended or reinstated. We keep delivery metadata (recipient, subject, delivery status) but not copies of message bodies.

Subscriptions. Purchases are processed by the Apple App Store, Google Play, or Stripe — we never receive your full payment details. On Windows, including the version from the Microsoft Store, Premium is bought through our web checkout, which Stripe runs. We store minimal subscription status (product, status, expiry date, platform, the store's transaction ID, and, for web purchases, the payment provider's customer ID) to grant entitlements. Premium ends immediately on a refund or lost chargeback; partial refunds don't.

In-app feedback. If you send feedback in the app, we receive your message, your device ID, your account identity if you're signed in, platform, OS version, language/region, diagnostic details, and app logs only if you choose to attach them. If you choose "Include recent logs" when sending feedback, the app first runs those logs through the same privacy filter it uses for error reports, removing file paths, file names, web links, email addresses, quoted text and your device user name, and it also removes sign-in tokens; the message you type yourself is sent as you wrote it. We keep this for 90 days, then delete it.

Technical data. We process your IP address and request metadata for security, abuse prevention, and rate limiting. Server logs are kept up to 7 days. These logs record technical events and errors; since October 9, 2026 they don't include your IP address or location. Our hosting provider Cloudflare's records of blocked or flagged requests include the IP address and the country the request came from. Those records are kept up to 31 days for security and fraud prevention. Those logs are not used as product analytics. We do not use third-party advertising trackers.

If you allow it, the app sends usage statistics and error reports; see Usage statistics and error reports in the app.

App stores (Microsoft Store, Google Play, Apple App Store) give us install, usage and crash statistics about the app. For the Microsoft Store this can include crash reports from Windows devices that have chosen to share diagnostic data with Microsoft; we use them only to fix bugs and improve the app.

Usage statistics and error reports in the app

Lumlu Reader can send us two kinds of information. Both start off. The first screen the app shows lets you choose Allow all, Only error reports, Don't allow, or Customize. You can change this later in Profile → Privacy, using Share usage statistics and Share error reports. If you haven't chosen yet, or you choose Don't allow, the app sends neither kind. Lumlu LLC is responsible for this information (contact: legal@lumlu.app).

Usage statistics are sent only after you choose Allow all or turn on Share usage statistics. If you haven't answered, or you choose Don't allow, nothing is sent.

Why: to see which features people use and what to improve, how many people keep using the app, and, on Android, which of our Google Play links or campaigns bring new readers.

What is sent:

Events about what happens in the app, for example: the app was opened; a document was opened (its format: PDF or EPUB; whether it is the first document ever; and roughly how long after first launch); a reading session lasted 5–15 minutes (as a range, not an exact time); a document was imported (its type and how: file picker, share sheet, drag and drop, "open with" or sample); a highlight, note or flashcard was created; a review session was completed; an AI study tool was used (and roughly how many AI credits are left); a study set was shared or imported; you signed in; the subscription screen was shown; a trial or subscription started (plan and store); onboarding steps.
App and device context: app version and build, platform (for example Android or macOS), operating-system version, processor type, device language and region (for example es-MX) and app language, the store you installed from, whether you have Premium, and the day the app was first opened.
A random usage ID: a random number created on your device the first time you allow usage statistics. It isn't based on your device's hardware, it's separate from your Lumlu account and sign-in, and we don't combine it with them. Our server keeps only a one-way form of it, not the ID itself. A usage ID is replaced every 396 days, and it is deleted when you turn sharing off.
Your country: two letters, worked out by our hosting provider (Cloudflare) from the connection. Usage-stat requests are not logged, and your IP address is used only briefly to limit request rates. We don't store your IP address with these statistics.
Android (Google Play) only, the store link or campaign that brought you: when you install from Google Play, the app reads the campaign information Google Play provides once per usage ID, after you allow usage statistics. If the usage ID is reset, that information is read again and a new first-open event is sent. We keep only values from a fixed list, not the raw labels: an unknown source, medium or campaign becomes a generic "other". Organic installs are stored as such. Advertising click identifiers, other parameters and the raw store data are dropped on your device before anything is stored. We use these campaign labels only to measure which of our campaigns bring new readers, to guide our marketing. We don't sell or share them; they stay on our own service. On iPhone, iPad, Mac, Windows and Linux the app reads no campaign information.
The app reports a crash only if you had usage statistics and error reports on when it happened; if the app quit unexpectedly during a session where they were off, it never reports that crash, even if you turn them on later. When both are on, the next launch after an unexpected close adds one short "crash" event to the usage statistics (app version, build and which screen was open).

