lumi. is operated by Sarah-Jane Barton trading as lumi. (referred to in this policy as "lumi."). As the data controller under UK GDPR, lumi. determines what data is collected and how it is used. ICO registration number: C1942494. You can reach us at the contact details at the bottom of this page.
lumi. stores the following in its database, hosted on Railway:
When you record or upload a voice note, the audio file is sent to a transcription service (OpenAI Whisper). Once transcription succeeds, the audio file is immediately and permanently deleted from the server. lumi. never stores your audio long-term.
If transcription fails, the file is kept temporarily so you can retry. Once you retry successfully or discard the entry, the file is deleted.
lumi. works with a small number of trusted services to deliver its features. Here is exactly what is sent to each one and why.
| Service | What is sent | Why / retention |
|---|---|---|
| OpenAI Whisper API |
Your audio file + a short vocabulary hint containing your name, life area names, goal titles, and common phrases | Speech-to-text transcription. OpenAI does not use API data to train models. Retained up to 30 days for abuse monitoring per OpenAI's policy. |
| Anthropic Claude API |
Decrypted journal content — transcripts, summaries, intentions, life context, voice profile, goals, life areas, Google Calendar events | All AI features: tagging, daily questions, weekly signals, monthly summaries, pattern alerts, onboarding extraction, life context synthesis. Anthropic does not use API data to train models by default. Retained up to 30 days for trust and safety monitoring per Anthropic's policy. |
| Clerk Authentication |
Your name, email address, and login credentials | Account creation, login, and session management. lumi.'s own database stores only your Clerk user ID as a reference. Account deletion in lumi. also triggers deletion in Clerk. See Clerk's policy. |
| Google Drive Backups (optional) |
An encrypted backup of the database — Google receives an opaque encrypted file, not readable journal content | Daily encrypted backup if you connect Drive. The last 7 versions are kept; older ones are auto-deleted. You can revoke access at any time. See Google's policy. |
| Railway Hosting |
Application logs — file sizes, entry IDs, processing statuses, character counts | Infrastructure hosting. Logs do not contain readable journal content. Retained for typically 7 days. See Railway's policy. |
Under UK GDPR, lumi. relies on the following legal bases:
| Data | Retention |
|---|---|
| Audio recordings | Deleted immediately after successful transcription |
| Journal entries, summaries, goals, intentions, session data | Kept indefinitely — the longitudinal record is central to what lumi. does. You can delete individual entries at any time. |
| Google Drive backups | Last 7 versions kept; older ones auto-deleted |
| Railway application logs | Typically 7 days |
| All data on account deletion | Permanently and immediately deleted — see section 7 |
Under UK GDPR, you have the following rights. To exercise any of them, contact lumi. using the details at the bottom of this page.
lumi. performs a local keyword check on your journal entries before any content is sent to external services. This is designed to detect signs of significant distress. If certain language is detected, the normal AI analysis may be suppressed for that entry, and crisis support resources are shown instead. This check runs on the server before any content leaves lumi.'s systems.
lumi. is not a mental health service and does not provide therapeutic support. If you are in distress, please reach out to a professional. In the UK: Samaritans — 116 123 (free, 24/7).
lumi. is currently in a private testing phase with a small number of users. During this period, features may change and — in exceptional circumstances — data may be reset with advance notice. This policy will be updated if anything material changes. The current version date is shown at the top.
lumi. uses session cookies and local storage only as required for authentication (via Clerk) and to remember your in-app preferences. No advertising or tracking cookies are used.
If this policy changes materially, you will be notified in the app. The date at the top of this page always reflects when it was last updated.
If you have any questions about this policy or how your data is handled, please get in touch.
Contact: lumi.journalling@gmail.com
If you are not satisfied with how a concern is handled, you have the right to lodge a complaint with the UK Information Commissioner's Office (ICO) at ico.org.uk.