Privacy Policy · allumi

1. Who we are

allumi is made by allumi Inc. (incorporation in progress), developed in Zürich, Switzerland. The registered details will be published here as soon as the registration is complete. We are the controller of the data described on this page. You reach us at fini@allumi.ai.

2. What allumi collects

Each source is something you set up yourself. Nothing is collected from a source you have not connected. Here is what each one sends.

Windows app

Which app is in front: the app name and the window title, with start and end time.
Web addresses: the URL of the page you are on, taken from the browser window.
Media: the title, artist and source of what is playing (a video, a song, a podcast).
Idle time: whether you were active or away, and how long. The app decides this locally from your input and whether media was playing.
Device: a device name you choose, the Windows version and the app version, so we can tell your devices apart and fix problems.

The Windows app does not take screenshots, record your keystrokes or read the contents of your files.

Phone app (Android; iPhone to follow)

Every sensor on the phone is a switch under Connections, off until you turn it on. Pausing the phone stops all of them. Here is what each one reads and why.

Health, through Health Connect on Android (Apple Health on iPhone): heart rate, heart rate variability, resting heart rate, steps, sleep and its stages, workouts, and blood oxygen, as your watch or phone wrote them. Read only; allumi writes nothing back. With your permission it also reads in the background, so new watch data arrives while the app is closed. We use it for one thing: to show you your own sleep, recovery and training next to the rest of your day. Health data is stored for your account only, is never shared with anyone, never sold, never used for ads and never used to train AI models. You can take the permission back in Health Connect at any time, and delete the data under Settings → Data.
Places, through background location: where the phone is, also while the app is closed. The phone turns the raw fixes into stays of five minutes or more and a thinned route between them; only those are sent. If you allow “physical activity”, whether you walked, ran, cycled or rode labels the trips. If you import a Google Maps Timeline export, the file is read on the phone and only the visits go to your account.
Screen time (Android), through usage access: which app was in front and for how long. Not what you did in it: no screenshots, no keystrokes, no titles. Apps you exclude under Settings → Privacy are never recorded, not even their names.
Meals: a photo you take or pick when you log a meal, and nothing else from your library.
Device: a device name, the phone model and the app version, so we can tell your devices apart and fix problems.

Google Calendar

If you connect Google Calendar, allumi reads your events: title, time, location, attendees and description. Access is read-only. allumi does not create, change or delete events in your calendar. You can disconnect the account at any time, which also revokes the access token.

Meals

Photos of food you upload, and what allumi derives from them: the dishes it recognises, portion estimates and about forty nutrients per meal. You can edit every value. The photos are stored so you can look back at a meal; see retention below.

Chat

Your messages to allumi and its replies. From your conversations and your activity, allumi extracts short memories (for example “prefers to work before noon”) so it does not have to ask twice. You can see every memory it has, edit it or delete it.

Voice

“Hey allumi” is recognised on your own device: nothing leaves it until you speak after those words. From then until the conversation ends, the microphone stays open and what it hears goes directly from your device to Gemini Live, a Google service, which answers out loud. That includes anything said nearby during that time, which can also be answered and saved to your chats. Your audio does not pass through allumi’s servers and allumi does not keep it.

To answer you, Google also receives your name, your memories and the part of your day allumi needs, including anything it looks up while answering. On a locked phone what you say still goes to Google, but your name, memories and day do not, unless you allowed personal answers without unlocking in Settings → Voice. You can switch Gemini Live off there too.

A written record of what you said and what allumi answered becomes a normal chat conversation. With Gemini Live switched off, and in the browser, your device or browser turns your speech into text, which can involve its maker’s speech service, and allumi answers from that text.

Messages between friends

What you send a friend in allumi: your words, GIFs, the cards you choose to share, reactions and voice messages. Only the two of you can open them in allumi, and allumi’s AI does not read them. Voice messages are recordings you choose to make and send. We store the sound on our servers for the two of you to play, and it is not sent to any outside service. If either of you asks for a transcript, a speech model running on our own server turns it into text, and that text stays with the message for both of you. Your friend can see while you are typing or recording.

Account

Your email address, name and username. If you sign in with Google, Google tells us your email address and name; we do not see your Google password.

This website

Waitlist: your name and email address, so we can tell you when a place opens.
Contact: what you write to us and the address you write from.
Analytics: none today. If we turn on analytics, it will be a privacy-friendly service without cookies or cross-site tracking, and we will update this page before it goes live.

