Privacy Policy

Short version: we store what we need to teach you, we don't sell it, and you can delete all of it from Settings at any time.

What we collect

• Account: your email address, and a password hash if you set one. Payment details are handled by Stripe — we never see your card number.
• What you add: lecture links, uploaded syllabi, slides, notes, homework and quizzes, photos of your work, and anything you draw on the whiteboard or write on a page.
• Your learning: the questions you ask, Lumo's replies, practice attempts, and the derived model of what you know — concepts, mastery estimates and misconceptions.
• Technical: basic logs and usage counts (how many questions today, which model answered) for limits, billing and debugging.

Why we use it

To run the service you asked for: answering your questions about a specific moment in a lecture, building your course map from your syllabus, choosing your next practice problem, and enforcing plan limits. Your learning history is what makes the tutor adapt to you rather than start from zero every session.

Who it goes to

• Google (Gemini API): the content needed to answer a question — the video moment, page image, your drawing and the question itself. Google processes it to return an answer.
• Supabase: our database, authentication and file storage.
• Vercel: hosting.
• Stripe: payments, if you subscribe.

We do not sell your data, and we do not use your coursework to train our own models. Beyond these providers, we share data only when the law requires it.

How long we keep it

As long as your account exists. Paused-frame images and drawings sent with questions are kept with the conversation they belong to. Delete your account and we remove your profile, sessions, messages, uploads, learning model and stored files. Backups roll off within 30 days. We keep billing records where tax law requires it.

Your choices

• Export: download everything we hold about you as JSON from Settings.
• Delete: delete your account from Settings. It happens immediately and cannot be undone.
• Ask: email tedevh8@gmail.com and we'll answer questions about your data.

If you are in the EU or UK, you have rights to access, correct, export and erase your data; the tools above cover them, and email reaches us for anything they don't.

Students under 18

LumoTutor is for students 13 and older. We don't knowingly collect data from children under 13. If you believe a younger child has an account, email us and we'll delete it.

Security

Data is encrypted in transit and at rest by our providers, uploads live in private storage reachable only through short-lived signed links, and database access is restricted per user at the row level. No system is perfect; if we ever have a breach affecting you, we'll tell you.

Changes

We'll post changes here and update the date above. Material changes come with an email or an in-app notice. Questions: tedevh8@gmail.com.