Lumi

Privacy Policy

Effective: 20 October 2026 · Lumi desktop app by Overpowered Studios ("we", "us")

Lumi is a desktop companion that runs on your Windows PC. We built it to keep as much as possible on your PC and to send nothing anywhere without you knowing. This policy explains what we collect, what Lumi sends to other services on your behalf, and the choices you have.

1. Your Lumi account (what we hold)

To use Lumi you create an account. We collect:

  • Email address and, if you give one, a display name.
  • Password: stored only as a secure hash by our sign-in provider. We never see or store your password in readable form, and the Lumi app never saves it on your PC.
  • If you use Continue with Google: your Google account email, name and profile picture link, as shared by Google.
  • Sign-in records: when you signed up and last signed in, and technical data our provider logs for security (such as IP address and browser/app information).

We use this only to run your account: sign you in, confirm your email, reset your password, keep accounts secure, provide support, and (when Lumi is sold) check that you have a valid licence. We do not sell your data or use it for advertising.

Accounts are hosted by Supabase (our sign-in and database provider) in their South Asia (Mumbai, India) region. Account emails (confirmation, password reset) are sent through our email delivery provider.

2. Conversations with Lumi (Google Gemini - your own key)

Lumi's AI conversations use Google's Gemini API with an API key that you provide. When you talk to or type to Lumi, the app sends what's needed for a reply directly from your PC to Google: your message or a transcript of what you said, recent conversation, facts you asked Lumi to remember, and short summaries of Lumi's mood and your reminders. This content does not pass through our servers and we cannot see it. Google processes it under Google's Gemini API terms and privacy policy for your key; on some free tiers Google may use content to improve its products - check Google's terms for your key.

Some features send more, and only if you turn them on in Settings → Privacy and ask for them:

  • Voice / microphone audio - sent to Google only after you opt in to cloud audio. (Offline speech recognition is also available and keeps audio on your PC.)
  • Screen - one screenshot when you ask Lumi to look at your screen; small periodic screenshots only while "Watch with me" is on (the blue light shows). Password, banking and private-browsing windows are skipped.
  • Webcam - one photo, only when you ask Lumi to look at you, only if allowed.
  • Files - only a file you pick with Attach, when you press Send.

3. Data that stays on your PC

Settings, remembered facts, friendship level, diary, reminders, to-dos and logs are stored only on your PC. Your Gemini API key and Lumi sign-in token are kept in Windows Credential Manager (encrypted for your Windows account). Lumi reads the title of the active window and when you last typed or clicked, on your PC only, to react naturally - it never records keystrokes, never stores or sends window titles, and never reads or injects into games.

4. Other services Lumi can contact when you use a feature

  • Weather (Open-Meteo): only the city you type, once a day, if you turn weather on.
  • Music (YouTube): searches and streams songs you ask Lumi to play.
  • Optional add-ons and voice models: downloaded from their public sources when you choose to install them.

Payments

When you buy Lumi, payment is handled by our payment provider (a "merchant of record", such as Lemon Squeezy), which processes your card or other payment details under its own privacy policy. We never see your full card details. We receive your email, what you bought, when, and the order status, so we can unlock Lumi for your account, send receipts and handle refunds.

This website

overpoweredstudios.in uses no advertising or tracking cookies. To sign you in, it keeps your session in your browser's storage. Pages load fonts from Google Fonts and code libraries from jsDelivr, which see your IP address as part of delivering them. Our host keeps standard server logs for security.

5. How long we keep account data

We keep your account data while your account exists. When you delete your account (Settings → More → Your account → Delete my account, or by emailing us) we delete your account from our sign-in provider. Some records may remain in our providers' backups or security logs for a limited time before they are erased, and we keep records we are legally required to keep (for example, purchase records for tax purposes).

6. Your rights and choices

You can see and change your name in the app, sign out, and delete your account at any time. You can ask us for a copy of your account data, to correct it, or to delete it by emailing overpoweredstudios10@gmail.com. Depending on where you live (for example under India's Digital Personal Data Protection Act, 2023, or the EU/UK GDPR), you may have further rights, including to withdraw consent and to complain to your data protection authority.

7. Security

All account traffic uses HTTPS. Passwords are hashed by our provider. Lumi never contains our secret server keys. No system is perfectly secure, but we work to protect your data and will notify you of a breach where the law requires.

8. Children

Lumi is not intended for children under 13. In India, users under 18 need the consent of a parent or guardian to use Lumi. If you believe a child has created an account without that consent, contact us and we will delete it.

9. Changes

If we change this policy we will update this page and the date above, and tell you in the app or by email for important changes.

10. Contact

Overpowered Studios · overpoweredstudios10@gmail.com