← lumollo

The short version

• Your notes stay on your phone, encrypted. The key never comes to us.
• A short excerpt leaves so a note can be understood — through our server to a frontier AI model, back as the result. We keep none of it; the AI provider holds it up to 30 days for abuse checks (§3.4).
• Names are masked first. The AI reads “Call [name] about her exam”. No setting turns this off.
• We store your login. Nothing else.
• Nothing you write trains the AI. No analytics, tracking or ads, nothing sold.
• Delete means delete. Remove a person and everything about them goes.

1. Who is responsible for what

lumollo is an iOS app. We means lumollo, its publisher, which is based in the United States. Contact: support@lumollo.ai.

Your vault is yours. You decide what to write and when to delete it. We hold no copy and only synthesise what you wrote, adding nothing. You are in charge; we act on your instruction. The one thing we control is your account (§4).

2. Where your data lives

Your people, notes, imported chats, facts, plans, actions and drafts sit in one encrypted store on your iPhone — the vault.

• The key is created on your phone, kept in iOS’s secure store, never sent to us, and not placed in iCloud Keychain.
• The vault cannot be read while your phone is locked.
• Deleted data is overwritten inside the vault, not merely unlinked — the app sets SQLite’s secure_delete, so freed pages are zeroed. Copies already in your device backups are a separate matter and persist until those backups age out (§2.1).
• We hold no copy: no vault of ours, no sync, no mirror.

2.1 Backups

Your vault and its key travel in your encrypted iPhone or iCloud backup, so losing your phone does not lose your data. We never receive that backup. Turning off iCloud Backup keeps the vault on the phone alone — and then a lost phone does mean lost data.

If you set an app lock, restoring a backup asks for it.

2.2 Voice recordings

Not kept. Audio exists only long enough to become text, then is deleted. The text is saved; the recording is not.

2.3 Contacts and reminders

With Contacts access, lumollo reads the name, phone, email, organisation and birthday of the contacts you bring in, and saves them in the vault. Your address book is never uploaded, and the rest of it is never read. What you type into a note travels like any other note (§3).

Reminders are scheduled by iOS and show a first name only — never your note, the action text or a date. A setting replaces the name too.

3. What leaves your device

Only what is needed to understand a note, and only when you act — saving a note, importing a chat, recording, asking a question. It goes to our server, which passes it to one of the frontier AI models and returns the result. Our server holds the AI key so the app does not have to. Our server keeps none of it; what the AI provider holds, and for how long, is in §3.4.

Being precise about a word: we do not store your notes, and an excerpt is nevertheless processed by us in transit — it passes through our server and is handled by the AI provider. Both things are true, and the second is what this section is about.

3.1 What is sent

• A handful of recent notes about one person, plus earlier summaries. Never your library.
• From an imported chat, the other person’s messages only — never yours.
• Voice audio, to become text; on-device transcription is less accurate. A rough on-device transcript is the fallback if the upload fails.

3.2 Names are masked first

Saved names, your own, the names of people you deleted, and the app’s internal references all become placeholders. The list restoring them never leaves your phone and is never logged. No setting turns this off.

The limit: masking works only from names the app knows. Any other name travels as typed, and your words travel as written. Masking hides who, not what.

3.3 What never leaves

• The vault as a whole. Selected excerpts do leave — that is §3.1, and it is the entire point of this section’s limits. What never leaves is the store itself: no bulk copy, no export, no sync.
• Your contacts list, and any photo.
• Your own messages, and chats you did not import.
• Anything identifying which person a note concerns.

A request is signed in as you, so our server knows which account sent it. The AI is not told.

3.4 What is kept

Our server: nothing. No note, transcript, audio or answer is written or logged. It keeps usage and cost totals, tied to nothing about you.

The AI provider: nothing trains their models; held up to 30 days for abuse checks, then deleted — audio and text alike.

Three companies process data on our instruction, and no others: a leading AI lab (the model, and speech-to-text), Cloudflare (hosts our server, this site and the account records), and Resend (account email only, never marketing).

Two more are involved without acting for us, and they are named here because “three and no others” would otherwise read as more than it means:

• Apple — the App Store handles any purchase, and your encrypted device backup is theirs, not ours (§2.1). Apple decides its own purposes for those; we receive no payment details. If you use Sign in with Apple, we get a meaningless identifier and, unless you hide it, an email address.
• Google — only if you choose Sign in with Google. We receive a stable Google account identifier and your email address, and nothing else: we do not ask for your name or photo, we never see your Google password, and we have no access to Gmail or anything else in your account. The identifier, not the email, is what your account is keyed on.

There is no analytics, crash reporter, advertising network or customer-data platform. We do not track you across apps or websites, and do not sell or share your personal information (§9).

4. Accounts

AI features need an account. We store your email, a one-way scrambled password, a random account number, sessions and expiring codes (also one-way), and the day you signed up. With Apple or Google sign-in we store only their meaningless identifier; Hide My Email gives us the forwarding address only.

