Lumi Privacy Policy

Lumi lets you raise an AI that knows you, chat with friends, meet new people, and let others talk with your AI. That only works if you can trust us with what you tell it. This policy explains, in plain language, what we collect, why, who helps us process it, how long we keep it, and the choices and rights you have.

Lumi is provided by BeringTech Inc, a Delaware corporation based in San Francisco, California, USA ("BeringTech", "we", "us", "our"). BeringTech is responsible for your personal information in Lumi. This policy covers the Lumi iOS app, the websites at mylumi.link (including personal sites and AI pages), and our related services (together, "Lumi").

1. The short version

• You decide what your AI may share, item by item: Private (only you and your own AI), Friends, or Everyone.
• Your most sensitive data — finance, health, Private Info, Private Identity and Crab keys — is end-to-end encrypted on your device. We can't read it.
• We don't sell your personal information, we don't share it for advertising, and we don't show ads.
• We may use what you do in Lumi, including your chats, to train and improve Lumi's own AI, with identifying details removed where we can. End-to-end encrypted data is never used, and you can opt out.
• AI replies are generated by an AI provider (currently OpenAI). We send it only what's needed for the reply, and only what the person on the other end is allowed to see.
• You can export your data and delete your account at any time in the app.

2. Information we collect

2.1 Information you give us

Account information

• The phone number and/or email address you sign in with. We send one-time codes to them; we store only a hash of each code, and codes expire within minutes.
• Your name, username and profile photo.
• Your birthday and gender, if you add them.

Your content

• Messages, photos, voice messages, files, reactions and quotes you send to friends or to people you meet through Discovery.
• Your conversations with your own AI, including the time each message was sent.
• Your knowledge base: memories, your profile document, people in your life, plans, today's tasks and notes, places, your AI's name, photo, personality, voice examples and permissions, and your sharing choices (Private / Friends / Everyone).
• Your personal site, what you publish on myLumi.link, and your AI page settings.
• Corrections you give your AI, and the lessons it keeps from them.
• Feedback you send us.

End-to-end encrypted content

• Finance records, health measurements, Private Info, your Private Identity document and Crab keys are encrypted on your device with a key that only you hold (in your iCloud Keychain and as a recovery code you keep). We store only the encrypted copy and cannot read it.
• To let your own AI know such items exist, the app sends us their titles only (for example, "Passport" or "Visa card"), never their contents.
• Lumi never stores full payment card numbers or security codes.

Purchases

• If you buy something in the app, Apple handles the payment and tells us what you bought; we don't see your payment details.
• If you buy on our website, our payment processor collects your payment details directly. We receive only what we need to provide your purchase: your account, what you bought, the amount, the date, and the card brand and last four digits. We never receive or store your full card number or security code.

Safety information

• People you block, and reports you file, including a copy of a reported message.

2.2 Information collected automatically

• Devices and sessions: device name, when each signed-in device was last used, and a push notification token for each phone that allows notifications.
• Time zone: so your AI knows what time it is for you and can avoid messaging you at night.
• Server logs: IP address, the time and type of each request, and errors. We use them for security, abuse prevention and debugging.
• AI usage: how much of your weekly AI "energy" each request used, which part of Lumi made it, and how many web searches your AI ran.
• Presence: whether the app is currently connected, so your AI knows when you're away and so we don't send you notifications for a chat you're already reading.

We don't use advertising identifiers, third-party analytics or tracking SDKs, and we don't track you across other companies' apps or websites.

2.3 Information from others

• Friends may send you messages and photos, or mention you to their AI.
• People you meet through Discovery see, and their AI may use, only what you share with Everyone.
• If someone reports you, we receive their report.

3. How we use your information

We use your information to:

1. Provide Lumi: sign you in, deliver messages in real time, store and sync your data across your devices, show your personal site and AI page, and send the notifications you allowed.
2. Run your AI: reply to you in your own chat; remember what you've told it; find earlier conversations that matter to what you're saying now; suggest updates to what it knows about you, which you confirm before they're saved; follow the lessons you've taught it; check in with you occasionally; and look things up on the web when you ask something that needs fresh information.
3. Let others talk with your AI, only within the sharing level you chose:
   • friends you've allowed can chat with your AI and see only what you share with Friends or Everyone;
   • if you turn on "reply for me", your AI may answer a friend while you're away, and they always see that the reply came from your AI;
   • if you open your AI page to everyone, anyone with the link can chat with it, and it uses only what you share with Everyone.
4. Discovery: unless you turn off "Let others discover me", we use what you share with Everyone, your published site, your time zone and how recently you've used Lumi to suggest people you might get along with, and to let your AI say a first hello on your behalf. Nothing marked Private or Friends is ever used for Discovery. You can also turn off automatic introductions.
5. Crab links: when you create a Crab key, anyone who has that link — for example another AI service you gave it to — can read the parts of your knowledge base you chose for that key, until it expires or you revoke it.
6. Keep Lumi safe: prevent spam and abuse, enforce rate limits and our Terms, review reports, and protect people from harm.
7. Support and improve Lumi: answer feedback, fix problems, and understand which features are used.
8. Train and improve Lumi's AI: we may use your content — including your conversations with your own AI, your messages, your corrections and how you rate your AI's replies — to develop, train and improve the AI models that power Lumi. Before using content for training, we remove names, contact details and other information that directly identifies you where we reasonably can. We never use end-to-end encrypted data, because we can't read it. You can opt out at any time by emailing founder@beringtech.com; after that, your future content won't be used for training.
9. Process purchases you make in the app or on our website, and prevent payment fraud.
10. Meet legal obligations and protect our rights and the rights of others.

