Privacy Policy for Lumi and the Lumi app

Controller

Daniel Alisch, Zum Weizenring 1, 14469 Potsdam, Germany, email: daniel.alisch@me.com

Summary

The Lumi app has no user account, no advertising and no analytics or tracking tools. It talks to your Lumi on your own Wi-Fi, encrypted with TLS, or via Bluetooth. The app only goes online for the place search for the weather (via Apple), for the list and download of public-domain audio stories from our server (only when you open “Stories” in the parents’ area or download a story) and for App Store purchases (only if you take out a subscription or buy extra minutes for Lumi Plus). The app does not use the camera. It only uses the iPhone’s microphone with your consent and permission, and only to record your own stories in the parents’ area. What Lumi stores stays on Lumi, and what the app stores stays on your iPhone, including your own recordings and stories.

Lumi goes online for conversations (only after a button press) via the voice agent of our account with ElevenLabs or, with the Lumi Plus prototype, via our own server, for the weather from Open-Meteo (only if you have set a place) and for the time of day. Lumi Plus is off by default and can only be switched on with parental consent. We process personal data for conversations (via ElevenLabs, or with Lumi Plus via our server and the AI services named there; our server only stores numbers and identifiers about your Lumi, no audio and no words of your child), for subscriptions and purchases, and if you voluntarily sign up for the Lumi waiting list (see below).

Connection between app and Lumi

On Wi-Fi the app looks for Lumi via Bonjour (service “_lumi._tcp”); iOS asks once for the “Local Network” permission. Lumi announces its device ID in your home network so that the app recognises its Lumi. Without Wi-Fi it connects via Bluetooth (see next section). Pairing uses a six-digit code shown on Lumi’s display. It is valid for two minutes and for at most three attempts, then it expires. Every code that does not lead to a pairing increases the waiting time until the next one (10 seconds, 1, 5 and 15 minutes, 1 and 4 hours, then 12 hours). This lock survives deep sleep and updates; it ends with the next successful pairing, an accepted invitation, or when someone switches Lumi off and on again by hand.

After pairing the app receives an access token, which it keeps in the iOS Keychain, only on this iPhone and without iCloud sync. Every request to Lumi carries this token, and Lumi refuses requests without it. The only exception is adding a Wi-Fi network without the app (see next section).

Since firmware 1.29 and app 1.19 the connection on Wi-Fi is encrypted with TLS 1.2. For this, Lumi creates its own key and a self-signed certificate when it first starts. When pairing, the app remembers a fingerprint of its public key (SHA-256, “pin”) in its app data on the iPhone and from then on only accepts exactly this key; a different key does not lead to a connection but to a notice to pair Lumi again. Pairing for the first time via Bluetooth is the safest option; when pairing for the very first time on Wi-Fi, the app trusts the key that Lumi presents in the same encrypted connection. Lumi only answers unencrypted until paired iPhones have switched to TLS after the update, or if parents explicitly allow it for an older app. The connection stays inside your home network.

Updates for Lumi are bundled with the app and transferred in chunks directly over Wi-Fi, without a download server. The firmware is digitally signed: Lumi only accepts firmware with a matching signature and no older version; it verifies its voice pack with a checksum. “Unpair from Lumi” in the settings deletes the token, pin, address and device ID of Lumi from the app.

Bluetooth and setup

If Lumi cannot find a known Wi-Fi network (for example in the car or on holiday) or is being set up for the first time, it switches on Bluetooth; Wi-Fi and Bluetooth never run at the same time on Lumi. It only announces itself with its name “Lumi-XXXX” and a service identifier. The app uses Bluetooth to reach Lumi without Wi-Fi and to give it your Wi-Fi network during setup; iOS asks once for the “Bluetooth” permission.

Bluetooth carries the same requests as Wi-Fi, with the same access token; updates are only available on Wi-Fi, and conversations need an internet connection via Wi-Fi. The Bluetooth connection is encrypted and confirmed (Bluetooth LE Secure Connections with a code): the first time, Lumi shows a six-digit Bluetooth code, which you enter when the iPhone asks for it. Lumi remembers this pairing for up to four iPhones; it does not accept a pairing without the code. Access tokens, Wi-Fi passwords and the ElevenLabs key therefore do not travel through the air in plain text.

