Privacy Policy
Luma is a manifestation app that writes affirmations from what you tell it. That only works if you tell it real things, so this page sets out exactly what is collected, where it goes, and how to get rid of it.
Last updated 13 September 2026
Who we are
Luma is operated by the developer of the Luma mobile app (“we”, “us”). You can reach us at privacy@lumamanifest.com.
What we collect
Your account. You sign in with Google. We receive your name, email address and profile picture from Google. We never receive your Google password.
Your onboarding answers. The questions Luma asks before it writes anything: your first name, age, gender, country, relationship status, whether you have children, the areas of life you are focused on, the goal you are calling in and why it matters to you, how strongly you want it, how much you believe it is coming, what has been in the way, your experience with this kind of practice, and the times of day you want reminders.
Your voice recording, if you make one. Recording is optional. If you record, we store the audio file and the timestamp at which you agreed to it being used. If you would rather not record, you can choose one of three Luma voices and no recording is ever made.
What Luma writes for you. Your affirmation cards, reminder wording, audio scripts and the rendered audio files.
Technical session data. When you sign in we store a session record that includes your IP address and browser or device user-agent string. This is how we keep you signed in and spot abuse.
Subscription status. If you subscribe, our payment provider tells us which plan you are on and when it renews or ends. We never see your card details.
What we do not collect
- No advertising identifiers, and no advertising.
- No location data.
- No contacts, photos, or files from your device.
- No third-party analytics or tracking SDKs.
- No selling of personal information to anyone, ever.
Why we collect it
Everything above exists to produce your affirmations and deliver them to you. Your answers are what the writing is based on; your voice is what the audio is spoken in; your reminder times are when the app reaches you. Remove any of it and that part of the product stops working.
Our legal basis for processing, where the UK GDPR or EU GDPR applies, is the performance of our contract with you — providing the app you signed up for — and your consent, specifically for the voice recording.
Who we share it with
We use a small number of processors. They act on our instructions and are not permitted to use your data for their own purposes.
- Google — sign-in only.
- Anthropic — your onboarding answers are sent to Claude to write your cards, reminders and audio scripts.
- ElevenLabs — your voice recording and the text to be spoken are sent to generate your audio.
- Cloudflare — runs our API and stores your audio files.
- Neon — hosts our database.
- RevenueCat — handles subscriptions, when subscriptions are enabled.
We will also disclose data if we are legally required to, and we will tell you unless we are prohibited from doing so.
Where it is stored
Our database and file storage are located in the United States. If you are in the UK, the EU, or elsewhere, your data is transferred to and processed in the United States and in the regions our processors operate in.
How long we keep it
We keep your account and its contents for as long as your account exists. Delete your account and we delete the lot — see deleting your data.
Your voice can be deleted on its own, at any time, from the You tab inside the app. Deleting it removes the recording, the cloned voice held by our audio provider, and the audio files generated from it, while leaving the rest of your account intact.
Your rights
You can ask us to give you a copy of your data, correct it, delete it, or restrict what we do with it. Email privacy@lumamanifest.com and we will respond within 30 days.
If you are in the UK or EU and you think we have handled your data badly, you can complain to your local data protection authority.
Notifications
Your reminders are scheduled on your own device. The wording is written on our server and sent to your phone once; after that the scheduling happens locally, and we are not told whether a reminder was shown or opened.
Children
Luma is for people aged 13 and over, and the app asks your age before anything else. We do not knowingly collect data from anyone younger. If you believe a child has given us their data, email us and we will remove it.
Changes
If we change this policy in a way that affects you, we will update the date at the top and tell you in the app before the change takes effect.