The paperwork

Privacy, terms and refunds

Last updated 8 September 2026

Privacy policy

Lumie is a period and cycle tracker. What you put into it is about as personal as data gets, so this section is written to be read rather than to be survived.

Who we are

Shiksha Industries (proprietor: Nav Prabhat Sharma), operating from Greater Noida, Uttar Pradesh, India, is the data controller for the information described here. Reach us at hylumie@gmail.com.

How you are identified

We do not file your health data under your name or your email. When you sign in, our database derives a one-way hash from your sign-in identifier and a secret that never leaves the server, and files everything under that. The app on your phone cannot compute this identifier and never sees the secret. We hold no address book, no phone number and no location.

You can use Lumie without signing in, and most people who do never send us anything: tracking, logging, the calendar, predictions, reminders and export all run on the phone. But "guest" is not the same as "offline". The app still creates an anonymous account for you on our server, so that the same pseudonymous identifier exists if you later turn something on, and if you use chat or live voice, what you say goes to a model exactly as described below. Cloud backup stays off until you switch it on.

That anonymous account is deletable like any other. Deleting it is on this website and in the app's privacy centre.

What is stored, and where

• On your phone, always. Your cycle history, symptoms, moods, notes and conversations live in an encrypted store on the device. The encryption key is held by the phone's own secure keystore.
• On our servers, only if you turn on cloud backup. Backup is off until you switch it on. With it on, the same records sync so a new phone can restore them.
• Your first name, if you choose to give one during setup, so Lumie can use it. Optional, and it only leaves the device when backup is on.
• Messages and photos to a linked partner, encrypted end to end and held only until the other phone collects them. We cannot read these. See below.

When your words are sent somewhere

Lumie talks back, and that requires a language model. This is the part people most deserve a straight answer about:

• When you chat with her, or talk to her out loud, the message you send is processed by a language model, along with recent context from your logs, including any free-text notes you wrote about those days, because without them she answers like a spreadsheet.
• The short line on your home screen is generated from structured facts only: phase, day count, streaks. Your written notes are not sent for that.
• She can search the web. When a question needs something she does not know, like a fact, a definition or something current, the model may run a web search to answer it. The search runs at Google, on the same request, and what it looks up can be shaped by the message you sent.
• Model providers process this on our behalf under their API terms, on paid API tiers that are not used to improve or train their models.

Who else touches your data

We do not sell your data, and we do not share it with advertisers. There is no advertising SDK in the app.

When something breaks, and what we count

Two things leave the app that are about the app rather than about you, and both have a switch in the Privacy Center, under Profile, that you can turn off.

• Crash and error reports. When the app crashes or hits an error it cannot recover from, we send a technical report: the type of failure and where in our own code it happened. Anything you wrote or said is removed before the report leaves the phone, and removed again on the way out. The report carries no screenshot, no device identifier and no account of yours. This is how a bug that only some people hit gets found at all.
• A count of what parts of the app get opened. Seven fixed event names, one of seven feature names, which setup screen somebody stopped on, whether a permission was granted, and the app version. There is no free-text field in that table, so a symptom, a note or a date has nowhere to go even by accident. It stays on our own database and goes to no analytics company.

Turning either off stops it for good and costs you nothing else in the app.

Separately, if you switch reminders on, your phone is given a delivery token by Google so notifications can reach it. We store that token against your pseudonymous id and use it for reminders and for the rare announcement about the app itself. It identifies an app installation, not you, and it changes when you reinstall.

Sharing with a partner

If you link a partner, they see a single card built from a fixed, short list of fields, and nothing else. Each field is a switch on your phone. Two of them are on when you start, and they are the two worth naming here: where you are in your cycle, which includes your fertile week, and the range of days your period is expected. Your cycle day, a three-level read on your mood, and one thing that would help are all off until you turn them on.

What the card can never show, at any setting: your symptoms, your day notes, anything you said to Lumie, your name, and any exact date. They see it under the same pseudonymous scheme as everything else, and you can pause or revoke the link at any time. Revoking removes their access immediately, and they are not told.

There is one exception, and it is one you write on purpose. Instead of picking “one thing that would help” from the short list, you can type a single line in your own words, and they can send one back the same way. Those two lines are the only free text that ever crosses between your phones through the card, they clear themselves within a day, and they are encrypted end to end exactly like messages — sealed on the sending phone with a key we do not hold, so what reaches our database is bytes we cannot read. Nothing you typed anywhere else in Lumie is ever included.

Their line is theirs to write and yours to switch off. Under Safety and access you can turn off their free line entirely, leaving them the six fixed things they can send back — and they are not told either way, for the same reason pausing is invisible.

