Privacy Policy

Lumina, the personal assistant app. Effective November 6, 2026.

Lumina is published by Bioscope.ai, Inc. ("Bioscope", "we", "us") of Carmel, Indiana, USA. This policy explains what Lumina collects, why, who it goes to, how long it is kept, and how you can delete it. Questions or requests: lumina-support@bioscope.ai.

The short version

Lumina is an AI assistant. To answer you, what you say goes to the AI services listed below, and only after you agree on the first-run screen. You can withdraw that agreement at any time (Settings → Account → Stop sharing with AI services); Lumina then stops working until you agree again.
Your conversations and what Lumina learns about you are kept in your own account, separate from everyone else's, and are not sold, shared for advertising, or used to train AI models by us.
You can delete your account and its data at any time in the app (Settings → Account → Delete account).

What we collect

What	Why
Your account: an identifier from Sign in with Apple, and the email Apple shares (often a private relay address)	To know which Lumina is yours across your devices.
What you tell her at first run: the name she calls you, your sex (suggested from that name, which is checked against a list of common first names and not kept apart from it), your birth date, your time zone, and your mobile number if you give it	So she addresses you correctly (her pronouns for you follow your sex; tell her if they are wrong), can celebrate your birthday with you, knows your local time, and can call or text you. A number you give (at first run or in Settings → About you) she calls once, through Telnyx, so you can press 1 to confirm it is yours. If you give none, she takes it from the number your Mac's Messages texts you at, or from your own card in Contacts. Change or clear it in Settings → About you.
Conversations (what you type or say, and her replies) and what she remembers about you	To answer you and to remember what matters to you between conversations.
Your voice, while the microphone is on	Streamed to be turned into text. We do not keep recordings.
Location, only while Pocket mode is on	For weather, directions and reminders tied to places. Kept with your account so she can answer "where was I" questions. Your home and the other places you enter in What Lumina knows (work, the gym; placed on the map by Apple's geocoder on your phone, so the addresses go to no one else), the places you ask her to save, and home as she infers it from where your phone spends its nights until you confirm or remove it, so she knows whether you are home or away. Your phone's time zone, so times and quiet hours follow you. She may notice a place you go often and offer to name it; you can instead keep any place private: then your location there is never recorded, what was recorded there is erased, and she never mentions it.
Calendar and contacts, only if you allow access on your device	Contacts are read on your phone when a request needs them, and only what it needs is sent (a name, a number). With calendar access, the titles, times, places and attendees (names and addresses) of the coming week's events are sent when you open Lumina and every 30 minutes, so she knows what your day holds, can prepare your morning brief, and can prepare for meetings.
People you meet and places you go, researched on the web, only while Preparing for what's coming is on (the menu)	Before a meeting with someone new (by default a one-on-one with someone outside your circle and work), she searches public sources about them and their company and writes you a briefing; before a hike or a trip, she reads about the place, saves its public maps and its forecast. Public sources only, cited; nothing about health, faith, politics or family; she never contacts them. Briefings, trip sheets and maps are kept in your account, listed in Documents, and deleted with it. You can turn any one down, or all of it off.
Your employer, only while Know about my employer is on (Settings → Work)	She looks up the organization you work for in public sources (what it does, its size, where it operates, its leadership and news), once a month, and each night checks for important news about it, which she tells you until you say you would rather not. The organization is found from your own work email address or your Contacts card; your place in it (your title, since when, whom you work with most) comes only from your own card and the dates and counts of your own mail, never its content, and is never searched for. All of it is shown and editable in What Lumina knows → Work.
Your email address, only if you give one (Menu → Account → Email)	So she can email you what you ask for, such as a briefing, a trip sheet or a list. She mails it a code first, and uses it only once you type the code back. She writes to you at most 20 times a day, and copies it on any mail she sends to someone else for you. Remove it there at any time. Your replies to her mail reach her as messages from you, only from that address and only when your mail service vouches for it; each is held by Amazon SES for at most two days until she reads it, then deleted.
Mail she sends to other people for you, and their replies	When you ask her to email someone, or she writes on her own to someone she knows (Settings → Email to other people), the mail goes from her own address, says it is from Lumina, your assistant, and copies you. The recipients' names and addresses, what she wrote and what they write back are kept in your account for 30 days so she can follow the conversation, then deleted. Their replies go to Anthropic so she can answer them; anyone who replies "stop" gets no more mail from her.
Your Google account, only if you connect one (Menu → Integrations → Google)	So she can read, sort, label, archive, trash and send your Gmail, read your calendar and add, move, remove or answer events, and look up your contacts and add, change or delete one, as you ask. What she reads is used only for that, under Google's Limited Use rules (see Google user data). The sign-in is kept encrypted in your account; Disconnect there revokes it at Google and deletes it.
Your Slack, only if you connect it (Menu → Integrations → Slack)	So she can search and read your conversations, open files shared there, tell you about new DMs and mentions, and send messages as you after your yes. She sees only what you can see in Slack (see Slack data).
Your Instagram, only if you connect a professional account (Menu → Integrations → Instagram)	So she can read your DMs and the comments on your posts, tell you when one arrives, and reply after your yes (see Instagram data).
