The short version
- There are no accounts. Lumio never asks for your name, email, phone number, contacts, photos or location.
- Your phone makes up a random, anonymous id. It lets our server tell two phones apart, and nothing more.
- Your one line goes to our server, is screened for kindness, and is handed to exactly one other person. Our server never stores it, and it never appears in any log.
- Your journal, streak and settings live only on your phone. Settings → Forget me erases them.
- No ads, no analytics, no trackers, and we never sell data. That goes for this website too.
Who we are
Lumio is made by an independent developer (“we”, “us”). We decide how the personal data described here is used, which makes us its “controller” under data-protection law. You can reach us at any time via our contact form.
What Lumio never collects
Lumio has no sign-up and no profile. It does not ask for, and does not collect:
- your name, email address, phone number, or any login;
- your contacts, photos, camera or microphone (Lumio plays sound but never listens);
- your precise location, city or region;
- advertising identifiers, or any other identifier from your device.
The app contains no advertising, analytics, attribution or crash-reporting software.
What stays on your phone
These are saved in Lumio's private storage on your phone. They are never sent to us:
- Your kindness journal — the two lines from each completed exchange (yours and theirs) and when it happened, up to your 200 most recent.
- Your streak — how many exchanges you've completed and the date of the last one.
- Your preferences — whether you've seen the welcome, and whether narration or music is muted.
- Your anonymous id — explained below.
This data is protected by your phone's own security, like any other app's, and may be included in your own device backups (iCloud or Google), which Apple or Google look after under your account. You can delete journal letters one at a time, or erase everything with Settings → Forget me. See Delete your data.
If you choose to share a journal card or your streak, Lumio draws the image on your phone and hands it to your phone's share sheet. It goes only where you send it.
Your anonymous id
The first time you use Lumio, your phone generates a random identifier (a UUID — a long string of letters and numbers). It isn't based on your device, your phone number or anything about you. Lumio sends it with each exchange so our server can pair two different people, stop you being matched with yourself, and keep the promise of “never cross paths again”.
Forget me deletes it. The next time you open Lumio, a new, unrelated id is made.
What travels during an exchange
When you hold your finger on the screen, your phone opens an encrypted connection to our server, which runs on Cloudflare. It sends:
- your anonymous id;
- your line (up to 80 characters);
- once you're matched, the position of your finger on the screen — two numbers between 0 and 1, about thirty times a second — so your partner can see your light move.
Our server adds one thing: the country your connection appears to come from, which Cloudflare works out from your network (IP) address as it carries the connection. It is used only for the postmark on your partner's letter — “from a light in Portugal”. We never use your city, region or coordinates, and Lumio's own code never stores your IP address. (If you use a VPN, the country may be wrong. If it's unknown, the letter says “from a light far away”.)
Your partner receives your line, that country, and the movement of your light during the exchange. Their phone also receives a reference for the exchange, built from both anonymous ids, which the app uses only if one of you reports the letter; it is never shown. Your partner never receives your name, because nobody has it.
Before you hold, the app may also ask our server how many people are holding right now and how many exchanges have happened today. That request carries no id.
How your line is screened
Before your line enters the waiting room, our server checks it:
- against word lists and phrase patterns for profanity, insults and cruelty, including heavy or despairing lines, because the person receiving it came looking for warmth;
- for anything that could move a conversation off Lumio or put someone at risk — links, email addresses, phone numbers, social handles, and questions about age, school, location or meeting up;
- with an AI classifier — Meta's Llama 3.1 8B Instruct model, run by Cloudflare Workers AI inside Cloudflare's network — asked one question: is this line kind?
- with OpenAI's moderation service, which receives the text of your line only — not your anonymous id and not your IP address.
If any check says no, your line comes back to you to rephrase. It isn't delivered, and it isn't stored or logged anywhere. These checks are automated: no person reads your line before it's delivered. Their only possible outcome is that a line isn't sent; they don't make any other decision about you.
What our server keeps, and for how long
| What | What it contains | How long |
|---|---|---|
| Waiting-room entry | Your anonymous id, your line, your country, and when you started holding. | In memory only, until you're matched or you stop holding (about a minute). |
| The exchange itself | Finger positions, and the signals for “bloom” and “they left”. | Not stored. Passed straight to your partner and discarded. |
| Your delivered line | The text of your line, as your partner received it. | Not stored or logged. Once delivered, it exists only on the two phones. |
| Pair block (after a report) | The two anonymous ids involved. | Kept indefinitely, so “never again” stays true. |
| Report tally | Which anonymous ids reported which, and when — used to count how many different people have reported an id. | 30 days. |
| Suspension | An anonymous id that three or more different people reported within 30 days, or that we stopped after a safety report. It can no longer be matched. | Until we lift it. |
| Report log | When the report was made, which anonymous id reported, which was reported, the reason “did not feel kind”, and whether the exchange was one our server really made. Never the letter itself. | 180 days, then deleted automatically. |
| Daily count | One number per day: how many exchanges happened. | Kept. It contains no personal data. |
| Operational logs | Which screening stage turned a line away, error details, and when. Never the text of any line, and no anonymous ids. | A few days (at most 7), then deleted automatically by Cloudflare. |
Operational logs exist so we can keep Lumio running and fix problems. We don't use them for anything else.