Never sent with usage statistics: your documents or their contents, titles or file names, reading positions or page numbers, the text of your notes, highlights or flashcards, what you search for, your account details, advertising identifiers or your precise location.

Where: our own service on Cloudflare. Our usage database is in North America. Cloudflare doesn't publish where it keeps the aggregated event counts, so they may be processed elsewhere on its network. No third-party analytics service receives this usage data.

How long:

Records tied to a usage ID (first-open day, platform, store, country, campaign labels, which days the app was used) are deleted after 90 days: the install record 90 days after first open, and daily activity 90 days after the day it covers. We delete them automatically.
Event counts that carry no usage ID (event name, platform, store, country, app version, operating-system version (major version only, for example iOS 18 or Windows 11), processor family (for example ARM or x86), device language (the language only, for example "es", not the region), app language, whether you have Premium, and two event-detail values — the first holds things like document format, where a screen appeared, item kind, onboarding step, survey answer, launch type, the store where a trial or subscription started, a range for how many flashcards were created or reviewed, or the app version that closed unexpectedly; the second holds things like duration range, source, screen surface, how a card was made or an item was shared (for example manual or AI, file or link), plan, credits-left range, or whether an onboarding step was finished or skipped) are kept up to 3 months.
Aggregated statistics that can't identify an install are kept up to 25 months, then deleted automatically.
On your device, the usage ID and campaign labels are deleted when you turn usage statistics off.

Why: to find and fix problems when the app closes unexpectedly, stops responding or hits an error.

Nothing is sent to Sentry until you explicitly agree — Allow all or Only error reports on the first screen, or by turning on Share error reports in Profile → Privacy. After Don't allow, nothing is sent to Sentry.

What is sent when error reports are on:

Crash and error reports.
A small sample of performance data: how long the app's requests and operations take, without web addresses or identifiers.
The app's diagnostic log lines. Before sending, the app removes file paths, the names of your documents and images, email addresses, web addresses and quoted text from those lines.
A description of the app's screen layout: the names and types of on-screen elements, never book titles, file names or paths.

Crash and error reports carry no per-install or user ID: the app turns off Sentry's session tracking on every platform and removes the installation ID that Sentry's software would otherwise add, and any user details, from crash reports, error logs and performance data before they're sent. No personal details such as your name or email are attached. This is not used to track you or for advertising.

Who processes it: Sentry (Functional Software, Inc.) processes this for us as our service provider. Crash and error reports, diagnostic log lines, performance data, and screen-layout descriptions are stored in Sentry's EU data region (Frankfurt, Germany). Sentry (Functional Software, Inc., a US company), its affiliates and its subprocessors may access or process this data from other countries, including the United States, to provide, support and secure the service. These transfers are covered by our data processing agreement with Sentry, under the EU-U.S. Data Privacy Framework (in which Sentry participates) and, where that does not apply, the EU Standard Contractual Clauses. Certain account and configuration data about our Sentry organization is stored in the US.

IP addresses aren't stored with crash and error reports, and location derived from the IP is removed from those reports before storage. Crash memory snapshots are used to build the report and then discarded, not stored.

How long: Crash and error reports and files attached to them are kept for up to 90 days. Diagnostic log lines and performance data are kept for up to 30 days. Sentry deletes its backups 90 days after they're made.

