Privacy Policy

Last updated: October 25, 2026

This policy explains what Lumio (run by Lantern AI) collects and why: the website and Lumio AI on it (Chat, with images and videos made in chat), Lumio AI for iPhone and iPad, Lumio for Chrome, the older Lumio for iPhone and iPad, and Lumio Browser, which is retiring. We don’t sell your data, use it for advertising or track you across other companies’ apps and websites.

What we collect

• Account: from Sign in with Apple or Google sign-in, your name, email address (with Apple, this can be a private relay address Apple makes for you), your Apple or Google account ID and, with Google, your profile picture. If you sign up with your email address and a password, we keep your email address, and your password only as a salted one-way hash (PBKDF2), never the password itself. The sign-in codes we email you are stored only as a hash and expire after 15 minutes. Resend sends Lumio’s sign-in emails (your email address and the code). To stop abuse of sign-in, a one-way hash of your network address is kept for one hour, and a one-way hash of your email address for up to a day.
• Chat in Lumio AI: your chats and messages, the files you attach (pictures, and the text of documents) and the pictures and documents Lumio makes for you, so you can come back to them. Deleting a chat deletes its messages and files. Attachments you never send are deleted after a day.
• Chat without an account: if you chat in Lumio AI before you create an account, we keep your messages and Lumio’s replies for 24 hours after your last message, then delete them, unless you create an account or sign in from that chat, which moves the chat to your account. A cookie with a random ID ties the chat to your browser for up to 30 days. With that ID we keep when you chatted and what it cost, and, for one day, a one-way hash of your network address, to prevent abuse. Your messages are processed the same way as everyone’s (see AI processing). We may use Cloudflare Turnstile to check that you’re a person before your first message; Cloudflare then processes information about your browser under its own privacy policy.
• Images and videos in Lumio AI: your prompts, any pictures you upload to edit or animate, and the pictures and videos you make. They’re stored on our servers (Cloudflare R2) until you delete them. Requests a model refused are kept for 7 days to prevent abuse. When you accept the rules for making images and videos, we keep the time you did.
• Usage: when you use Lumio AI and what it cost, to apply your plan’s allowance.
• Signed-in devices: for each browser or app signed in to your account, the kind of device and browser (like “Chrome on macOS”), its approximate location (city and country, which Cloudflare works out from the connection; we don’t keep your IP address) and when it was last active, so you can see your devices and sign them out in Settings › Devices. This goes away when that device signs out, or after 30 days.
• Billing: Stripe processes payments. We keep your Stripe customer ID and plan status; we never see or store your card number.

Lumio for Chrome

Lumio for Chrome is a Chrome extension that puts Lumio AI in Chrome’s side panel and, with Work, does tasks in your browser. Here’s what it reads, and when:

• Your sign-in: it reads one cookie, Lumio’s own session cookie on lumio-co.online, so it’s signed in whenever the site is and signed out when you sign out there. It never reads other sites’ cookies, and it never sees your password.
• The page you’re on, when you ask: Use this page reads the open tab’s title, address and text only when you click it, and sends them with your message, like a file you attach.
• During a Work task: to do what you asked, it reads the pages in the task’s Lumio tab group (their text, the parts you can click or type in, and screenshots), and sends what the AI model needs for each step to our server and the model. It uses another tab only after you allow it. It clicks and types through Chrome’s debugger, which it attaches to the task’s tabs only while the task runs and detaches when it ends; Chrome shows a bar while it’s attached, and closing it stops the task. It uses the clipboard only to paste what you asked for.
• What it never does: it doesn’t type card numbers or ID numbers, doesn’t fill password, card, one-time code, bank or ID fields, and doesn’t act on payment providers’ pages or on Lumio’s own pages.
• What’s kept: your settings and the task that’s running stay in Chrome’s storage on your computer. Your Work tasks (what you asked, Lumio’s replies and steps, and small pictures of the pages it worked on) are saved to your account like chats, so you can come back to them, and deleting one deletes it. We don’t keep the page content of a step after it, except a copy for up to 24 hours used to avoid charging twice for a retried step.

Chrome asks you before Lumio for Chrome may read and change sites (at your first task); you can take that back anytime in Chrome’s extension settings, or remove the extension.

