Privacy

This is an informational website. Its current version has no accounts, forms, note input, or AI processing in the browser. Viewing a page does not start the Luma application or send notes to an AI engine.

The reviewed files contain no JavaScript, audience analytics, advertising trackers, embedded third-party content, or external fonts. The website adds no tracking cookies. This does not mean its hosting provider processes no technical data.

When a website is served by GitHub Pages, your browser communicates with GitHub’s infrastructure to load pages and resources. GitHub states that it logs and stores visitors’ IP addresses for security purposes, even when visitors are not signed in to GitHub.

See the GitHub Pages data collection documentation and GitHub General Privacy Statement. Other technical data, recipients, retention periods, and any transfers must be checked against the terms applicable to the chosen hosting arrangement. No website-specific retention period is established here.

The macOS application is separate from this website. According to the product brief based on the 14 October 2026 audit, notes are stored locally using SwiftData, with CloudKit disabled. Chapters, version history, and review progress are also stored locally. An optional disk cache may contain analyses and passages from notes.

This describes the audited version and is not a guarantee for every future version. Storage locations, logs, caches, and deletion procedures must be checked in the released version. Deleting a note must not be described as automatically erasing its history, exports, or remote backups.

Codex is Luma’s recommended engine. It requires Codex CLI to be installed and signed in to a ChatGPT account, with network access. The note text used for generation is sent to the OpenAI service associated with that account. Turning off the Wikipedia search globe does not disable this transmission.

Remote processing is subject to the service’s terms and the account’s settings. See the official Codex security and privacy documentation. Retention, logging, any use of content to improve models, and transfers must be checked for the account and configuration in use. No guarantee of zero retention or exclusion from training is made here.

With Ollama installed and running on the Mac and a local model downloaded, Luma can generate content on that device. According to the brief, this local flow does not send note text to a remote generation service.

The initial installation and model download require internet access. Offline use requires an available local model, without Codex, Wikipedia search, or GitHub backup. This description does not cover a remote Ollama server or cloud model; check the actual configuration against the Ollama documentation. Local storage and logs still need to be reviewed.

Wikipedia: when the globe is enabled, Luma sends concepts or search terms to the Wikipedia API to find articles and excerpts. According to the brief, this flow does not send the full text of notes. Search terms may still contain personal information drawn from them, and the service also receives technical connection data. See the Wikimedia Privacy Policy.

GitHub: optional backup sends the full contents of the backed-up data to a private repository configured with SSH access. This includes notes, chapters, versions, tags, favourites, and review progress. A private repository is still a remote service, subject to access permissions and GitHub’s terms. Deleting histories and copies requires a separate review.

These services are independent of the AI engine you choose. Following an external link on this website does not enable an application integration; the destination website applies its own rules.

To complete before publication: the identity and contact details of the controller for processing under the publisher’s responsibility, a privacy contact, and, where applicable, the data protection officer’s contact details.

Depending on the processing and applicable legal conditions, you may have rights of access, rectification, erasure, restriction, objection, and data portability, as well as withdrawal of consent where processing relies on it. Requests concerning third-party services also follow their procedures. See the CNIL’s guidance on your rights (in French); you may lodge a complaint with the CNIL, the French data protection authority.

To verify: the respective responsibilities of the publisher and providers, applicable purposes and legal bases, recipients, retention periods or criteria, transfers outside the European Economic Area, and any safeguards. This draft does not replace those missing disclosures.