Privacy policy

Last updated 3 November 2026

Lumi (readlumi.app and the Lumi Android app) is a reading app: you read your own books, ask questions as you go, and Lumi keeps a record of your thinking so it can write you a summary, mind maps and a report when you finish. This page explains what Lumi stores, who else sees any of it, and how to delete it. Lumi is run from Malaysia.

What Lumi stores

• Your account: your name, email address and password. The password is stored only as a one-way hash, so nobody can read it.
• Your books: the EPUB and PDF files you upload, the text taken from them so you can search and ask about them, and their covers.
• Your reading and thinking: the questions you ask and Lumi's answers, your notes, highlights, bookmarks and word look-ups, which page you were on and how long you spent reading.
• What Lumi makes for you: summaries, thinking reports, mind maps, slide decks and infographics.
• Settings: your preferences, plus any AI service keys you add yourself, which are stored encrypted.
• Usage counts: how many AI requests your account made and their size, to keep within monthly limits.

Lumi uses one cookie to keep you logged in. Display choices such as dark mode or font size are saved on your own device. Lumi has no adverts and no advertising or analytics trackers, and never sells your data.

Who else sees it

• The AI service that answers you. When you ask a question, look up a word or finish a book, Lumi sends the relevant passages from the book, your question and (when finishing a book) your trail of notes to the AI service used for your account. This is DeepSeek by default, or the one you pick in Settings (OpenAI, Anthropic Claude, Google Gemini or OpenRouter). They process it to give the answer, under their own privacy terms. Lumi does not send them your name, email or password.
• Voice. If you speak to Lumi, the words are turned into text either by your browser's own speech service (in Chrome this is Google), or by OpenAI if you choose an OpenAI voice option in Settings.
• Hosting. Lumi runs on a server rented from Hostinger, and traffic passes through Cloudflare, which protects the site. Fonts and icons load from Google Fonts, jsDelivr and cdnjs, which see your device's internet address, as with any website.
• Nobody else, unless the law requires it.

How long it is kept, and deleting it

Your data stays until you delete it. You can delete a single book (with everything made from it) from your library, or your whole account in Settings → Delete my account. Deleting is immediate and permanent. Safety backups of the server, if any, are overwritten within 30 days. See Deleting your account for the steps, including how to ask by email if you cannot log in.

Security

All traffic to Lumi is encrypted (HTTPS). Passwords are hashed and AI keys are encrypted. Each account can only see its own books and notes.

Children

Lumi is not meant for children under 13 and does not knowingly collect their data.

Your rights

You can ask to see, correct or delete your data at any time, in line with Malaysia's Personal Data Protection Act 2010. Contact [email protected].

Changes

If this policy changes, the new version will be posted here with a new date.