Turning error reports off in Profile → Privacy (Share error reports) stops sending to Sentry at once. Reports Sentry already received are deleted on the schedule above.

Legal basis

Your consent (GDPR Art. 6(1)(a)). Where the law requires consent to store or read information on your device (for example the usage ID), that consent covers it too. We don't sell this information or share it for advertising, and we don't track you across other companies' apps or websites. We do not send analytics to Google Ads or any advertising network.

Changing your mind, and deleting the data

Turn either one off at any time in Profile → Privacy (Share usage statistics / Share error reports). When you turn off usage statistics, the app waits at most 10 seconds for any usage upload already in progress, cancels it if it hasn't finished, and only then sends the deletion request; it discards that usage ID and never sends it again, and a later opt-in starts with a new random ID. It also asks for deletion of its current random usage ID and the earlier usage IDs it used and later replaced (it keeps up to 4). If the deletion request can't get through (for example, offline), the app keeps that request and retries it first thing at every launch, even if sharing stays off and even if the app can't fetch its usage settings. Turning error reports off stops sending to Sentry at once.
Turning usage statistics off stops sending, deletes the usage ID and any campaign labels from your device, and asks our server to delete the records tied to that usage ID (see backups below). Counts and aggregates without a usage ID can't be linked to you and expire as above.
Turning error reports off stops sending to Sentry at once. Reports Sentry already received are deleted on the schedule above.
You can turn either one back on later in Profile → Privacy.
Your other rights (access, deletion, objection, complaint to a supervisory authority) are described in "Your choices and rights" below. Contact legal@lumlu.app. These records aren't linked to your name, email or account, so we usually can't find them from your email alone. Turning the setting off in the app is the reliable way to delete them.

Website analytics

We discard advertising click identifiers as soon as a request arrives — they are not logged, stored, written to cookies or browser storage, or passed along when you go to an app store or download the app. If you click a download link on our website, we may count the platform and a campaign label, without identifying you. When the desktop app checks for updates, or you download the desktop app, we count the request by app version and platform. These counts don't include your IP address or any identifier, and we keep them up to 3 months. If the link that brought you to our website carries a campaign label, the page adds it to its Google Play and download links, so we can see which campaign led to an install. The Microsoft Store link always carries a short label for the same purpose: the campaign, or, if there isn't one, whether you came to our site directly, from a search engine or from another website. These labels don't identify you. We use Cloudflare Web Analytics to count page views on lumlu.app and measure how fast our pages load. It records the page address (without the extra parameters), the referring site, your browser, operating system and device type, your country, and page-speed timings. It does not use cookies or browser storage and does not identify you by device fingerprint. Cloudflare discards your IP address for this at its nearest data center and doesn't store it in its core databases or logs. It is not used for visitors connecting through Cloudflare's data centers in the European Economic Area, the UK or Switzerland. Cloudflare keeps the full data for 7 days; after that it keeps a roughly 10% sample, and we can view up to 6 months of it.

2. How we use information

Provide and operate the Service (store, sync, and display your content).
Generate AI study material at your request.
Process subscriptions and grant entitlements.
Keep the Service safe: prevent abuse, enforce our Acceptable Use Policy, moderate public content with automated tools and human review, rate-limit, and respond to reports.
Notify you of important account events (such as enforcement actions) if you have a linked email address.
Understand and improve how features are used (usage statistics and error reports, only with your permission).
Comply with law and respond to lawful requests.

3. How information is shared

We do not sell your personal information. We share it only with service providers that process it on our behalf, and only as needed:

Cloudflare — hosting, database, file storage, and to run our website and API. Also delivers service emails to your linked email address. Also provides our website analytics (see "Website analytics").
Apple App Store / Google Play — payment and subscription processing.
Stripe — desktop subscriptions and the customer billing portal.
OpenRouter — an AI service for study-material generation; receives the document text you submit and passes it to the AI model provider that runs the request.
Apple and Google — receive device-integrity checks from the app (Apple's device check / app attestation, and Google Play's integrity check), used only to prevent abuse and fraud.
Sentry (Functional Software, Inc.) — crash and error reports, diagnostic log lines, performance data, and screen-layout descriptions from the app, stored in Sentry's EU data region (Frankfurt, Germany), only when error reports are on. Not used for product analytics.
Your sign-in/identity provider — if you choose to link an account.