Connectors

If you connect an app in Settings › Connectors (like Notion or Linear), Lumio gets the access you grant on that app’s own consent screen. It uses it only when you ask, in a chat or a Work task: it reads what it needs to answer, and it changes something (like adding a page or an issue) only after you confirm, unless you set that action to Always allow. With Google Drive, Lumio sees only the files you pick, or the ones it made for you. The access tokens are stored encrypted. We don’t use this data for anything else, don’t sell it, and don’t use it to train AI models. What Lumio reads becomes part of that chat or task (so you can see what it used) until you delete it. You can disconnect an app anytime in Settings › Connectors, and also remove Lumio’s access in that app’s own settings.

Lumio’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Code

In Code (Pro and Max), Lumio works on a GitHub repository you pick, through your GitHub connection. To open pull requests it needs access to your repositories, which GitHub asks you to allow; Lumio uses it only for the repository and branch of a Code task. While it works, it reads the files it needs and searches the code, and what it reads goes to the AI model you picked (or to each model of your Super AI team), as in Chat. It writes to GitHub only when you press Create pull request or Update pull request: it makes a branch whose name starts with lumio/, commits the proposed files there, and opens or updates that task’s pull request. It never pushes to your other branches, and it doesn’t run your code or tests. Each proposal (the files it would change and their differences) is kept with the task until you delete the task or your account; pull requests stay on GitHub. You can disconnect GitHub in Settings › Connectors, and remove Lumio’s access in GitHub’s settings (Applications › Authorized OAuth Apps).

Lumio AI for iPhone and iPad

Lumio AI for iPhone and iPad is Lumio AI as an app. It signs in to the same Lumio account, so your chats, images and videos, connectors and plan are the same as on the web, and this policy covers what it sends and keeps. It has no Work, so it never clicks or types on web pages for you. What’s particular to the app:

• Before anything goes to an AI model: after you sign in on a device, the app asks before it sends anything you write, say, show or attach to an AI model, and says where it goes. Until you allow it, nothing is sent. The answer stays on that device, so another device or a new install asks again. You can turn it off in Settings › Data › Send to AI models; the app then asks again before the next message, voice chat or picture.
• Voice mode: what you say goes to our server and a speech model to be turned into text, and Lumio answers out loud with OpenAI’s GPT Audio, or, with Your model in Settings › Voice, its reply is read aloud by a speech model (see AI processing). We keep the words, as your messages in the chat, not the recordings. Voice mode keeps listening and talking while you use other apps, but only while it’s open: ending it turns the microphone off, and iOS shows when the microphone is on. The app uses the microphone only in voice mode and while you dictate with the mic button.
• Deleting your account: in the app, Settings › Account (your name at the top) › Delete account. It deletes your account and its data as described under Your choices.

Lumio Browser and Lumio for iPhone and iPad

Lumio Browser is retiring: from its retirement date, its AI and connected apps stop working. Until you uninstall it, what it still does is handled as described here.

Your browsing history, bookmarks, passwords, chats with the AI in Lumio Browser and settings stay on your device unless Lumio Sync is on (below). When you ask the AI in Lumio Browser to help, the messages, voice clips, page content and screenshots it needs for that request are sent to our server and the AI model to answer; we don’t keep browser page content or voice clips after the request, except a short-lived copy used to avoid charging twice for a retried step. Lumio for iPhone and iPad asks before it sends anything to the AI the first time, and you can turn that off again in its Settings › Lumio AI.

Websites you visit can ask to use your camera, microphone or location, or to reach devices on your network; your device asks you first, and what you allow goes to that website, not to us. Lumio uses the microphone itself only while you hold the mic button to talk to the AI.

Issue reports: when you use Help › Report an issue in Lumio Browser, we keep what you wrote and only what you chose to include (an email to reply to, the page’s address, a screenshot, your Lumio and system versions) for up to 180 days. To stop abuse, a one-way hash of your network address is kept with it for one hour.

Crash reports are off unless you turn them on (Settings › Privacy, or the welcome screens). Then, when Lumio Browser crashes, it sends us a report to help fix the problem: the Lumio version, your system type (Mac, Windows or Linux, and the processor type) and technical details of the crash. A crash snapshot (minidump) can contain bits of what was in Lumio’s memory at that moment. Reports aren’t linked to your account. We keep them for 90 days, and we keep a scrambled form of your IP address for one day only, to limit how many reports one network can send.

Lumio Sync and your computer

Lumio Sync is on when you sign in to Lumio Browser or Lumio for iPhone and iPad, and you can turn it off in Settings › Sync. What you choose to sync (such as bookmarks, history, chats, settings, open tabs, and passwords between computers) is encrypted on your device with your account’s sync key before it’s uploaded. Payment methods sync only if you turn them on.

