Where your data lives
Accounts and brain dumps are stored in Supabase. Row Level Security is enabled, which enforces at the database layer that a row belongs to exactly one account. It is not an application-level check that a bug could bypass.
Data is encrypted in transit and at rest.
How the AI request works
When you submit a dump, the text is sent to the AI provider for ranking through a serverless function. The API key lives on the server and is never present in the frontend, so it cannot be read from your browser.
Your brain dump text does leave our infrastructure to be ranked. That is inherent to how the product works, and you should know it before you write something sensitive into it.
What we do not do
We do not sell your data. We do not run advertising. We do not use your brain dumps to build a profile of you for any purpose other than returning your ranking.
What to keep out of Lumin
Treat a brain dump like a note you're sending to a service, because that is what it is. Keep passwords, full card numbers, government identifiers and clinical details out of it.
You can reference a sensitive task without its contents — "call the bank about the disputed charge" ranks exactly as well as pasting the account number.
Related guides
What is Lumin?
Lumin is an AI task prioritisation app. You type or speak everything on your mind into one box, and Signal AI…
Lumin Pricing
Lumin costs USD9 per month or USD90 per year, which saves 17%. Every account starts with a 7-day unlimited…
How Lumin Works
You write or speak everything on your mind into a single box with no formatting. Signal AI reads the whole…
About Lumin
Lumin is built by Sean Looi and Krystle, a two-person team based in Malaysia. They built it after abandoning…
Frequently asked questions
Can Lumin staff read my brain dumps?
Access is restricted and we do not read user content as a matter of course. Support access may be needed to investigate a specific fault you report to us.
Can I delete my data?
Yes. Contact us through the <a href="/contact">contact page</a> to request account and data deletion.
Is Lumin GDPR compliant?
Data is encrypted in transit and at rest, access is restricted by Row Level Security, and deletion is available on request. For a formal compliance position for your organisation, contact us directly rather than relying on this page.
Where are the servers?
On managed cloud infrastructure through Supabase. There is no Lumin-operated data centre.