Privacy Policy

1. What we collect

Account: your email address and a hashed password (or your Google account id if you sign in with Google), managed by Supabase, our authentication and database provider.

Content: the decks you create and any documents you upload for deck generation. Uploaded documents are processed to text in memory to build your deck and are not stored on our servers.

Usage: a per-account metering record (deck credits, plan, generations used) needed to run the free tier and paid plans.

2. Payments

Purchases are handled entirely by Dodo Payments, our merchant of record. Your card, UPI, or wallet details go directly to them and never reach our servers. We receive only the confirmation needed to credit your account (which product was bought and for which account).

3. AI processing and other providers

When you generate or edit a deck with AI, the topic, brief, and any uploaded document text are sent to our AI providers (Anthropic for text, Cloudflare for images) to produce the result. These providers process the data to serve the request and do not use it to train models under our agreements with them.

Stock photos come from Pexels: search terms drawn from your deck, or typed into the image picker, are sent to Pexels, and the photos load from Pexels when a deck is viewed. Placeholder images, used where a deck has no photo yet, load from Lorem Picsum, and their addresses can include those search terms.

Lumora is hosted on Vercel, which also provides our cookieless page-view analytics. Sign-in and sign-up are protected by Cloudflare Turnstile, a bot check. Account emails, such as confirming your address or resetting your password, are sent through Resend. Feedback sent from the studio reaches us through Web3Forms.

4. What we don't do

We do not sell or rent your data, we do not run third-party advertising or cross-site tracking, and we do not read your decks except when required to operate the service or investigate abuse.

5. Cookies and browser storage

Lumora sets no advertising or tracking cookies. Your browser stores only what the app needs: your sign-in session (Supabase), decks saved in this browser and whether they have been moved into your account, the links you have published from it, a count of recent sign-in attempts, and your light or dark preference.

6. Sharing links

A deck is private unless you create a share link for it. Anyone with the link can view the deck as it was when you published it; editing or deleting the deck later does not change or remove it. You can unpublish a link at any time from the Published links list on your decks page, in any browser where you are signed in to the account that published it, or by emailing us the link.

7. Retention and deletion

Decks and account data are kept while your account exists.

You can delete your account yourself from the Account page. That immediately deletes your decks, including any photos you uploaded into them, and your billing record.

It also takes down the share links you have published. Links from Lumora's first weeks were stored without a record of who published them, so they cannot be matched to your account; email us any of those and we will remove them. Deleting your account does not remove images generated for your decks: those are stored at unlisted web addresses and stay there even after a deck or account is deleted. To have them removed too, email infolumora2389@gmail.com from your account address and we will delete them within 30 days.

If your account received the free deck, we keep a one-way hash of its email address after deletion, never the address itself, used only to stop the free deck being claimed again.

8. Contact

Data controller: Ayush Yadav (sole proprietor, India), infolumora2389@gmail.com. We may update this policy; material changes will be announced on the site.