We do not store your IP address, device or app version, sign-in history, or anything timed finer than a day.

You can delete your account in the app — a real deletion. It does not touch the vault on your phone, which we cannot reach.

Unless you ask for that too. Delete everything, in Settings, erases both: your account on our side, and on this iPhone the library, the voice recordings and your settings. It is the only thing in the app that does. An encrypted Apple backup you already made still holds a copy (§2.1) — restoring from one brings the library back.

5. Legal bases, and the people in your notes

We rely on consent only for the permissions iOS asks you for — microphone, speech, contacts, notifications — changeable in Settings at any time.

No line here lets us use your content to improve our products — we do not train models on it, study how you use the app, or learn anything across our users.

5.1 When you write about other people

Your notes are about people who did not ask to be. They stay your record, on your phone. We build nothing from them, sell nothing and share nothing beyond §3.4. Names are masked before anything leaves, only excerpts travel, we keep no copy, and one step removes a person entirely (§5.3).

5.2 Children in your notes

A niece’s school year or a godson’s birthday is the same private record: yours, on your phone, protected and removable the same way. We collect nothing from a child, and lumollo is not a service a child signs up to (§10).

5.3 Removing someone

Deleting a person removes every note, fact, plan, action, draft and birthday, with the space overwritten. Nothing remains. If you have been written about, write to support@lumollo.ai — we cannot search anyone’s phone, but we will tell you what the app keeps and what the writer can remove.

6. How long things are kept

• On your phone: until you delete it. One exception — when the app clears a summary it wrote, the leftover record is erased 30 days later.
• On our side: no content at all. Account details until you delete your account; sessions expire by themselves.
• An unfinished signup: an address that is never confirmed is deleted from our server within nine days — automatically, and whether or not anyone asks.
• At the AI provider: up to 30 days, then deleted.

7. Your rights

If you are in the UK or EEA, these are yours. Write to support@lumollo.ai; we answer within one month.

• Access (Art. 15). We send your account data — the list in §4. Of your vault we hold nothing; the app shows you all of it.
• Correction (Art. 16). Edit any note and the app re-reads it, withdrawing what the old wording produced. Write to us for your account email.
• Erasure (Art. 17). Deleting a person or your account is real deletion. For someone else’s notes about you, see §5.3.
• Portability (Art. 20). Account details in a reusable form on request. Your vault is on your phone; there is no whole-vault export today.
• Objection and restriction (Art. 18, 21). Objecting to §3 means not using the AI features; the rest works.
• Withdraw a permission. iOS Settings, any time.
• Complain. To your data protection authority — in the UK the ICO; in the EEA, the authority where you live (list); in the US, see §9.

8. International transfers

We are based in the United States, and so are the three companies in §3.4. Your account details and anything sent for AI processing are handled there.

If you are in the UK or the EEA, that is an international transfer. It relies on the standard contractual clauses (and the UK addendum), which oblige everyone handling the data to protect it to the standard you are used to at home. Your rights in §7 are unaffected by where the servers are.

Your vault is not part of any of this. It stays on your phone (§2) and crosses no border.

9. If you are in the United States

We do not sell your personal information or share it for cross-context behavioural advertising. There is no advertising, attribution or analytics code in lumollo.

In California’s terms we collect identifiers (email, account number, and a provider identifier if you sign in with Apple or Google), audio (voice notes sent for transcription) and the note excerpts sent for AI processing. We store neither of the last two — but they pass through us and the AI provider holds them up to 30 days (§3.4), so we count them as collected rather than argue the point. The vault itself we do not collect. It comes from you; we use it to provide the service, sign you in and prevent abuse, and keep it as §6 says. You may know, delete, correct, opt out of sale or sharing (there is none), limit sensitive-data use, and not be treated worse for asking. We honour equivalent requests from any US state with a comparable law.

To complain: your state Attorney General, or in California the California Privacy Protection Agency.

10. Children

lumollo is not made for children. You must be 16 or older. We do not knowingly collect personal information from anyone younger, and will delete it if we find we have. For children appearing in someone’s notes, see §5.2.

11. Security

• The vault is encrypted on your device and its key never comes to us. Both travel only in your encrypted Apple backup (§2.1).
• The vault cannot be read while your phone is locked.
• The optional app lock survives a restore. Encryption underneath is always on.
• We never hold your password, only a one-way form that cannot be reversed. Sessions likewise.
• Requests must be authenticated; a misconfigured server refuses everything.

No system is perfectly secure. Report weaknesses to support@lumollo.ai.

12. If this policy changes

We update the date above and publish the new version here. If a change affects what leaves your phone, what we store, or who handles it, we tell you in the app before it takes effect — and by email once your address is confirmed.

13. Contact

support@lumollo.ai — for the rights in §7, any question, or a request from someone who has been written about (§5.3). We answer within one month.