Your Zapier, Notion or Linear, or another service you add by its MCP address, only if you connect it (Menu → Integrations)	So she can use that service as you ask: search and read what your account there can see, and run its actions (send, create, change) only after your yes. What she sends a service is what that request needs (for example the words to search for, or the page or issue to write), and goes to that service under its own terms. Its sign-in, or the key you gave, is kept encrypted in your account; what she reads stays in the service, and in your conversation with her when she tells you about it. A service you add by its address is not checked by Lumina. Disconnect or Remove there deletes the sign-in or key, and revokes it at the service where it allows.
What you ask about trails, flights or homes, sent to AllTrails, Kiwi.com or Zillow when you ask (on unless you switch one off, Menu → Integrations)	So she can answer from their listings: these services need no account, and she never signs in to them as you. She sends only what that search needs: a place or a trail's name (or the coordinates of where you are, when you ask for trails near you), cities and dates for a flight, an address or an area for a home, and, only for an affordability check you ask for, the income, savings, debts or credit score you tell her. Each receives it under its own terms. Nothing that names you is sent, and what comes back is not added to what she learns about you. When she shows a service's own view in the chat (AllTrails' map of a search), that view is the service's page, run in your browser or app apart from Lumina: it loads the service's maps and pictures from the service and its map provider, and may send the service its own usage analytics, under its terms. It is given only that search and what it found, never your account or the rest of the conversation.
Mail you forward to her, only if you set up forwarding to your Lumina address (Menu → Account → Email)	So she can tell you what matters and find it again. Each message's sender, recipients, subject, date and text (attachments' names only, never the files) are kept in your account for 30 days or the time you choose (Settings → Forwarded mail), then deleted. Its sender and an excerpt go to Anthropic to sort it, as with Mac mail, and mail from people she knows to learn from, if learning is on. The message as received is deleted from Amazon SES as soon as she has read it. Turn it off, or erase it, at any time.
What she has done	How often she has spoken up unasked or sent you a notification, and whether you opened it, kept for 30 days as counts, so she does not interrupt you more than your settings allow.
Motion and activity, only if you turn it on in What Lumina knows	Whether you are still, walking, running, cycling or in a vehicle, so she keeps it short and asks nothing that needs your eyes while you drive. Used for what is happening now; not kept as a history.
Focus status, only if you turn it on in What Lumina knows	Whether you are in a Focus (on or off; iOS does not say which one), so she raises only what cannot wait and the rest arrives quietly. Used for what is happening now; not kept as a history.
Apple Health, only if you turn on the Apple Health switch (What Lumina knows, Account or the setup pages)	Last night's sleep (when it started and ended, how long, and how many times and for how long you were awake), your newest heart rate and resting heart rate, heart-rate variability, your latest workout (its kind, time and distance; for a hike, walk or run, how far you climbed, the highest point, and the saved place or town it started from, worked out on your iPhone from the workout's route), today's steps and your usual day, your newest blood pressure, and your newest weight and height, read from Apple Health on your iPhone. She uses them to know when you are asleep, when you woke and when you are exercising, how active you have been, and how a day compares with your own usual; your weight and height are for your sizes. Only these summaries leave your iPhone, never the readings themselves or a route's path (to name the town, your iPhone asks Apple Maps where the route began). What is kept in your account: the latest summary, for what is happening now; one row a day for 90 days (the night's times and minutes, resting heart rate, heart-rate variability, the day's steps, the newest blood pressure, and the longest workout's kind, minutes, distance and climb), so she can compare a day with your own usual; and your weight and height with your measurements, until you change them. None of it is used for advertising or marketing, sold or shared, written to Health or stored in iCloud. Turning the switch off forgets the latest summary at once; deleting your account deletes all of it. You can change what Lumina may read in the Health app at any time.
Garmin, only if you connect Garmin (Menu → Integrations → Garmin; Garmin data)	Your Garmin watch's summaries, sent by Garmin minutes after the watch syncs: last night's sleep (when it started and ended, its stages, and how many times you were awake for five minutes or more), your heart rate and resting heart rate, heart-rate variability, stress, Body Battery and steps. She uses them as she uses Apple Health's: to know when you are asleep, when you woke, and how a day compares with your own usual. What is kept in your account: the latest of each, so a restart does not forget last night, and the same one row a day for 90 days; never Garmin's readings through the day.
Purchases: the product, the App Store transaction identifier and date (never your card)	To add the tokens you bought and to handle refunds.
Usage: how many tokens each request used, and your balance	To show your balance and to charge for use.
How you use Lumina: which features you use and how often (a count and its kind, such as a video or a song played), your time with the app each day and how it splits across Pocket, Silent and Hand, how far you went through the setup pages, which permissions you allowed on your devices, which connections you set up, and the circle invites you sent and where each stands. Never what you said, asked, read or played	To see how Lumina is used and to make it better. Our team sees these counts for each person, in an admin view only they can open; they are kept 60 days after your last use, and deleted with your account.
Device and diagnostic records: app state (for example whether the screen or AirPods are in use, battery level), errors, and a notification token	To keep Lumina working, to know whether she can be heard, and to send you notifications you allowed.
Replies you report, and your note	To review and improve what she says. Our team reads what you report, which may quote your mail or other connected data; reporting it is your permission for that.