Who else is involved
We use a small number of providers, only to run Lumio:
- Cloudflare, Inc. hosts our server, carries every connection, runs the AI classifier and stores what's listed above. Like any network, it processes IP addresses to deliver and protect traffic.
- OpenAI screens the text of lines, as described above.
- Google Fonts. The app downloads its typefaces from Google's font servers the first time it needs them and keeps them on your phone. As with any web request, Google can see your phone's IP address; no Lumio data is sent. This website loads its typefaces from Google Fonts too.
- Apple and Google distribute the app. They may give us download numbers and, if you've agreed to share with developers, anonymous crash and usage statistics. We can't link these to anyone.
- Wherever you share. If you share a card, it goes through your phone's share sheet to the app you pick, which handles it under its own terms.
We don't sell personal information, we don't “share” it for cross-context behavioural advertising (as California law defines it), and we don't use it for advertising of any kind.
Where data is processed
Cloudflare runs a worldwide network, so your connection is handled by a data centre near you, and what our server keeps may be stored outside your country, including in the United States. OpenAI processes data in the United States. When data from the UK, the EEA or Switzerland is transferred, these providers rely on recognised safeguards such as the Standard Contractual Clauses.
Our legal bases
If you're in the UK, the EEA or anywhere with similar laws, we rely on:
- Providing the service you ask for (contract) — carrying your line, id, finger positions and country to your partner.
- Legitimate interests — screening lines, pair blocks, the report log and tally, suspensions and operational logs, which keep Lumio kind, safe and working and help prevent abuse. We keep them minimal and anonymous.
- Your consent — for evening reminders, given through your phone's notification permission. You can withdraw it at any time in your phone's settings.
Reminders
Lumio's reminders are scheduled on your phone. No push service or server is involved, and we hold no notification token. Lumio never sets a reminder unless you tap “chime for me at dusk” (asking for notification permission where your phone requires it). It then sets one quiet reminder a day at 8 pm in your own time zone. Settings → Forget me cancels it, and you can turn it off whenever you like in your phone's notification settings.
Children
Lumio is for people aged 16 and over. We don't knowingly collect personal data from anyone younger, and because Lumio never asks who anyone is, there's very little to collect. If you believe a child under 16 is using Lumio, please tell us via our contact form. Our Child Safety Standards explain how we protect young people.
Your rights
Depending on where you live — for example under the UK GDPR, the EU GDPR or California's CCPA — you may have the right to access, correct or delete personal data about you, to receive a copy of it, to object to or restrict how it's used, and to withdraw consent. Using these rights will never change how Lumio treats you.
The fastest route is on your phone. Almost all of Lumio's data lives there, and Settings → Forget me erases it immediately. For anything on our server, write to us via our contact form.
One honest caveat: because Lumio has no accounts and doesn't display your anonymous id, we usually can't match server records to a person. Tell us roughly when a relevant exchange or report happened and we'll do what we can — and we'll tell you plainly if we hold nothing that can be tied to you. We reply within one month.
You can also complain to a data-protection authority: in the UK, the Information Commissioner's Office (ico.org.uk); in the EU, the authority in your country.
Security
Everything between the app and our server travels over encrypted connections (HTTPS and secure WebSockets). What little we keep is stored with Cloudflare behind access controls. No system is perfectly secure, but the safest data is data that was never collected. Lumio is built on that principle.
This website
This site sets no cookies and runs no analytics, trackers or scripts in your browser. It's served by Cloudflare, which processes your IP address and basic request details to deliver and protect it. Its typefaces load from Google Fonts, so your browser also connects to Google's servers.
If you use the contact form on the Support page, we keep what you send — the topic, your message and, only if you give one, an email address for our reply — for up to 180 days, stored with Cloudflare, then it's deleted automatically. To stop abuse, a one-way hash of your IP address is kept for up to an hour to count how many messages were sent; it's never stored with your message.
Changes to this policy
If the way Lumio handles data changes, we'll update this page and the date at the top before the change takes effect. If the change is significant, we'll also tell you in the app.
Contact
Lumio
our contact form