Luma Privacy Policy

Last updated: 2026-10-03

This privacy policy explains how the Luma browser extension and the LumaTruth service ("Luma", "we", "us") handle information when you use the extension and related services.

Information we collect

• Content you submit for analysis, such as post text, selected text, image URLs or screenshots, and video frames.
• A random installation ID and secret to verify trial and subscription access. Existing legacy IDs remain unchanged during enrollment; secrets are stored on the server only as hashes.
• Usage data, including free-trial start/end status and access checks for badges, selected text checks, image checks, and video checks.
• Plan and entitlement status for subscriptions.
• API keys you choose to save, stored on LumaTruth in encrypted form.
• Billing data processed by Stripe, with subscription status shared back to us.
• Operational logs and security events that may include timestamps, request metadata, and IP addresses.

How we use information

• Provide scoring, image checks, video checks, and related features.
• Enforce free tier limits and manage subscription entitlements.
• Store API keys securely so scoring can run on your behalf.
• Operate, secure, debug, and improve the service.

How we share information

• OpenAI: content submitted for analysis is sent to OpenAI using your API key to generate results.
• Stripe: billing and subscription payments are processed by Stripe.
• Service providers: we use infrastructure providers to host our servers and databases.
• We do not sell your personal information.

Installation recovery

A Secure, HttpOnly, host-only LumaTruth cookie preserves the installation credential for 390 days, renewed when the extension initializes. The cookies permission accesses only this product-specific LumaTruth backup, not other websites' cookies. This restores the same browser profile after extension removal without user login.

If explicitly installed, the shared LumaTruth Windows helper uses nativeMessaging to retain separate Luma, Gmail ChatView and VibeFrame credentials outside browser storage, protected by Windows for the current OS account. It creates an opaque computer ID for recovery metadata, not a hardware serial number. It never reads content submitted for analysis or provider API keys. Each authorized extension can access only its own product credential.

Install the helper and open each updated extension once before removing it. Recovery across browser profiles requires the same Windows account and a previously saved helper credential. Different OS accounts, OS reinstalls or deleting both browser and helper backups require support. Original trial dates and subscriptions are preserved; computer IDs and fingerprints do not grant paid access or merge products. Conflicting or unreadable backups stop recovery.

Data retention

We retain data only as long as needed to provide the service, comply with legal obligations, and enforce usage limits. You can request deletion of stored keys or usage records by contacting us.

Your choices

• You can disable badge scanning or avoid analysis features to stop content from being sent for analysis.
• You can remove the extension to stop collection and delete local settings.
• You can request removal of server-stored data by contacting us.

Security

We use reasonable safeguards to protect data. API keys saved to LumaTruth are encrypted at rest.

Children's privacy

Luma is not directed to children under 13, and we do not knowingly collect personal information from children.

Changes

We may update this policy from time to time. The latest version will be posted at this URL with the updated date.

Contact

For privacy questions, contact us at chri.haines@gmail.com.