Lumina for Mac

Lumina for Mac is an optional app that lets Lumina use your messages, mail, contacts and calendar on your Mac. It reads them on your Mac, only after you allow each one in macOS, and sends your Lumina only what is listed here. The files themselves (your Messages history, your mailboxes, your contacts and calendar databases) are never copied off your Mac.

What it reads on your Mac	What leaves your Mac, and why
Messages (Full Disk Access, and permission to control Messages)	The messages that answer what you ask her, and a photo or file from a message when you ask what it is. The names of the people you text, so she knows who is who. Whether someone has replied to you (only that, not what they said). A text you ask her to send is sent from your Mac, after you approve it.
Mail (Full Disk Access for Mail's index, and permission to control Mail)	For new mail in the accounts and mailboxes you choose in Settings → Mail: its sender, subject and a short excerpt, so she can sort it and tell you what matters. The messages that answer what you ask her. What she decides is carried out on your Mac, and only if you allow it there; a message she removes goes to a "Lumina/Held" mailbox for 30 days, never to the Trash.
Contacts (Contacts permission)	What a request needs, such as a name, a number or an address.
Calendar (Calendars permission)	The titles, times and places of your coming events, so she knows your day.
Learning from your messages	Lumina learns as she works: as new texts and mail with people you correspond with arrive (never mailings, notifications or strangers), she notes what they tell her about the people and plans in your life, in her memory, each item noting the message it came from rather than keeping the message. That can include sensitive things, such as someone's faith, politics, health or the places they go; she keeps those to herself, never shares them with anyone, and does not raise them unless you do. If something she learned is wrong, tell her and she corrects it. Each night she reviews the week more deeply and organizes what she learned; you can turn that nightly review off (Settings → Nightly review of my messages). What she learned is listed in What Lumina knows.
Claude Code (only if it is installed on that Mac)	Lumina for Mac runs Lumina's Claude Code agent, which carries out tasks you ask for on that Mac. Because the app starts it, it has the same access as the app.

