Privacy Policy

This policy explains how Lumen (“we”, “us”) handles personal information when you use Lumen, a study app for students in New South Wales. We handle personal information in line with the Australian Privacy Principles in the Privacy Act 1988 (Cth).

1. What we collect

Your account

• Your email address and name.
• Your password, stored only as a secure hash by our authentication provider. If you sign in with Google, we receive your name and email from Google, not your Google password.

Your profile (optional)

• Your school, school year, courses and daily study goal, if you add them or tell Lumen in chat.

Memory

• Short notes Lumen saves when you tell it something about your study in chat, such as a topic you find hard or when your exams are. Every save is shown to you with an Undo button, and you can see, delete or turn off memory in Settings → Memory. Lumen is told not to save health, family or other sensitive details, and never saves from notes or documents you paste in.

How you use Lumen

• Your plan (Free or Paid) and counts of what you've used today and this month, so the Free limits work.
• Technical information needed to run the service securely, such as sign-in cookies and short-lived server logs (which can include your IP address). Our logs of AI requests record their size and cost, not what you wrote.
• Anonymous usage statistics from Vercel Web Analytics: which pages are visited and a few actions (like making a study set or finishing a paper), with your country and device type. It uses no cookies, doesn't identify you, and never includes what you type.

Payments

• If you buy Paid, Stripe collects your card details and billing email and processes the payment. We receive your subscription's status, renewal date and invoices, not your full card number.

Emails

• If you switch on study reminders in Settings → Notifications, we use your email address to send them. Every email has a one-click unsubscribe.

Photos, files and shared papers

• Photos of handwritten answers, and files you attach in chat (photos, PDFs, text), are sent to an AI model to read them and aren't kept after that. A photo taken on your phone through the QR code is held for a few minutes until your computer collects it, then deleted. Syllabus PDFs are read in your browser; only their text is sent.
• Texts you upload for text analysis (a poem, a speech, a chapter) are read in your browser and their text is sent to an AI model to find themes and quotes. We don't store the text: it stays in your browser on that device, and only the analysis (themes, quotes and notes) is saved to your library.
• If you share a paper, a copy of the paper and your first name is stored so anyone with the link can open it, until you stop sharing it. Your answers and marks aren't shared.

Ratings

• Your rating and comment if you use Rate us. We use them to improve Lumen and don't publish them.

What you write

• When you chat, make something, or have an answer marked, the text you send and the study items you're working on are sent to an AI model to produce the reply.

2. Where your information is kept

• Your study library (papers, answers, marks, flashcards, notes, exams and chats) is saved in your browser and synced to your account with Supabase, so it follows you to other devices. Only you can read it.
• Your account, profile, memory notes, plan and usage counts are stored with our database and authentication provider, Supabase. The website runs on Vercel, emails are sent through Resend, and payments are handled by Stripe. If Lumen crashes, an error report goes to Sentry so we can fix it; we've turned off what it would otherwise collect, so reports carry no messages, files, AI prompts or replies, or account details.
• AI requests go through OpenRouter to AI providers that we require to keep zero data retention: they process your request to answer it and don't store it or use it to train models.

3. How we use it

• To run Lumen: your account, making and marking study material, and applying plan limits.
• To fit answers to you: your year, courses and memory notes are sent to the AI with your messages so it follows the right syllabus.
• To keep Lumen secure and working, and to prevent abuse.
• To contact you about your account, such as password resets, and important changes to Lumen.

We don't sell or rent personal information, we don't show advertising, and we don't use what you write to train AI models.

4. Students under 18

Many Lumen students are under 18. We collect only what Lumen needs to work, which is why AI requests go only to zero-data-retention providers. If you're under 18, check with a parent or guardian before signing up. A parent or guardian can contact us about their child's account at any time.

5. Overseas disclosure

Our service providers (Supabase, Vercel, Stripe, Resend, Sentry, OpenRouter and the AI providers it routes to) may store or process information outside Australia, including in the United States. We choose providers with strong security and, for AI, zero data retention, and take reasonable steps to make sure they handle your information consistently with the Australian Privacy Principles.

6. Security

We use encrypted connections (HTTPS), hashed passwords, access controls on our database so each account can only reach its own data, and per-account rate limits. No system is perfectly secure, so please keep your password private and tell us if you think your account has been misused.

7. How long we keep it

• Account and profile information, and memory notes: while your account exists, or until you delete them in Settings.
• Usage counts: they reset daily and monthly, and are kept only as long as needed for plan limits.
• Server logs: kept briefly for security and troubleshooting.
• Your study library: while your account exists. Deleting your account deletes it.
• Payment records: Stripe and we keep invoices and payment records for as long as tax law requires, even after you cancel or delete your account.

8. Access, correction and deletion

You can see and change your profile and memory in Settings, download everything we hold in Settings → Account → Compliance, and delete your account there too. To get a copy of the information we hold about you, correct it, or delete your account and the information stored with it, email us at lumenhsc@gmail.com. We'll respond within 30 days.

9. Complaints

If you're concerned about how we've handled your information, email us at lumenhsc@gmail.com and we'll respond within 30 days. If you're not satisfied with our response, you can complain to the Office of the Australian Information Commissioner at oaic.gov.au.

10. Changes to this policy

We'll update this page if how we handle information changes, and tell you in the app about significant changes. The date at the top shows when it last changed.

Contact

Questions about privacy: lumenhsc@gmail.com.