Legal bases (for people in the EEA, the UK and Switzerland). We process your information to perform our contract with you (providing Lumi and your purchases); based on our legitimate interests in keeping Lumi safe, secure and working well, and in improving Lumi and its AI (you can object at any time); with your consent where we ask for it (for example notifications, which you can withdraw at any time); and to comply with the law.

4. AI processing

• When your AI writes a reply, the parts of your knowledge base and conversation it needs are sent to our AI provider, OpenAI, to generate the reply. Under OpenAI's API terms, this data is not used to train OpenAI's models, and OpenAI may retain it for up to 30 days to monitor abuse before deleting it, unless the law requires otherwise.
• What's sent always follows your sharing levels: a friend's request uses only what you share with Friends or Everyone; a stranger's uses only Everyone; end-to-end encrypted content is never sent.
• When your AI searches the web, it sends a search query (not your knowledge base) through OpenAI's web search tool.
• Matching people for Discovery uses text "embeddings" (numeric representations of what you share with Everyone), created by OpenAI and stored on our servers.
• AI can be wrong. It may misunderstand you or say something you wouldn't. You can correct it, and you can always see and edit what it knows about you.

5. How we share information

We share personal information only as described here:

• With the people you choose: your messages go to their recipients; friends, people you meet through Discovery, AI page visitors and Crab link holders see what your sharing choices allow.
• With service providers who process data on our behalf, under contracts that limit their use to providing their service to us:

• For legal reasons: if we believe in good faith that the law requires it, or that it's necessary to protect someone's safety, to investigate fraud or abuse, or to protect our rights. Where we're allowed to, we'll tell you first. We can't hand over end-to-end encrypted content, because we can't read it.
• In a business transfer: if BeringTech is involved in a merger, acquisition or sale of assets, your information may be transferred as part of it, and this policy will continue to apply to it.

We do not sell your personal information, "share" it for cross-context behavioral advertising, or let anyone use it for advertising.

6. How long we keep it

When you delete your account, we immediately delete your account, contact details, devices, friendships, conversations, files, introductions, knowledge base and AI data. Messages you sent in other people's chats are deleted too. Copies in backups expire within 30 days. Reports may be kept, without your account, as described above.

7. Your choices

• See, edit and export: your knowledge base is yours to read and edit in the app. Export it from Settings → Data & Privacy.
• Control sharing: mark each item Private, Friends or Everyone; choose which friends may chat with your AI; open or close your AI page.
• AI behavior: turn "reply for me" on or off; correct your AI and it will learn; approve or dismiss what it suggests remembering.
• Discovery: turn off "Let others discover me" or automatic introductions in Discovery's menu. Block or report anyone.
• Notifications: turn Messages or AI check-ins off in Settings → Notifications, or turn notifications off in iPhone Settings.
• Crab keys: revoke any key at any time.
• AI training: opt out of having your content used to train Lumi's AI by emailing founder@beringtech.com.
• Delete your account: Settings → Data & Privacy → Delete account.

8. Your privacy rights

Depending on where you live, you may have the right to:

• know what personal information we hold about you and get a copy of it;
• correct inaccurate information;
• delete your information;
• object to or restrict certain processing, and withdraw consent;
• receive your information in a portable format;
• not be discriminated against for using these rights.

Most of this you can do yourself in the app. For anything else, email founder@beringtech.com. We'll respond within 30 days (45 days where California law allows), and we may need to confirm your identity first. You can use an authorized agent; we may ask for proof that they're acting for you.

California residents. In the last 12 months we collected these categories of personal information, for the purposes in section 3, and disclosed them only to the service providers in section 5: identifiers (name, username, phone, email, IP address, device token); customer records; characteristics you choose to add (birthday, gender); internet or network activity (logs, usage); approximate location derived from your time zone; audio and visual information (photos and voice messages you send); and inferences your AI draws about your preferences, which you can review and edit. Some of what you put in Lumi may be "sensitive personal information" (for example health or financial information); health, finance and identity documents are end-to-end encrypted and we use sensitive information only to provide Lumi to you. Purchase information is collected as "commercial information". We don't sell or share personal information, and we have no actual knowledge of selling or sharing information of anyone under 16.

EEA, UK and Switzerland. You can also lodge a complaint with your local data protection authority. BeringTech is the controller of your information.

9. Security

We protect your information with encryption in transit (HTTPS/TLS) everywhere, private storage that's accessible only through our servers, short-lived links for files, hashed sign-in codes and session tokens, rate limits, access limited to the people who run Lumi, and daily encrypted backups. Your most sensitive data is end-to-end encrypted, so even we can't read it. No system is perfectly secure; if a breach affects your information, we'll tell you as the law requires.

Your recovery code matters. If you lose all your Apple devices and your recovery code, your end-to-end encrypted data can't be recovered — by you or by us.

10. International transfers

Lumi is operated from the United States, and your information is stored and processed in the United States. If you use Lumi from elsewhere, your information will be transferred to the US, where privacy laws may differ from yours. Where required, we rely on appropriate safeguards, such as the European Commission's Standard Contractual Clauses, for these transfers.

11. Children

Lumi is not for children under 13, and in the EEA and the UK, not for anyone under 16 (or the lower age of digital consent where you live). We don't knowingly collect personal information from children under these ages. If you believe a child has given us information, contact us and we'll delete it.

12. Do Not Track

Lumi doesn't track you across other websites or apps, so we treat every visitor the same whether or not their browser sends a Do Not Track or Global Privacy Control signal.

13. Changes to this policy

If we make material changes, we'll tell you in the app before they take effect. The effective date at the top shows when this policy last changed.

14. Contact us

BeringTech Inc
San Francisco, California, USA
Email: founder@beringtech.com