We may also disclose information to comply with law, enforce our terms, or protect the rights, safety, and security of our users and the Service.

A public study share publishes the study layer — flashcards, notes, anchors, and any images or audio attached to them, plus the share's title, subject, and the source document's title — to anyone with the link. The source document itself is never included, and share pages do not display your name or any account identity. By default a share is unlisted (reachable only by its link) and share pages ask search engines not to index them; if you list a share in the public Explore gallery, anyone can discover it there and it may appear in search results. Link-preview services can read any share from its link. Only publish content you intend to be public. You can revoke a share at any time, though copies others made may persist.

5. Data retention

We keep your content for as long as your account is active or as needed to provide the Service. Public shares persist until you revoke them or they expire; expired shares are removed automatically, except that content under an unresolved report is preserved until review completes. Reports about a share are kept until the share's expiry date (or, if a report is still under review then, until the review is done) or until its owner's account is deleted, whichever comes first, even if its owner revokes it or we take it down before then. Some shares, such as those listed in Explore, never expire. Reports about other content are kept until that content is deleted. After 30 days, we delete the reporter's IP address from each report. If the person who sent a report deletes their account, the report is kept but is no longer linked to that account. Records of moderation scans and enforcement actions are retained — including after the related content or account is deleted — to address abuse, keep enforcement auditable, and meet legal obligations; material preserved under a legal hold (for example suspected child sexual abuse material) is retained as required by law. When you delete content, we delete the associated data promptly. When you delete your account, it is deactivated right away and its data is deleted when the 30-day grace period ends. Two kinds of records are deleted on their own schedule instead: the titles of books recorded in your library's sync history, and feedback you sent from the app before you signed in. We keep each of these for up to 90 days after it was created, then delete it automatically, including after you delete your account. Both are subject to the retention described above (see backups below). Deleted data may remain in our database's backup history for up to 30 days before it is permanently removed.

Product analytics. See Usage statistics and error reports in the app for the 90-day per-install, 3-month event-count, and 25-month aggregate periods. Error reports follow the Sentry schedule described there.

Residual anti-abuse fingerprints after account deletion. Deleting your account removes your library, documents, study material, reading progress, AI credit balances, and linked sign-in profile data from the product. To prevent repeated claiming of free AI credits or promotional offers (for example by deleting and re-creating an account with the same sign-in or payment proof), we may retain a minimal one-way fingerprint derived from those proofs for a limited time (about 18 months). That residual is purpose-limited to anti-abuse, is not used for marketing or advertising, and is not your documents, reading history, or plaintext email. When the retention period ends, those fingerprints are deleted automatically. Account deletion therefore means we erase your product data; it does not mean every technical record of a free-gift claim is wiped if that would let the same free gift be re-farmed.