Alternating with Bluetooth, Lumi opens its own setup Wi-Fi “Lumi-XXXX” for about 90 seconds at a time during setup and while travelling; its name and password are then shown on its display. Without the access token, only a new Wi-Fi network can be added, via the setup page or via Bluetooth, and only while Lumi is not on any Wi-Fi and either still brand new (within the first 10 minutes after switching on) or someone has held Lumi’s power button for 3 seconds within the last 10 minutes. A known network cannot get a new password this way, and the voice agent ID cannot be changed without the token. Lumi remembers up to three Wi-Fi networks. It keeps Wi-Fi passwords only on the device and never hands them out; the app only sees the network names.

More iPhones and family

A paired iPhone can invite further iPhones in the parents’ area under “Second parent”, up to four in total. The invitation is a one-time random code that is valid for 10 minutes and expires after five wrong attempts. The app shows it as a QR code or you send it as a link; it only contains this code, Lumi’s device ID and its address in the home network or its Bluetooth name, no passwords. If you send the link, it travels through the service you choose for it. To accept a link, the app only reads the clipboard when you tap “Paste”.

Each iPhone gets its own access token and can be removed individually (just not by itself). For this, Lumi stores per iPhone the token, a random number, a name and, except for the first iPhone, the time of pairing. As the name, the app sends the device name iOS provides (usually just “iPhone”), with at most 24 characters; when accepting an invitation you can enter it yourself. All paired iPhones see the same data and can change the same settings.

Under “Greeting for your child” you send Lumi a greeting: who it is from (Mum, Dad, Grandma, Grandpa or Friend) and a preset text such as “Good night” or your own text of at most 40 characters. The greeting goes directly from the app to Lumi, on Wi-Fi or via Bluetooth, not over the internet. Lumi keeps up to three greetings, shows them as a card on its display the next time the child interacts with it (it does not read out your own text) and deletes them afterwards.

“This week” shows a weekly review with conversation starters. For this, Lumi counts per day conversation minutes, routines, completed tasks, school exercises, its own games played to the end and greetings received (for this week; for the previous week the totals remain) and adds tooth-brushing days and the feelings check. The app itself counts which phone games were open and for how long, and which preschool stations were newly completed. Without a valid time Lumi counts nothing. If you wish, the app reminds you on Sundays at 6:30 pm with a notification on the iPhone; for this iOS asks for the “Notifications” permission.

Under “Birthdays” you enter first name, day and month. They are stored on Lumi, together with birthdays that Lumi remembered in conversation (at most eight in total), and can be changed and deleted in the app. Lumi remembers which doors of the Advent calendar are already open.

What is stored on Lumi

Lumi stores in its own memory: the settings (for example volume and volume limit, brightness, quiet time, conversation limit, alarm with weekdays and whether it can be set on the device, routines, learning time, eye colour, costume, weather location, language, whether older apps may connect unencrypted), up to three Wi-Fi credentials, the password of its setup Wi-Fi, the voice agent ID, access tokens, numbers and names of the paired iPhones, the Bluetooth pairings, the counter of the pairing lock, the ElevenLabs key if set, the tooth-brushing week (on which days teeth were brushed, plus the number of brushing days), stickers, game records (including the best time for getting dressed), the conversation minutes of the day, the counters of the weekly review, the learning progress per journey and the exercises of the day, waiting greetings, opened Advent calendar doors, the answers of the feelings check for the last 30 days, the wake-up traffic light (wake-up time and days), whether it greets other Lumis and how sensitively, which tricks it has already learned and the counters for them (brushing teeth together, exercises, games, routines) and, for Lumi Plus, the server address, a device ID, the device token if any, whether Lumi Plus is paused and the parents’ consent (see “Consent for Lumi Plus”).

In addition there are two keys of its own that Lumi creates on first start and never hands out (one for the encrypted connection in the home network, one for signing in to Lumi Plus), for devices from series production a device certificate, and Lumi’s memory: children’s first names, short notes Lumi remembers in conversation, and birthdays (first name, day and month). Also technical data such as Lumi’s own mood (with the day it was first started and the time of the last contact), the progress of its introduction, which scenes have already been shown, a short error report after a crash and, until Lumi is switched off completely, numbers about the last interrupted conversation (see “Diagnostics after interrupted conversations”).