How the sync key is kept. By default, our server also keeps a copy of your sync key, encrypted with a key only our server has, so signing in is all a new device needs to start syncing, like Google Chrome’s default sync. This means Lumio could technically decrypt your synced data. We don’t sell it, use it for advertising or use it to train AI models. When a device gets the key, a one-way hash of its network address is kept for one hour to stop abuse. Signing out of Lumio on a device removes the sync key from that device.

Encrypt with your own passphrase. In Lumio Browser, Settings › Sync › Advanced, you can choose to keep the sync key only on your devices. We then delete our copy, and your synced data starts over with a new key that never reaches our server, so we can’t read it. New devices then need your approval on a device that already syncs, or your recovery key; if you lose all of them, we can’t recover your synced data. A deleted copy of a key can stay in our database’s backups for up to 30 days.

We keep the encrypted copies, a list of your devices with their names and random IDs, and our encrypted copy of your sync key until you reset sync or delete your synced data (Settings › Sync), or delete your account. Tasks and tabs you send between your phone and Lumio on your computer are encrypted the same way.

If you turn on notifications in Lumio for iPhone and iPad (Settings › Your Computer), we keep the push token Apple gives your device so we can tell it that Lumio on your computer finished a task or needs your OK. The notification only says what kind of thing happened; the details stay encrypted. Turning notifications off, or deleting your account, removes the token.

Lumio Browser’s connected apps

If you connected Google (Drive, Gmail, Calendar) or Microsoft (Outlook, OneDrive) in Lumio Browser, Lumio got read-only access. It reads your email, calendar or files only when you ask it to in Lumio Browser, and only what it needs to answer. The access tokens are stored encrypted, and we use this data for nothing else. You can disconnect anytime in Lumio Browser, and also remove Lumio’s access in your Google or Microsoft account settings; deleting your account revokes it too.

AI processing

To answer, your messages (and any files, voice clips, page content, screenshots or connected-app content they include) go to the model’s provider through OpenRouter, which routes them to the model’s maker, such as OpenAI, Google or Anthropic. For images and videos, your prompts and the pictures you upload go to the model’s provider the same way. In voice mode, Lumio’s spoken answers come from OpenAI’s GPT Audio through OpenRouter, made from the text of what you said: your recording is turned into text first, and GPT Audio gets that text and the chat, never the recording. With Your model in Settings › Voice, the model you picked answers and a speech model reads its reply aloud.

For Chat and pictures, we ask providers not to keep or train on what you send, and the providers of Chat’s models don’t, except a model marked with a note in the model picker: Qwen3.7 Flash (the model Free starts with) runs on Alibaba Cloud’s servers, which keep what you send for a time under Alibaba’s policy, though they don’t train on it. Video models can’t offer zero data retention, so the video provider (for example xAI or Alibaba) may keep the prompt, the pictures and the video for a limited time under its own policy. Providers process what you send to produce the reply, picture or video under their own terms and policies.

When a reply shows its sources, each website’s small logo comes from Google’s favicon service, and a team’s crest on a match card comes from Wikipedia. Lumio’s server asks for them with only the website’s address (like espn.com) or the team’s name, never your messages, files or account, and keeps them for up to 30 days.

When you ask about the weather, Lumio’s server gets the forecast from Apple Weather with only the place’s coordinates. For the weather where you are, that’s your approximate location: the city Cloudflare works out from your connection. Your messages and your account are never sent.

Cookies

We use one essential cookie to keep you signed in and, if you chat without an account, one that keeps that chat in your browser (a random ID, for up to 30 days). No tracking or advertising cookies.

Your choices

You can delete chats anytime, and your pictures and videos anytime in Images and Videos. You can delete your account and its data yourself in Lumio AI for iPhone and iPad (Settings › Account › Delete account) or in the older Lumio for iPhone and iPad (Settings › your account › Delete Account), or contact us (see below) from the email you signed in with. Deleting your account ends any paid plan, revokes Lumio’s access to your Apple or Google sign-in and connected apps, and deletes your chats, files, pictures and videos, synced data, sync key, devices and push tokens from our servers. Records of how much Lumio AI you used are kept without your account or any content, for our accounting.

Contact

Email support@lumio-co.online with privacy questions or to delete your account (write from the email you signed in with), or see your account. More help is on the Support page.