LUMAI Privacy Policy

This policy describes LUMAI as it is sold on the App Store. That app uses no cloud speech or language service, and no paid add-on is sold in it. The requests it does make are listed under “What leaves your device”.

What LUMAI stores

LUMAI has no accounts, no sign-in, no analytics, no ads, and no tracking. It stores only the on-device information described below.

Where your data lives

• The last room selected on Home is remembered on this device with its bridge identifier, so it can reopen the same room. It is not uploaded.
• Your Hue Bridge address and the application key created when you pair are stored only on your device.
• Your rooms, lights, scenes, and looks are read from your own Hue Bridge over your local network.
• In the app you buy, if you use the microphone (hold-to-talk), what you say is recognized by iOS on this device whenever on-device speech recognition works. If this device cannot recognize speech on its own, LUMAI leaves the microphone closed rather than uploading audio. The microphone itself tells you when it is listening.
• A bounded, on-device observation log can remember a room’s bridge ID, the kind of lighting change, a broad time window, and rounded brightness. It stores neither what you said nor the room’s name or a calendar date. You can erase it from Settings → What she notices.
• Clip-library coverage is remembered as up to 400 identifiers and counts on this device. On iPhone, capture witnesses are also kept in the iOS Keychain across restarts; the older local capture witness is deleted when the queue is rewritten. The Library collector is paused, so these counts are not uploaded. No sentence wording or slot values are stored in this queue.
• Whether you have read the light-effects health notice is remembered on this device (one flag), so the warning is shown before the first fast-changing effect and not on every visit. Nothing else is recorded with it.
• A picture you select for Colour from a picture is decoded and analysed on this device. LUMAI never uploads or retains the picture; only the derived preview colour is used for a direct local bridge write.
• If you pair a Philips Hue Play HDMI Sync Box, LUMAI stores that box’s address and the access token it issued on this device. On iPhone, new tokens use a separate, device-only iOS Keychain item. Older app-storage copies are removed only after secure storage is confirmed, and may remain if migration or cleanup fails. Existing device backups may retain older copies. The web version uses browser storage; these tokens are not uploaded to LUMAI’s server.
• The names of any protected rooms — rooms you have told LUMAI never to touch, list, or name back — are kept on this device only. The list is empty on a fresh install, you choose what goes in it, and nothing about it leaves the phone.
• LUMAI also keeps on this device, and nowhere else: which room is yours (so “my room” means something, asked once and never guessed), which room you meant by a shared room name such as “the bedroom” (asked once, and never used again once that bridge is forgotten), your timers and their journal, your saved looks and their backup, which rooms follow daylight, your voice preference, your music-sync preferences and receipts, your dimmer and switch mappings, how many times the app has been opened, the minute Signify’s discovery service last refused a lookup (so it is not asked again for fifteen minutes), whether you left continuous talk switched on, a counter and a short list of opaque handles that stop an already-confirmed change from being run twice.
• While a look is staged and you have not made it real yet, the sentence you asked for and which variation of it you were shown are kept on this device for up to thirty minutes, so the preview survives iOS reloading the app in the background. It is dropped once the look is made real, and ignored after thirty minutes whether or not it was dropped.
• On iPhone, the bridge application key is held in the iOS Keychain, not in ordinary app storage.
• LUMAI keeps a small house snapshot on this device: your room and zone names, whether each is on, its brightness, your bridge’s address and id, and when it was last written. It is what lets the widget and Siri answer without opening the app. It never contains your bridge’s application key, it leaves out any room you have protected, and it is not uploaded.
• If the screen inside LUMAI is ever shut down by iOS during a Live call, the app keeps one screen-restart mark on this device: a timestamp and nothing else. The next Live call reports the fact (not the time, not what was said) so the problem can be fixed; it is then erased. It is not a recording and it is not uploaded on its own.
• On the developer’s own test iPhone only, the list of rooms LUMAI must never touch is fetched from LUMAI’s server after that phone proves its device key, and kept in the iOS Keychain on that phone. No App Store copy asks for it, and it is never built into the app.
• When the app asks this iPhone to sign a confirmation, Apple’s App Attest creates a device key. Only that key’s identifier is kept, on this device. It is a signature from a device — never a name, an account, or a way to contact you.

What leaves your device

Lighting commands travel directly from your device to your Hue Bridge on your local network. Your bridge key is sent only to your local bridge, not to LUMAI or a speech provider. Stored schedules are not uploaded.

In the app you buy, spoken replies use filmed clips and the iPhone’s built-in voice, microphone audio stays on the device or the microphone stays closed, and lighting sentences are parsed on the iPhone. No speech or language vendor is called. One request leaves.

Bridge discovery during setup. When the pairing screen searches for your bridge, LUMAI asks Signify’s official discovery service (discovery.meethue.com) for your bridge’s address at the same time as it looks on your local network. That request carries no account details or room data; like any internet request, it reaches Signify from your internet address. Typing your bridge’s IP address does not avoid it, because the lookup starts as soon as the pairing screen searches.

A calendar or assistant question is recognized only so it cannot become a light change. LUMAI answers it on this phone, keeps no calendar and cannot pass the question along.

Separate unlisted web presentation

The private presentation is a separate unlisted web experience and is not included in the iOS app. It collects no engagement analytics. If you choose its optional talk-back, typed or browser-transcribed text and bounded page-session context are sent to xAI through our server for a tool-less reply inside the simulated room. Browser speech recognition is device-dependent. Microphone audio is not sent to LUMAI or xAI by the presentation; the browser’s recognition service may process it under its own terms. LUMAI does not persist the conversation, but xAI says its default API handling stores requests and responses for 30 days. Zero Data Retention (ZDR) is not verified for this presentation. See xAI’s API security policy.

Permissions

• Local Network — required to find and control your Hue Bridge. iOS asks once; if it was declined, LUMAI cannot ask again. Turn it back on in Settings → LUMAI → Local Network (the app offers a direct link).
• Microphone — optional, only if you choose to talk to LUMAI, the in-app companion.
• Speech Recognition — optional; it turns what you say into a lighting request, on this iPhone whenever this iPhone supports it. This local recognition mode does not save your spoken request.
• Camera — optional, and only if you choose “Take Photo” for Colour from a picture. The picture is read on your phone and never leaves it.

Health notice

Flashing and fast-changing light effects — including LUMAI’s effects, colour movement, music sync, and Hue Entertainment or Sync Box streaming — can trigger seizures in people with photosensitive epilepsy, and certain light combinations can cause discomfort or adverse effects for some people. If you feel any discomfort, stop using that lighting feature immediately.

Children

LUMAI is not directed to children and does not create profiles or knowingly retain children’s personal information.

Changes

If this policy ever changes, the updated version will be posted at this URL with a new date.

Contact

Questions: reply through the App Store support link for LUMAI, or email hello@mar-ai.org.