Privacy Policy

Luma is operated by the developer of the Luma mobile app (“we”, “us”). You can reach us at privacy@lumamanifest.com.

Your account. You do not need to register to use Luma. If you have not signed in, the app creates an anonymous account with no name, email or password attached, so your practice has somewhere to live. Signing in is only needed to restore your practice on another device. You can sign in with Apple, with Google, or with an email address and password. Apple and Google give us your name and email address, and Google also gives us your profile picture; we never receive your Apple or Google password. If you sign in with an email address and password, we store the password only as a scrambled form that cannot be turned back into your password.

Your onboarding answers. You type or tap these into the app yourself; nothing is read from elsewhere on your device. They are the questions Luma asks before it writes anything: your first name, age, gender, country, relationship status, whether you have children, the areas of life you are focused on, the goal you are calling in and why it matters to you, how strongly you want it, how much you believe it is coming, what has been in the way, your experience with this kind of practice, and the times of day you want reminders.

Your voice recording, if you make one. Recording is optional. If you record, we store the audio file and the timestamp at which you agreed to it being used. If you would rather not record, you can choose one of three Luma voices and no recording is ever made.

What Luma writes for you. Your affirmation cards, reminder wording, audio scripts and the rendered audio files.

Technical session data. When you sign in we store a session record that includes your IP address and browser or device user-agent string. This is how we keep you signed in and spot abuse.

Subscription status. If you subscribe, our payment provider tells us which plan you are on and when it renews or ends. We never see your card details.

• No advertising identifiers, and no advertising.
• No location data.
• No contacts, photos, or files from your device.
• No third-party analytics or tracking SDKs.
• No selling of personal information to anyone, ever.

Everything above exists to produce your affirmations and deliver them to you. Your answers are what the writing is based on; your voice is what the audio is spoken in; your reminder times are when the app reaches you. Remove any of it and that part of the product stops working.

Our legal basis for processing, where the UK GDPR or EU GDPR applies, is the performance of our contract with you — providing the app you signed up for — and your consent, specifically for the voice recording.

We use a small number of processors. They act on our instructions and are not permitted to use your data for their own purposes. Each is bound by a data processing agreement that requires it to protect your data to the same standard as this policy, or a higher one.

Third-party AI services. Luma's writing and audio are produced by two AI providers, OpenAI and ElevenLabs. Before anything is sent to either, the app shows a screen naming each provider and exactly what it receives, and asks for your permission. Nothing is sent until you agree, and you are asked again on every new device you sign in on. If you do not agree, nothing is shared and the app does not continue. OpenAI receives your requests with storage switched off, and neither provider may use your data to train its models.

• Google — sign-in only.
• OpenAI — your onboarding answers are sent to OpenAI's models (the technology behind ChatGPT) to write your cards, reminders and audio scripts.
• ElevenLabs — the text of your audio scripts is sent to turn it into speech, and, if you choose to record one, your voice recording, to build your cloned voice.
• Cloudflare — runs our API and stores your audio files.
• Neon — hosts our database.
• RevenueCat — handles subscriptions, when subscriptions are enabled.

We will also disclose data if we are legally required to, and we will tell you unless we are prohibited from doing so.

Our database and file storage are located in the United States. If you are in the UK, the EU, or elsewhere, your data is transferred to and processed in the United States and in the regions our processors operate in.

We keep your account and its contents for as long as your account exists. Delete your account and it stops working immediately; you then have 30 days to sign back in and restore it, after which everything is erased permanently. See deleting your data for exactly what goes.

Three things outlive the account. Payment records are retained where tax and accounting law requires it, and hold no answers, cards or audio. The affirmations themselves are kept in anonymised form — stripped of your name, your email, every written answer, any account identifier, and any date finer than the month, so that nothing in it points back at you. We use it to judge which kinds of writing work. Tell us when you delete and we will leave you out of it entirely.

And if you have used a free trial, we keep a one-way scrambled form of your email address so that the same person cannot take one trial after another by deleting their account and signing up again. It is a fixed-length code, not your address — it cannot be unscrambled, we cannot read your email out of it, and it holds nothing else: no name, no answers, no record of what you did in the app. Our legal basis for this one is our legitimate interest in not having the free trial abused.

Your voice can be deleted on its own, at any time, from the You tab inside the app. Deleting it removes the recording, the cloned voice held by our audio provider, and the audio files generated from it, while leaving the rest of your account intact. This one is immediate and has no grace period — deleting your account destroys your voice straight away too, even though the account itself waits out the 30 days.

You can ask us to give you a copy of your data, correct it, delete it, or restrict what we do with it. Email privacy@lumamanifest.com and we will respond within 30 days.

If you are in the UK or EU and you think we have handled your data badly, you can complain to your local data protection authority.

Your reminders are scheduled on your own device. The wording is written on our server and sent to your phone once; after that the scheduling happens locally, and we are not told whether a reminder was shown or opened.

Luma is for people aged 13 and over, and the app asks your age before anything else. We do not knowingly collect data from anyone younger. If you believe a child has given us their data, email us and we will remove it.

If we change this policy in a way that affects you, we will update the date at the top and tell you in the app before the change takes effect.