The app displays part of this (for example battery, tooth-brushing week, stickers, conversation minutes, feelings of the week). This data is neither stored with the provider nor in a cloud. The sentences the app sends to Lumi for games and school are pre-recorded sentences from the app bundle, not recordings; Lumi only keeps them in working memory.

If a memory card with music is inserted in Lumi, Lumi reads the MP3 files only itself and plays them; it shows folder and track names on its display and passes them to the paired app so that you can control the music there. The files are neither uploaded nor copied.

What the app stores on your iPhone

The app stores in its own app data on your iPhone: Lumi’s Wi-Fi address, its device ID and its Bluetooth name, the pin of its TLS key, Lumi’s last known quiet time (so the app knows at night that it is asleep), the child’s name for the exercise “My name” (only if you enter it in the parents’ area), the school learning progress per child (stations and stars per journey, what a child already knows, should review and likes to practise) and the results of the latest tutoring lessons in key points, the app’s weekly review for this and last week (which phone games were played how often and for how long, school exercises and new stations), scores of the phone games (records per game and level, catch book, cook and bake book, pantries of kitchen and restaurant, progress of the building site and delivery run), game settings, which game explanations have already been shown, the volume on the iPhone, who your last greeting was from, whether the Sunday reminder is on, which voiced sentences are needed in which game (so the app can send them to Lumi in advance), for “Feelings with Lumi” which unit was tried on which day, the sleep timer for stories, the last loaded list of audio stories and the audio stories themselves (see “Audio stories”).

For consents and subscriptions there is also: the record of your consents (see “Consents in the parents’ area”) with a random ID of this app installation, for Lumi Plus a random subscription ID per Lumi (appAccountToken, see “Subscription and minutes”), which purchases have already been handed over to Lumi and whether a deletion request to the server still has to be repeated.

The child’s name stays in the app and is not sent to Lumi; only if you add it under “Birthdays” and save it does Lumi know it for the birthday. The app reports the completed exercises to Lumi so that it knows the learning time. For Lumi’s learning game the app gives it a small game plan (which stations are next), and Lumi reports back after each round whether the first guess was right, without names, only in working memory, for 24 hours at most. The school learning progress stays on your iPhone, in the child profile, and is never sent. At most a short hint in words without a name (for example “currently practising addition up to 20”) goes to Lumi; Lumi keeps it only in working memory, for 24 hours at most, does not write it to the log and passes it to Lumi Plus at the start of a conversation, and the server does not store it. You can switch the hint off per child. With “Practise with Lumi” the app sends Lumi the lesson plan and collects the results afterwards; the lesson is not recorded. You delete the progress in the child profile. The app keeps the access token for Lumi and the parental lock in the Keychain (see above and below). None of this goes to the provider or into a cloud of the provider; like all app data, this information may be included in your own iPhone backup, but the audio stories and their list explicitly are not. “Reset progress” deletes the preschool progress (also on Lumi), and when you delete the app, iOS removes its app data.

Parents’ area: PIN and Face ID

The app is divided into a children’s area (games, school, feelings, stories, music, stickers) and a parents’ area with all settings. You open the parents’ area with Face ID (or Touch ID) or with a PIN of 4 to 6 digits. Face ID is checked by the iPhone itself; the app only learns whether it succeeded and receives no face data. iOS asks once for the “Face ID” permission.

The PIN itself is never stored. The Keychain only holds a check value derived from it (PBKDF2-SHA256 with a random salt) and a counter of failed attempts, both only on this iPhone, only readable while the iPhone is unlocked and without iCloud sync. After five wrong PINs input is briefly locked (30 seconds, longer after further failed attempts, up to 5 minutes). “Forgot PIN?” only resets the parental lock if the owner of the iPhone authenticates with the device passcode or with the iPhone’s Face ID or Touch ID.

Consents in the parents’ area

For Lumi Plus and for recording your own stories, the app first asks for your consent in the parents’ area before switching the feature on, or before iOS asks for the microphone. The information comes from a fixed text with a version number; nothing is pre-selected, and “Not now” is as easy to reach as “Agree”. Under Help → Consents you can see what you have allowed and withdraw it.

On the iPhone the app records every event (given, paused, withdrawn) as proof in its app data: which consent, version and language of the text, a fingerprint of the wording shown (SHA-256), the confirmations ticked, the time, Lumi’s device ID, a random ID of this app installation and whether the parents’ area was opened with Face ID or PIN. The record stays until you delete the app and, like all app data, may be included in your iPhone backup. If the text changes significantly (a new major version, for example for a new service), the app asks again, and Lumi Plus stays paused until then. For a correction without a new service, new type of data or new purpose (a new minor version, currently 1.1.0), the app only shows a notice and does not ask again.