What leaves your Mac is processed like your conversations: by Anthropic (Claude), to sort your mail, answer you and learn. You can turn off any of this at any time in System Settings → Privacy & Security, or by quitting Lumina for Mac.

Who processes it

These services process data for us to provide Lumina. Each receives only what its task needs:

Anthropic (Claude): your messages and her context, to write her replies and to summarize what she remembers.
Google (Gemini), only if you choose Gemini as her model (her model, at the top of the conversation): your messages and her context, to write her replies. Sorting mail, summaries and her work in the background stay with Anthropic.
DeepSeek, only if you choose DeepSeek as her model: your messages and her context, to write her replies. DeepSeek processes them in the People's Republic of China. Sorting mail, summaries and her work in the background stay with Anthropic. If DeepSeek cannot answer, OpenAI (or Anthropic) writes that reply instead.
OpenAI: the text of what she remembers, to make it searchable.
Deepgram: your voice, to turn it into text. If you choose Apple for listening (Settings → Listening), or the iPhone has no signal, your voice is turned into text on the iPhone itself and goes to no one.
ElevenLabs: her replies, to speak them aloud.
Amazon Web Services (Polly): her replies, to speak them aloud, only if you choose her Economy voice in Settings.
Perplexity: the searches she makes on the web for you.
Telnyx: phone calls she places or answers on her own number for you (the numbers, the audio of the call, the other side's words turned into text, and her replies spoken in her voice), and the short call that confirms your mobile number. Nothing is recorded; the transcript of each call is kept in your account with her last 50 calls. And her text messages from and to that number, once the person texted START to it: the numbers and the words. Mobile numbers and opt-in information are never sold or shared with third parties or affiliates for marketing or promotional purposes (Texts from Lumina).
Anthropic (Claude web search and fetch): the searches and page reads she makes to prepare a briefing (the person's name, work address domain and company), a trip sheet (the place), or what she knows of your employer (its name and web domain).
US National Weather Service: the coordinates of a trip's destination, for its forecast.
Your own AI accounts, only if you add a key under Menu → Integrations → Your AI accounts: Anthropic (a Claude agent), Google (a Gemini agent, Gemini Deep Research) or OpenAI (a GPT agent), for Hand it off and Research, xAI (Grok), any of them for Ask an AI (one answer to a question), and xAI, Google or OpenAI for Picture (the description of a picture to make). Each gets, on your own account and under its own terms with you, only what an action you set up and approve sends it: the question or the task, and the web pages it reads for it. Never your mail, your texts, or what you told her about your faith or your health. What an agent makes is brought back into your documents, and its copy at the company is deleted when the job ends. With a free Gemini key, Google may read what is sent and learn from it. Your keys are kept encrypted, used only for those actions, and shown only by their last four characters; removing one here does not cancel it at the company.
Google (YouTube Data API): what you ask to watch, to find videos.
Google (Google Maps Platform): the places you ask about and, when it matters to the answer, where you are, to find places, addresses and directions.
Amazon Web Services: hosting, storage (encrypted) and sign-in (Amazon Cognito); and Amazon SES, to deliver the email she sends you and, for you, to other people (the addresses, and the mail with any attachment), and to receive replies.
Apple: Sign in with Apple, In-App Purchase, notifications, and on-device services such as weather and maps.

Each provider handles data under its own terms and privacy policy. We do not sell your data or share it with advertisers or data brokers.

Google user data

You can connect up to five Google accounts (for example a work and a personal one); each is handled the same way, and only for you. For each, Lumina receives only what you allow on Google's consent screen: the account's email address (so she knows which account it is), your Gmail (gmail.modify: read, mark read, label, archive, move to Trash and back, save drafts, and send or forward; never permanent deletion), your calendar events (calendar.events: read, add, move, remove, and accept or decline invitations), and your contacts (contacts: look people up, and add, change or delete a contact only when you ask).