What travels back from their phone

Sharing is not entirely one way. When the person you linked opens their card, Lumie records the time and counts how many times they have opened it in a rolling day, and shows both to you. That is the whole of it. Nothing else about their phone, their location, or their own use of Lumie ever reaches you.

It is there so that someone checking on you far more than feels right is something you can see rather than something you have to sense, and so that pausing or removing the link is one tap from where you see it. The person you linked is told this plainly in their own app, before they ever open the card.

Messages and photos with a partner

A linked partner can also message you, and either of you can send a photo. This is the one part of Lumie where you are talking to another person rather than to us, and it is built so that we are not in the middle of it.

• We cannot read any of it. Messages and photos are encrypted on the sending phone with a key the two devices agree between themselves. What reaches our database is sealed bytes. That is not a promise about our intentions, it is a property of the design: we do not hold the key, so there is nothing for us to decrypt, hand over or scan.
• The server is a letterbox, not an archive. A message is deleted from it the moment the other phone has taken a copy, and a photo the moment it has been downloaded. What is on our side at any given time is only what has not yet been collected.
• Photos are stored in a private bucket with no public or shareable links, and the filename itself is inside the encryption. They are compressed on your phone before sending, which also drops the location and camera data most photos carry.
• A notification never contains the message. It says only that a new message arrived.

You can block the person you are linked to. Blocking removes the card and the whole conversation, and stops them linking to you again even with a future code. They are not told. You can also report them to us, and because we cannot read your conversation, a report contains nothing from it unless you tick the box that attaches the messages you received. That box is off by default, and it can only ever include messages sent to you, never yours.

Deleting the link, or your account, removes the messages and photos held for you on our side along with everything else. The copies already delivered to the other person's phone are theirs, and we cannot reach into their device, exactly as we cannot reach into yours.

How long we keep things

For as long as your account exists. Conversations are kept indefinitely on purpose, since Lumie is meant to remember what you told her, and you can clear them yourself at any time from the app's privacy centre. Delete your account and everything keyed to you is removed, except payment records, which we must retain and which we strip your identifier from first.

Your rights

You can access, export, correct and delete your data. Export and deletion are both buttons in the app, and deletion is also available on this website. If you are in the EU or UK you additionally have the right to object to processing, to restrict it, and to complain to your data protection authority. Our legal basis for processing health data is your explicit consent, which you give during setup and can withdraw by deleting your account.

Children

Lumie is not for anyone under 18. You confirm your age during setup, and the birth year picker does not offer a younger one. If we learn that an account belongs to someone younger, we delete it.

Changes

If this policy changes in a way that affects you, we'll say so in the app rather than quietly editing this page.

Terms of service

What Lumie is

A tracker and a companion. It estimates, it notices patterns, and it talks. That is the whole offer.

What Lumie is not

It is not a medical device, not a diagnosis, and not contraception. Predicted dates and fertile windows are estimates from your own past cycles and are routinely wrong. Do not use them to prevent or to achieve a pregnancy. Nothing Lumie says replaces a doctor. If something worries you, see one.

Your account

You need to be 18 or older. One account is for one person; keep your sign-in to yourself. You own what you put in.

Payment and renewal

Premium is a subscription and renews automatically until you cancel. Prices are shown before you pay and include applicable taxes. If a renewal fails, premium lapses at the end of the period you already paid for and the app keeps working on the free plan. Nothing you logged is deleted or locked away.

Ending it

Cancel whenever you like, from your account page. We may suspend an account that is being used to abuse the service or other people. If we ever shut Lumie down we will give you notice and a way to export everything first.

Liability

The service is provided as-is. To the extent the law allows, our total liability is limited to what you paid us in the twelve months before the claim. Nothing here limits liability that cannot legally be limited.

Governing law

These terms are governed by the laws of Greater Noida, Uttar Pradesh, India.

Refund policy

Every new account gets 30 days of full access before anyone is asked for money, so you can find out whether Lumie suits you without paying. That said:

• Within 7 days of a payment, write to us and we'll refund it in full, no reason needed.
• Charged by mistake, like a renewal you meant to cancel or a duplicate. Tell us and we'll refund it, whenever it happened.
• Cancelling mid-period stops the next renewal. The period you already paid for is not pro-rated, and you keep premium until it ends.

Refunds go back to the original payment method through Razorpay. We process them within 5 working days of agreeing to one; your bank usually takes another 5 to 7 to show it.

Contact

A person reads hylumie@gmail.com. Refunds, privacy requests, bugs and complaints all go to the same place.