If you withdraw consent to your own recordings, the app deletes all stories you recorded yourself on this iPhone. You can also revoke the microphone permission in the iPhone settings under “Lumi”.

Consent for Lumi Plus

Lumi Plus is off by default. It can only be switched on in the parents’ area after your consent to the processing of your child’s speech and utterances and of Lumi’s memory by the AI services in the USA named there, with a separate, explicit confirmation for information about health, religion or family that your child mentions of their own accord, and the confirmation that you have parental responsibility or act with the consent of the person who has it. The app sends the consent to Lumi. Lumi stores the version, scope, the fingerprint of the text and the time, and only switches Lumi Plus on with a stored consent; a second parent can switch Lumi Plus back on with the same consent.

Lumi only passes the version and scope of the consent to our server, when signing in or before the next conversation. The server stores the time it was received with the device until you delete the data on the server; after that there is no record left there. The fingerprint of the text and your time stay on Lumi and on the iPhone. The minimum version required is 1.0.0. Currently Lumi itself checks that consent has been given; the additional check on the server, which refuses conversations without matching consent, is not yet switched on. Lumis that were already signed in to Lumi Plus before firmware 1.29 keep talking as before until the first consent from the app; the app then points out that consent is missing on this iPhone.

Switching off in the parents’ area gives you a choice: “Pause only” switches Lumi Plus off, the server then receives nothing more from Lumi, the numbers on the server remain until their deletion periods, and you can switch it back on without new consent. “Withdraw consent and delete data” switches Lumi Plus off, deletes the consent on Lumi and all data about your Lumi on the server (device including consent, conversations, monthly totals); to switch it back on you have to consent again. If Lumi cannot reach the server at that moment, the app repeats the deletion the next time you open “Lumi Plus”. You cancel a subscription separately in your iPhone settings. Processing carried out before the withdrawal remains lawful.

Audio stories

In the parents’ area under “Stories” you can download public-domain audio stories, record stories yourself and import audio files (MP3, M4A or WAV) from the Files app. The app downloads the list and the files of the public-domain stories from our server (lumi.daniel-alisch.site), without an account, without cookies and without a device ID. The server fetches the recordings, currently twelve fairy tales by the Brothers Grimm from LibriVox, itself from archive.org, checks their licence (public domain or a free licence with attribution, which the app then shows) and delivers them with a checksum; the app does not contact archive.org directly. Like every request, our server sees the IP address of your internet connection; it counts requests per IP address only in memory to limit abuse, and its access log contains no IP addresses and is deleted after 7 days.

For recording, the app uses the iPhone’s microphone, only on the “Record a story” page in the parents’ area and only between “Record” and “Stop”; before the first recording the app asks for your consent (see “Consents in the parents’ area”), then iOS asks for the “Microphone” permission. A recording lasts at most 30 minutes. The app copies an imported file; the original stays where it is. Recordings, imported and downloaded stories are stored with title and length only in the app data on this iPhone, not in iCloud and not in backups; if you delete the app, they are gone. Trimming, renaming and deleting are available in the parents’ area.

For playback, the app converts the story on the iPhone and sends the audio piece by piece over your home Wi-Fi to Lumi, encrypted and with the same access token as all requests; this does not work via Bluetooth. Lumi also receives the title and shows it in small print on its display. It only ever keeps the next few seconds in working memory and stores neither audio nor title. In the children’s area your child can only play the stories on the iPhone, not download, record or delete them.

No camera

The Lumi app does not use the iPhone’s camera. It never asks for the “Camera” permission, takes no photos and reads no QR codes. Lumi itself has no camera either.

Conversations via ElevenLabs

You can only talk to Lumi after someone has pressed Lumi’s button or tapped “Talk” in its menu; there is no wake word. Without a conversation the microphone only measures loudness on the device (for example for clapping games); nothing is sent. Without Lumi Plus (see below), during a conversation speech goes directly from Lumi to the voice agent of our account with the voice service ElevenLabs (Eleven Labs Inc., USA) and the answer comes back; ElevenLabs processes it as our service provider. At the start of each conversation the voice agent receives Lumi’s memory (first names, notes, birthdays) as background so that Lumi recognises the children, plus weekday and time, the start of Lumi’s bedtime, the battery level, Lumi’s own mood and, if applicable, whose birthday it is today.