Use: only to provide what you ask of her: telling you what matters in new mail (if Settings → Gmail → Sort my new Gmail is on), archiving the new mail she would archive (if Settings → Gmail → Archive what she would is on), finding and reading mail (aloud, if you ask), marking read, labeling, archiving, moving to Trash or back, drafting, and sending or forwarding what you ask (trash, sending and forwarding only after your yes, sending from the account the mail belongs to), clearing spam from your inbox (if Settings → Gmail → Clear spam is on: mail like what you filed in the Lumina/Archived label is archived to a Lumina/Cleared label, never deleted, and Not spam puts it back), your schedule, adding, moving or removing the events you ask about and answering invitations (inviting guests, removing and answering only after your yes), looking up, adding, changing or deleting the contacts you ask about (deleting only after your yes), and who people are. Nothing else.
Transfer: only to the services listed in Who processes it, only as needed to do that, and each only for that task:
- Anthropic (Claude): each new message's sender, subject and an excerpt, to sort it; to clear spam, the sender, subject and a short excerpt of new bulk mail, or of a stranger's first email, that matches nothing you filed, together with the senders and subjects of what you filed, to judge whether it is the same kind; the mail, events and contacts you ask about, to answer you (or Google or DeepSeek, if you chose Gemini or DeepSeek as her model); and, if learning is on, mail from people you know, so she learns about your world.
- ElevenLabs (or Amazon Polly, with her Economy voice): the words of her reply when she speaks it, which can include a mail or an event she reads to you.
- OpenAI: the text of what she remembers, which can include what she learned from your mail, to make it searchable.
- Anthropic's web search, only while Preparing for what's coming is on: the name, email domain and company of a guest on a coming event, to prepare your briefing.
Nothing else is transferred, and nothing to anyone for their own use. Never sold, never used for advertising, and never used to train AI models, ours or anyone else's.
What is kept: your mail, calendar and contacts stay in Google; she reads them when needed. She keeps her sign-in (encrypted), the coming week of your calendar for her agenda, a note of how she sorted each new message (its sender, subject, an excerpt and her decision, deleted after 90 days), for spam clearing the senders, mailing lists and subjects of what you filed as spam (until you remove the account) and a list of what she cleared, with its sender and subject (14 days), and, if learning is on, what mail from people you know taught her about your world, in her memory of you, which you can see and correct.
People: no person reads it, except with your permission (such as a reply you report), for security, or when the law requires.
Limited Use: Lumina's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
Protection: see Security: Google data and sign-ins are stored only encrypted, only in your own account's space, and reached only by your Lumina.
Your control: each account has its own switch (Menu → Integrations → Google): off, she uses none of it. Remove revokes Lumina's access to that account at Google and deletes her sign-in, its spam lessons and list, and her sorting notes on its Gmail messages at once; summaries she wrote of your day or week may mention a message until they expire (90 days, or 180 for a week), and deleting your account erases everything at once. You can also remove Lumina at myaccount.google.com/permissions.

Slack data

If you connect Slack, you sign in to Slack as yourself and approve Lumina's access on Slack's consent screen. Lumina acts with your own Slack sign-in, so she can see only what you can see in Slack, and only within what you approved: searching messages, reading public and private channels, DMs, group DMs and threads, finding people and channels, opening files shared in Slack, and sending messages. A Bioscope.ai workspace connects through Slack's own server for AI assistants; every other workspace connects through the "Lumina" Slack app, served by Lumina itself. Your workspace's admins may need to approve the app first.

Use: only to provide what you ask of her: finding and reading messages, threads and files, telling you when someone sends you a DM or mentions you, and sending or scheduling a message as you, only after your yes. Nothing else.
Transfer: what she reads goes to the AI services above only as needed to do that: a new DM or mention to Anthropic, so she can judge whether to tell you now, and what you ask about (to Anthropic, or to Google or DeepSeek if you chose Gemini or DeepSeek as her model). If learning is on, DMs from people you correspond with teach her about your world, as texts and mail do. Never sold, never used for advertising, and never used to train AI models, ours or anyone else's.
What is kept: your messages and files stay in Slack; she reads them when needed. A file she opens is read for that one request and never stored. She keeps her sign-in (encrypted); the DMs and mentions that reached you in the last 30 days (who wrote, when, where, and the first 600 characters), so she knows what you have and have not answered, deleted as each turns 30 days old; the names of the people in them; and counts of the messages you exchange with each person and post in each channel (never the words), deleted after 120 days, so she knows whom you talk to most. What you discussed with her about Slack stays in your conversation with her, like anything else you tell her.
People: no person reads it, except with your permission, for security, or when the law requires.
Your control: Menu → Integrations → Slack → Disconnect deletes, at once, her sign-in and everything she kept from Slack: the DMs and mentions, the names and the counts. She can no longer reach your Slack. Deleting your account does the same. Slack keeps the app installed for you until you remove it at slack.com/apps/manage.