3. What we use it for

To show you your own day: your timeline, sessions, meals and calendar in one place.
To answer your questions in chat with your real data as context, and to remember what you have told allumi.
To spot patterns and send you a nudge or a daily overview, if you have them switched on.
To run the service: sign you in, pair your devices, send you the emails you asked for (verification, password reset, waitlist and welcome mails).
To fix bugs. When something breaks we look at the technical details around it, not at your data for its own sake.

We do not use your data to train AI models, ours or anyone else’s. We do not build advertising profiles. We do not show ads.

4. Who processes it for us

allumi runs on a small number of services. They process data on our instructions and under their own data-processing terms. We do not give them your data for any purpose of their own.

Supabase: hosts our database in Zürich, Switzerland. What allumi stores about you lives here.
Hetzner Online: runs our API servers in Germany (EU). Everything the apps and this website’s forms send passes through them on its way to the database.
Anthropic: the text of your chat messages, the memories, the food photo and the slice of your activity needed to answer go to a language model. That is Claude, by Anthropic, in the United States. Anthropic’s API terms rule out training on this data.
Google: sign-in with Google, the Calendar API if you connect a calendar, and Gemini Live if you talk to allumi: your voice, and the memories and activity needed to answer.
Resend: sends our emails (verification, reset, waitlist, welcome) and delivers what you write through the contact form.
Vercel: hosts this website and the allumi app.

Some of these providers run servers outside Switzerland and the EU, in particular in the United States. Where that is the case, the transfer rests on their standard contractual clauses.

Beyond these processors, we share data only if you ask us to, or if the law obliges us to.

5. We never sell your data

We do not sell, rent or trade your personal data. Not now, not to fund the alpha, not later. If allumi ever changes hands, this promise goes with the data and you will be told first.

6. How long we keep it

Activity, health, places, media, calendar, meal and chat data stay as long as your account exists, or until you delete them under Settings → Data. They are yours to look back on.
Memories stay until you delete them or delete your account.
Meal photos stay with the meal they belong to. Photos in the upload queue that never became a meal are cleared.
allumi does not store the audio of your voice conversations with allumi. Google handles it under its own terms for Gemini Live. The written record of a voice conversation stays with your chats.
Messages between friends, including the sound of voice messages and any transcript, stay until the sender deletes them or deletes their account. Deleting a message removes it for both of you.
Waitlist entries stay until you have joined, or until you ask us to remove you.
Contact messages stay as long as we need them to answer you.
When you delete your account, your data is deleted from the live database within 30 days. Backups roll over within a further 30 days.

7. Your rights

You can always:

See what we hold about you.
Correct what is wrong.
Export your data in a machine-readable format.
Delete single items, a whole source, or your entire account.
Object to a use you do not agree with, or withdraw a consent you gave.

Today you exercise these rights by writing to fini@allumi.ai. We answer within 30 days, usually much faster. We may ask you to confirm the request from the email address on your account.

Most of this is in the app itself:

Memories: see, edit and delete them in the app.
Devices: see, rename, pause and remove your devices under Settings → Devices.
Google Calendar: disconnect in the app.
Export of all your data, as JSON or CSV: Settings → Data.
Delete a kind of data for a span of time (health, places, activity, meals and so on): Settings → Data.
Delete your account and everything in it: Settings → Danger zone. It is gone within 30 days; you can cancel until then.
A switch per source, to stop collection without removing the device: Settings → Privacy on the web, Connections on the phone.

Anything the app cannot do yet, the email route above does by hand.

8. Security

Data travels between your devices and our servers over TLS. Your data in the database is only readable by your own account; access from our side is limited to the team and used for support and debugging. Device keys and calendar tokens are stored on the server, not in the apps’ plain configuration, and we are tightening how they are stored.

allumi is not end-to-end encrypted, and AI runs on servers, not on your device. No method of transmission or storage is 100% secure. If we learn of a breach that affects you, we will tell you without undue delay.

9. Children

allumi is not for anyone under 16. We do not knowingly collect data from children. If you believe a child has an account, write to us and we will delete it.

10. Changes to this policy

This page will change as the product does. Small corrections are made in place with a new date at the top. For a change that affects what we collect or how we use it, we email account holders before it takes effect.

11. Contact

Questions, requests or complaints about your data go to fini@allumi.ai. If you are in the EU or Switzerland and are not happy with our answer, you can also contact your local data protection authority. The terms of use are at /terms, the imprint at /imprint.

Provider: allumi Inc. (incorporation in progress)The registered details will be published here as soon as the registration is complete.
Contact: fini@allumi.ai
Location: Developed in Zürich, Switzerland

What allumi knows about you, and what happens to it.