A conversation ends after about 20 to 25 seconds of silence, when the child says goodbye, and after 10 minutes at the latest. Once the daily limit is reached, Lumi does not start a new conversation; a conversation already running ends as described above. Parents set the daily limit in the app: the default is 30 minutes a day, possible values are 0 to 240 minutes, where 0 means “no limit”; without a valid time Lumi cannot count the limit. While a conversation is running, Lumi shows a small “AI” at the edge of its display; this also applies to Lumi Plus.

For conversations via the voice agent, Lumi needs an ElevenLabs key, which parents enter in the app. The app only passes it on to Lumi and does not keep it; Lumi never hands it out again, and the app only sees the last four characters. Before each conversation Lumi uses it to obtain a short-lived authorisation from ElevenLabs; without it the voice agent does not accept a conversation. We set up the voice agent with the settings that no audio recordings of conversations are kept and conversation data (transcript) is deleted after one day. Under its terms ElevenLabs may additionally retain data for a time, for example for abuse checks, and under its terms also uses data from accounts like ours to improve its models unless this is switched off in the account. See also “Service providers and transfers to the USA”.

The app does not display or store recordings or transcripts of conversations; it only shows the conversation minutes. The voice agent is instructed never to ask children for surnames, addresses, schools, phone numbers or passwords and not to store such information. The legal basis is the parents’ consent (Art. 6(1)(a), Art. 8 GDPR), which they give by entering the key; the app has no separate consent dialogue for the voice agent as it does for Lumi Plus.

Lumi Plus (prototype): conversations via our server

Lumi Plus is a prototype in which Lumi holds free conversations via the provider’s own server instead of the ElevenLabs voice agent. Lumi only uses it if parental consent is stored or it is an existing device (see “Consent for Lumi Plus”), Lumi Plus is not paused and Lumi has a device token from this server; otherwise conversations work as described in the previous section, provided an ElevenLabs key has been entered. Lumi gets a device token when you take out a subscription in the app (see “Subscription and minutes”), or, for devices from series production, with a device certificate. The firmware bundled with the app contains no shared sign-up key. Only Lumi stores the token and never hands it out; the app only sees the last four characters. The server is located in Germany (hosted by STRATO), and the connection from Lumi to the server is encrypted with TLS.

When signing in, Lumi provides a device ID: a random number it generated itself or, for devices with a device certificate, a hash derived from the chip’s hardware ID. In that case the server also stores the certificate’s serial number and, so that starter minutes are only granted once per device, the hash of the hardware ID; this entry remains after deletion without any link to your other data.

In a conversation your child’s speech goes from Lumi to our server and is only processed there in working memory: the audio goes to ElevenLabs (Eleven Labs Inc., USA) for speech recognition. The recognised transcript goes as text, together with the same background information as for the voice agent (Lumi’s memory, weekday and time, battery level, mood and, if applicable, a birthday), to a language model from OpenAI (USA), and Lumi’s answer goes to ElevenLabs for speech synthesis. The server sends no device ID and no token to these services. Under its rules OpenAI may retain requests for up to 30 days for abuse detection, ElevenLabs under its own rules. The conversation history is only held in working memory on the server during the conversation and is discarded when the conversation ends. Lumi’s answers are checked against a word list before speech synthesis. When hanging up, Lumi tells the server the reason (silence, time limit or button). If we change the provider of the language model, we will update this policy and ask for your consent again.

About your Lumi the server stores no content, only numbers and identifiers: the device (a label such as “Lumi 1”, not a name; the device ID; the token only as a hash; plan, type of access, since when Lumi has been signed in, when it last connected and until when access is valid; the version of the consent with its time; for a subscription, the identifiers listed under “Subscription and minutes”), per conversation the time, duration, number of turns, seconds of speech recognition, size of the answer, characters of speech synthesis, hits in the answer store, waiting times, costs, reason for ending and the seconds since Lumi’s last audio and since the child’s last utterance at the end, plus monthly totals. For the service’s daily budget and evaluation, the server counts daily totals and waiting times without reference to any device, including how often the word list was triggered. Not stored: your child’s audio, what your child says (transcripts), names, IP addresses and personal answers from Lumi.