Instagram data

If you connect Instagram, you sign in to Instagram and approve Lumina's access on Instagram's consent screen. Only professional (Business or Creator) accounts can be connected; Instagram gives apps nothing of a personal account. Lumina receives what you approve: your profile, your posts and their comments, and your DM conversations, with the permission to reply to them.

Use: only to provide what you ask of her: reading your DMs (the latest 20 messages of each conversation) and the comments on your posts, telling you when a DM or a comment arrives, and replying to a DM or a comment as you, only after your yes. Nothing else.
Transfer: what she reads goes to the AI services above only as needed to answer you (to Anthropic, or to Google or DeepSeek if you chose Gemini or DeepSeek as her model). Never sold, never used for advertising, and never used to train AI models, ours or anyone else's.
What is kept: your messages and comments stay in Instagram; she reads them when needed. A new DM or comment is passed on to you as a notification and not stored apart from that. She keeps her sign-in (encrypted), your Instagram account's identifiers (so that Instagram's notices and Meta's removal requests reach your Lumina), and counts of the DMs you exchange with each person (never the words), so she knows whom you talk to most. What you discussed with her about Instagram stays in your conversation with her, like anything else you tell her.
People: no person reads it, except with your permission, for security, or when the law requires.
Your control: Menu → Integrations → Instagram → Disconnect deletes, at once, her sign-in and everything she kept from Instagram: your account's identifiers and the counts. Removing Lumina in Instagram (Settings → Apps and websites), asking Meta to have your data deleted, or deleting your Lumina account does the same; for a deletion request Lumina gives you a confirmation code and a page that says when it is done.

Garmin data

If you connect Garmin, you sign in on Garmin's own page (Lumina never sees your Garmin password), allow Lumina there, and then confirm on Lumina's page, which says what Lumina gets and where it goes. Garmin then sends Lumina your watch's summaries, listed above, each time the watch syncs with the Garmin Connect app.

AI transparency statement: Garmin's summaries are processed by artificial intelligence, to provide what Lumina does for you and for nothing else. Each time she answers you, the summaries that matter right now (asleep or awake, last night, steps, stress and Body Battery) go with her context to the AI that writes her reply: Anthropic's Claude (directly or through Amazon Bedrock), or Google's Gemini if you chose it as her model. They never go to DeepSeek: when DeepSeek writes her replies, her context carries nothing from Garmin. What she says aloud goes to ElevenLabs or Amazon Polly to be spoken. None of it, nor anything derived from it, is used to train, evaluate or improve AI models, ours or anyone else's. Connecting is your consent to this processing; disconnecting withdraws it at once.
Who receives it: Amazon Web Services hosts and stores it (encrypted) for Lumina; Anthropic (directly or through Amazon Bedrock) or Google (Gemini, if you chose it) process it to write her replies; ElevenLabs or Amazon Polly speak her words. No one else receives it, and Lumina's Garmin keys are never shared with anyone.
Use and transfer: only to provide what you ask of her and the features above. Never sold, never used for advertising or marketing, never shared with anyone beyond the services named above, and never used to decide anything for your safety.
What is kept: her sign-in (encrypted), your Garmin user identifier (so that Garmin's summaries reach your Lumina), the latest of each summary, and its values in the one row a day kept for 90 days. A sleep schedule learned from your nights is in What Lumina knows, where you can correct or forget it.
People: no person reads it, except with your permission, for security, or when the law requires.
Your control: Menu → Integrations → Garmin → Disconnect ends Lumina's access at Garmin and deletes, at once, everything she kept from Garmin: the latest summaries and Garmin's values in the daily rows; switching Garmin off keeps the sign-in and stops her using it. Removing Lumina in Garmin Connect, or withdrawing the Health permission there, does the same as Disconnect. Deleting your Lumina account deletes all of it and ends the access at Garmin. You may ask for a copy of what Lumina kept from Garmin, its correction or its deletion at any time (Your rights). Garmin's own handling of your data is in Garmin's privacy policy.