6. Your choices and rights

Access & deletion. You can delete individual content in the app at any time. If you're signed in, you can delete your account on your account page: Profile → Manage account opens it in the browser, where you confirm. Your account is deactivated right away on all your devices, and after a 30-day grace period we permanently delete your content, credits, linked identity, and Lumlu sign-in account. During the 30 days, you can cancel the deletion, which restores your account: sign in to your account page again and cancel it. Product data is erased as described above; residual anti-abuse fingerprints may remain for a limited time. You can also request deletion by contacting legal@lumlu.app. Deleting your account doesn't cancel a subscription. If you subscribed through the App Store or Google Play, cancel it in that store first; otherwise it keeps renewing and you keep being charged. If you subscribed on desktop through Stripe, cancel it first from the billing portal the app opens, because once you request deletion the app can no longer open that portal for you.
Optional sign-in. You can use the Service without linking any identity. A linked identity cannot be unlinked in the app; deleting your account removes the product link and the identity profile data we store for the account.
Usage statistics and error reports. Both start off. You can allow them on the first-launch prompt (Allow all, Only error reports, Don't allow, or Customize) or later in Profile → Privacy (Share usage statistics / Share error reports). Turning usage statistics off also asks us to delete that installation's analytics records. See Usage statistics and error reports in the app.
Regional rights. Depending on where you live, you may have rights to access, correct, delete, or port your personal data, or to object to or restrict certain processing (for example under GDPR or CCPA/CPRA). To exercise them, contact legal@lumlu.app. You also have the right to lodge a complaint with a data protection supervisory authority, in particular in the EU/EEA country where you live or work or where the issue happened.

7. Security

We use reasonable technical and organizational measures to protect your information, including encryption in transit. No method of transmission or storage is completely secure, so we cannot guarantee absolute security.

8. Children

The Service is not directed to children under 13, and we do not knowingly collect personal information from them. If you believe a child has provided us personal information, contact legal@lumlu.app and we will delete it.

9. International processing

We operate on Cloudflare's global network, and the AI providers and app stores we use may process data in various countries. Our usage database is in North America. Cloudflare doesn't publish where it keeps the aggregated event counts, so they may be processed elsewhere on its network.

Lumlu LLC is based in the United States, and our service providers may process your information in the United States and other countries. Where the data protection laws of the European Economic Area, the UK or Switzerland require safeguards for these transfers, we rely on the following:

Cloudflare (Cloudflare, Inc.) processes data for us under its data processing addendum. Cloudflare participates in the EU-U.S. Data Privacy Framework, its UK Extension and the Swiss-U.S. Data Privacy Framework. If that stops applying, the EU Standard Contractual Clauses apply, with the UK addendum and Swiss adjustments.
OpenRouter (OpenRouter, Inc., a US company) processes the text you send for AI study features under its data processing agreement, which includes the EU Standard Contractual Clauses, with the UK addendum and Swiss adjustments. OpenRouter passes that text to the AI provider that runs the request. These providers work for OpenRouter as its subprocessors and may be in the United States or other countries, and OpenRouter must bind each of them by written contract to data protection terms at least as protective as its own.
Sentry: Crash and error reports, diagnostic log lines, performance data, and screen-layout descriptions are stored in Sentry's EU data region (Frankfurt, Germany). Sentry (Functional Software, Inc., a US company), its affiliates and its subprocessors may access or process this data from other countries, including the United States, to provide, support and secure the service. These transfers are covered by our data processing agreement with Sentry, under the EU-U.S. Data Privacy Framework (in which Sentry participates) and, where that does not apply, the EU Standard Contractual Clauses. Certain account and configuration data about our Sentry organization is stored in the US.
Stripe handles desktop payments partly on our behalf and partly as an independent company, for example to prevent fraud and meet its legal obligations. Transfers to Stripe are covered by its data processing agreement, under the Data Privacy Framework (in which Stripe, LLC participates) and, where that does not apply, the EU Standard Contractual Clauses or the UK addendum, with Swiss adjustments.
Apple, Google and Microsoft: When you buy through their app stores or sign in with their accounts, these companies handle your information as independent companies under their own privacy policies, which explain how they protect international transfers. Apple relies on the EU Standard Contractual Clauses; Google and Microsoft participate in the Data Privacy Framework.

By using the Service you understand your information may be processed outside your country of residence.

10. Changes to this policy

We may update this Privacy Policy. Material changes take effect on the new effective date above; your continued use of the Service constitutes acceptance.

11. Contact

Privacy questions or requests: legal@lumlu.app. Lumlu LLC, 2920 Forestville Rd Ste 100 #3327, Raleigh, NC 27616, USA