The server counts failed sign-up attempts per IP address only in working memory; the web server log contains no IP addresses and is deleted after 7 days. The server’s application log contains no content and no IP addresses, but it does contain the internal number of your device for events such as the start of a conversation or a diagnostic report (see below). No fixed deletion period has been set up for this application log yet; it is discarded when we deploy a new version of the server.

In addition there are two shared stores so that Lumi answers faster: some general answers from Lumi, for example why the sky is blue, are kept by the server with a neutrally worded general question as audio and text (answer store), and short general sentences such as “Great idea!” as audio and text (sentence store). What your child said never goes in there, nor do names, digits, content from Lumi’s memory or personal answers, and the answer store has no link to any Lumi. A new sentence in the sentence store initially only applies to the Lumi where it was created and is linked to that Lumi’s internal number until then; only when a second Lumi produces the same sentence itself does it apply to all and the link is deleted. Sentences that no second Lumi says are deleted by the server after 30 days. If several Lumis are active, new entries in the answer store are only used after we have reviewed them.

Before anything goes into these stores, rules and the OpenAI language model check whether it is general (for this, question and answer go to OpenAI as text); in addition, a small language model on another server of ours assesses whether a sentence reveals something personal in context. For this, Lumi’s sentence, your child’s utterance and Lumi’s memory are sent there as text over an encrypted connection (SSH); the model only processes them in working memory, stores nothing and writes no log. When in doubt, nothing is stored.

The server automatically deletes individual conversations after 90 days and monthly and daily totals after 400 days; the device stays stored until you delete the data, even after a subscription ends (there is currently no automatic deletion after a subscription ends). In the parents’ area under “Lumi Plus” you can see what is stored about your Lumi; the app asks the server via Lumi and does not know the token itself. “Delete all data on the server” (or “Withdraw consent and delete data”) deletes the device, consent, conversations, monthly totals and not-yet-shared sentences of your Lumi; Lumi then forgets the token and device ID, and Lumi Plus stays paused until you switch it on again. The shared entries of the shared stores belong to no Lumi and remain.

The legal basis for processing voice and conversation content is the parents’ consent (Art. 6(1)(a), Art. 8 GDPR), and for special categories of personal data mentioned in passing their explicit consent (Art. 9(2)(a) GDPR). We process device, plan, subscription, quota and billing to perform the contract with the parents (Art. 6(1)(b) GDPR), and the throttling of failed attempts, the daily budget, the shared stores and the diagnostics on the basis of our legitimate interest in a secure, affordable and working service (Art. 6(1)(f) GDPR). Speech recognition, speech synthesis and the language model involve transfers of data to the USA (ElevenLabs, OpenAI), see “Service providers and transfers to the USA”.

Subscription and minutes via the App Store

You take out a Lumi Plus subscription in the parents’ area, never in the children’s area; Lumi itself never offers anything for sale. Purchase, payment and cancellation are handled by Apple’s App Store under its terms and privacy policy; we do not receive payment data, Apple ID, name or email address. When purchasing, the app gives Apple a random subscription ID per Lumi (appAccountToken, a UUID stored only on your iPhone). The app then sends the transaction signed by Apple (including transaction ID, original transaction ID, product, times, expiry and this subscription ID) over the encrypted connection to Lumi, and Lumi registers the subscription with our server together with its device ID and, if you have consented, the version of your consent. The subscription alone does not switch Lumi Plus on; that requires your consent.

The server verifies Apple’s signature and stores with the device the original transaction ID, the subscription ID, the plan and the expiry date. A subscription belongs to one Lumi; it only moves to another Lumi with the same subscription ID. Apple can notify our server directly about renewals, cancellations, refunds and plan changes (App Store Server Notifications); the server only stores each notification’s ID, type and time of receipt without reference to any device, so that it is not counted twice. If a subscription has expired when a connection is made, the server can query its status from Apple using the original transaction ID. The subscription details stay stored with the device until you delete the data on the server.

If the conversation minutes are not enough, you can buy extra minutes in the parents’ area. The app sends the signed receipt to the server via Lumi in the same way; if Lumi was not reachable, the app sends it again the next time you open “Lumi Plus”. The server verifies Apple’s signature and stores the transaction ID, minutes, month, source and time of the credit. If you delete the data on the server, only the transaction ID remains, without any link to your Lumi, so that a receipt cannot be counted twice.