Circles, blocks and reports

What you send or share in a circle reaches only the members you send it to. Lumina reads message text as it is sent to refuse objectionable language; nothing is kept from that check. A block is kept with your account and is never shown to the person blocked. When you report a message or a member, a copy of what you reported, your reason and your note go to our team at lumina-support@bioscope.ai to review, and the report is kept until it is resolved.

When you invite someone to a circle, you choose what Lumina tells their Lumina about them (for example what they are to you, their town, their work, their family), and you may let Lumina look them up on the public web: it keeps only public, professional details from at least two sources that clearly identify them, with links, and never uses people-search sites or photos. Nothing is shared until they accept; they see each item with where it came from and can correct or delete it. Until they accept, it is kept with the invite and deleted only when you take the invite back, delete the circle or delete your account. Data from your Google mail is never shared.

Text messages (SMS)

Lumina's assistant texts from its own phone number only people who first texted START to that number themselves (Texts from Lumina shows how). For those texts we keep the phone numbers, the words of each text, and when and how each person opted in or out, to send the texts they asked for, to honor STOP, and to show their consent if asked. Texts are carried by Telnyx, our telephone carrier.

No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. Text messaging originator opt-in data and consent are not shared with any third parties, except the carriers and providers that deliver the texts. Mobile numbers and opt-in information are never sold.

Message frequency varies. Msg & data rates may apply. Reply HELP for help, or STOP to cancel at any time.

How long we keep it

Your account data (conversations, memory, location history, settings, balance and reports) is kept while your account exists and deleted when you delete the account, except purchase records we must keep for tax and accounting law.
Service logs, which can include parts of requests, are kept for 30 days.
Short spoken phrases of hers (such as "Good morning") may be cached to answer faster; they hold no conversation.

Deleting your data

In the app: Settings → Account → Delete account. This stops your Lumina, deletes your conversations, memory and files, revokes Lumina's Sign in with Apple access, and deletes your account. You can also write to lumina-support@bioscope.ai and we will delete it for you.

Your rights

You may ask for a copy of your data, its correction, or its deletion, and you may withdraw your consent to the AI services in the app at any time. Residents of some places (for example the EU, the UK and California) have these and other rights under their law; write to us and we will respond within the time the law allows.

Children

Lumina is not meant for children under 13, and we do not knowingly collect data from them. If you believe a child has an account, write to us and we will delete it.

Security

How we protect your data, and above all sensitive data such as your mail, messages, health readings and the sign-ins to services you connect:

In transit: everything travels encrypted with TLS (HTTPS), between your devices and Lumina and between Lumina and the services above, and inside our cloud between Lumina and her storage.
At rest: each account's files are stored on encrypted storage (Amazon EFS, encrypted with keys held in AWS Key Management Service). On top of that, the sign-ins to Google (its access and refresh tokens) and to the other services you connect are each sealed with a key of their own held in AWS Key Management Service, bound to your account, and kept in files only your Lumina can read.
Separation: each person's Lumina runs on its own, with its own files that no other account's Lumina can reach, and accepts only that person's sign-in (Sign in with Apple, through Amazon Cognito).
Minimum access: Lumina asks Google and the other services only for what her features need, and keeps your mail, calendar and contacts with the service that holds them, reading them when needed rather than copying them. Our own staff do not read your data, except with your permission, for security, or when the law requires; access to our cloud is limited to the few people who run it, through single sign-on.
Deletion: removing a connection or deleting your account deletes what is described above at once.

Changes

We will post changes here with a new effective date, and tell you in the app if they matter to how your data is used.