The same applies to an Android app with purchases via Google Play: instead of the Apple transaction, the Google Play purchase token with product, package name and a random account ID goes to the server via Lumi. The server queries the status of the purchase from Google, acknowledges it there and stores the purchase token, account ID, plan and expiry with the device; it stores notifications from Google only with their ID. The legal basis for subscriptions and purchases is performance of the contract (Art. 6(1)(b) GDPR). Apple and Google process purchase and payment as separate controllers.

Diagnostics after interrupted conversations

If a conversation breaks off without a proper ending, Lumi only remembers numbers about it: the time, seconds since the start of the conversation, the type of interruption, error codes of the connection (TLS, network), free internal memory, Wi-Fi signal strength and whether the conversation ran via Lumi Plus. It keeps them in memory that survives restarts but not switching off completely, and reports them to the paired app in its status.

With the next conversation via Lumi Plus, Lumi sends these numbers to our server once (“client_diag”). The server only accepts these fields as numbers and writes them, with the internal number of your device, to its application log, not to the database; for retention see above under Lumi Plus. The diagnostics contain no content, audio or transcripts. We only use them to find and fix interruptions (Art. 6(1)(f) GDPR). Without Lumi Plus, the diagnostics do not leave your home network.

Weather and location

If you choose a place under “Weather” in the settings, Lumi receives the place name and the location rounded to two decimal places (a little over one kilometre). With this, Lumi fetches the forecast for today and tomorrow from Open-Meteo (open-meteo.com) about every three hours. Setting a place is optional; “Remove place” deletes it from Lumi again.

For the place search the app uses Apple’s place search (geocoding); processing is carried out by Apple under its privacy policy (https://www.apple.com/legal/privacy/). The app only uses your location if you tap “My location”, and only with the “While Using the App” permission; it is determined once and roughly (to one kilometre), also passed to Apple’s place search to find the place name, used only for the weather and not stored in the app.

Meeting other Lumis

When two Lumis on the same Wi-Fi are close to each other, they recognise each other and play a short scene together. For this, while awake and not busy, Lumi sends a short 18-byte greeting via ESP-NOW about every 10 to 13 seconds, directly through its Wi-Fi radio, unencrypted to all devices within radio range. The greeting only contains a Lumi identifier, version, type, flags and sequence number of the message, a random number, a random value that changes every day and, during a meeting, the chosen scene, the other Lumi’s daily value and the start time; no names, no device ID and nothing about your child. As with every Wi-Fi frame, the header contains Lumi’s Wi-Fi address (MAC address) as the sender.

Lumi only evaluates greetings from other Lumis. It remembers at most four daily values it has heard with their signal strength (for 35 seconds) and four meetings (daily value and time, until the next day). Meeting is switched on by default; under Set up Lumi → “Greet other Lumis” you can switch it off, and Lumi then sends nothing and evaluates nothing. There is no meeting while travelling via Bluetooth.

Other connections of Lumi

Lumi gets the time from the public time signal pool.ntp.org; without internet it takes it from the app. As with every request on the internet, ElevenLabs, our server (for Lumi Plus and when downloading audio stories), Open-Meteo and the time service see the IP address of your internet connection. The links to the manual and privacy policy in the app open this website in your browser, and the “Terms of Use” link for the subscription opens Apple’s standard terms of use.

Permissions and identifiers

The app asks for “Local Network” (to find Lumi on Wi-Fi), “Bluetooth” (to reach Lumi without Wi-Fi and set up its Wi-Fi), “Face ID” (only if you open the parents’ area with it), “Notifications” (only if you switch on the Sunday reminder), “Microphone” (only when you record a story in the parents’ area) and, only for “My location”, for location while using the app. In the phone game Racing the child can optionally steer by tilting the iPhone; the motion data is only used for the game and is not stored. The app only sees files that you select yourself under “Import file”. The app does not use contacts or photos, no advertising identifier and no tracking within the meaning of Apple’s App Tracking Transparency.

Lumi itself has no camera, and the app does not use the iPhone’s camera either. For manual images and tests, a device with an access token can fetch an image of Lumi’s display (at most every two seconds); Lumi then briefly shows a camera symbol so that child and parents can see it. This is an image of the screen, not a recording of the surroundings; the app does not use this function.

Crash reports via Apple

The app is distributed via TestFlight. If you have allowed sharing analytics with developers in iOS, or send feedback via TestFlight, Apple may pass crash reports and your feedback on to us. These reports come from Apple, not from the app.

Service providers and transfers to the USA

For conversations we use ElevenLabs (Eleven Labs Inc., USA; speech recognition, speech synthesis and voice agent) and OpenAI (USA; language model for Lumi Plus) as processors, and STRATO in Germany for the Lumi Plus server. We are currently concluding the data processing agreements under Art. 28 GDPR with ElevenLabs and OpenAI; with STRATO, data processing terms are part of the contract. We are checking in the register whether ElevenLabs and OpenAI are certified under the EU-US Data Privacy Framework; where this is not the case, we base the transfer to the USA on the EU standard contractual clauses in these agreements. Data protection law in the USA differs from that in the EU, and US authorities may access data under certain conditions.

Zero data retention with the provider has currently not been agreed with OpenAI or ElevenLabs. Our server asks ElevenLabs with every request not to retain anything; speech recognition refuses this for accounts without an enterprise contract, in which case the server continues without this setting. The server makes requests to OpenAI in such a way that OpenAI does not store the answers as retrievable entries. Apple (App Store, TestFlight, place search) and, where applicable, Google (Google Play) act as separate controllers.

Children

The app is meant for parents, Lumi for children. The children’s area of the app contains games, school, feelings, stories (playback only), music and stickers; all settings, consents, recordings, downloads, subscriptions and purchases are in the protected parents’ area. Whether Lumi can hold conversations is decided by the parents through the ElevenLabs key or through their consent and the “Use Lumi Plus” switch, and through the daily limit. Birthdays can be changed and deleted in the app. The rest of Lumi’s memory (first names and notes) can be deleted per child or completely; this is currently only possible via Lumi’s maintenance interface (USB), so please contact us if you need it.

Lumi waiting list / newsletter via Brevo

On the Lumi page you can sign up for the Lumi waiting list with your email address. Purpose: we inform you by email exclusively about news on Lumi, for example the start of a Kickstarter campaign. We process your email address, the language of the page you used (German or English) and the time and IP address of sign-up and confirmation.

The legal basis is your consent under Art. 6(1)(a) GDPR. We use the double opt-in procedure: after signing up you receive an email with a confirmation link. You are only added to the list once you click it. Sign-up and confirmation are logged with time and IP address so that we can prove your consent. Without confirmation the address is not added to the waiting list.

For sign-up and sending we use the service Brevo of Brevo GmbH (formerly Sendinblue GmbH), Köpenicker Straße 126, 10179 Berlin, Germany, as a processor under Art. 28 GDPR. According to Brevo, it stores the data on servers in the European Union. For details see Brevo’s privacy policy: brevo.com/en/legal/privacypolicy. Our website only passes your address on to Brevo and does not store it itself; to prevent abuse, the number of sign-up attempts per IP address is counted in memory for ten minutes and then discarded.

Retention: your data is kept until you unsubscribe or the waiting list ends. Withdrawal: you can withdraw your consent at any time with effect for the future, via the unsubscribe link in every email or by writing to daniel.alisch@me.com. We then delete your address; we keep a blocklist entry only as far as necessary so that you are not contacted again and we can prove the earlier consent.

Data protection officer

A data protection officer has not yet been appointed. We will appoint one before Lumi Plus is offered beyond our own test operation and will then add their contact details here. Until then, please send all data protection questions directly to daniel.alisch@me.com.

Your rights

What the app and Lumi store locally does not reach us. The only data we hold is what you provide for the Lumi waiting list and, for Lumi Plus, what our server stores about your Lumi, including consent, subscription details and diagnostics in the log (see above). You have the rights under the General Data Protection Regulation (access, rectification, erasure, restriction of processing, data portability, objection, withdrawal of consent with effect for the future and complaint to a supervisory authority, for example the Brandenburg State Commissioner for Data Protection and Access to Information). You can view and delete the Lumi Plus data yourself in the app at any time, or write to us; this also applies to conversations via our voice agent at ElevenLabs. For data that Apple or Google process as separate controllers, please contact those providers.

Changes

We update this policy when Lumi or the app change, for example through new features or services. This version applies to firmware 1.29 and app 1.19. The current version is available at this address.

Contact

Email: daniel.alisch@me.com