Privacy

Last updated: 13 November 2026

Short version

No trackers, no ad pixels, no fingerprinting. The website counts page views only if you allow analytics in the cookie banner. We never log your prompts and we never train models on your data. How much stays on your device depends on which way you run LU:

• On your device (the LU desktop app on your own hardware, or the LU app on Android and iPhone with a model on the phone): your prompts, generations, chats and files never leave your device. The desktop app talks straight to whichever AI backend you have installed (Ollama, LM Studio, ComfyUI). Nothing in that path touches our cloud.
• LU Cloud (the hosted service, from the website, the desktop app or the phone app): generation runs on our managed GPUs, so your prompts and inputs are processed off-device. What that means, and how briefly we keep anything, is spelled out below.
• The LU app on Android and iPhone works without an account. Using LU Cloud, signing in, syncing your memories, reporting content and the Cloud switch counter send data to us, each as described below.

How LU Cloud processes your requests

Chat, image and video run on managed NVIDIA H100, A100 and B200 class GPUs operated by our infrastructure partners, not on your device. Your prompts and any inputs are sent to those partners solely to produce your result and are returned to you. We do not sell them, and we do not train models on them. We do not claim confidential-compute / TEE guarantees on this path.

What we store, in the cloud

• Your email address (for account login).
• If you sign in with Apple, Google or GitHub: what that service hands us for the sign in, at least your email address (with Apple, possibly a relay address Apple made for you) and your account id at that service.
• If you sign in with Apple: possibly a token from Apple that lets us end the link between your Apple ID and LU when you delete your account. It is stored encrypted, used for nothing else, and deleted with the account.
• A Stripe customer and subscription reference. Stripe processes the payment; we never see your full card details.
• The desktop app’s public key (used to verify it’s really your app when you connect it to the cloud).
• The media you generate, in a private, per-account library only you can read (auto-deleted, see Retention).
• Trained character models you create, on your private shelf, until you delete them or your account. The same goes for the base image of a character in the Character Room, a copy of one of your results that every look of that character starts from.
• Your chat history only if you turn on cross-device sync (off by default). Then it is stored in a private, per-account row only you can read. With sync off, your conversations never leave your browser.
• Memories you choose to sync (see Memories below).

Memories

LU can remember things you want it to keep, for example your name or a project. They live on your device. If you are signed in, agree to syncing and start a sync, each memory (its title, text, kind, tags, times and where it came from) is stored in a private row of your account that only you can read, so your other devices see it. When you delete a memory and sync, its content is removed from the account too. Deleting the account deletes every synced memory.

Dictation, audio files and read aloud

Dictation and read aloud through LU Cloud need an account with a plan that includes LU Cloud. For dictation, your recording (up to about two minutes) is sent to a speech recognition partner, and the text comes back to you. An audio file you attach to a chat message is cut into parts of up to 30 seconds in your browser, each part goes the same way, and the text is added to your message. Documents you attach (PDF, Word, plain text) are read in your browser; only their text travels with your message. For read aloud, the text (up to 1,500 characters) and the voice you picked are sent to a speech synthesis partner, and the audio comes back to you. We do not store the recording, the text or the audio. What we keep is the credits the request used.

Reporting content

In the LU app on Android and iPhone you can report an answer, image, video or audio clip. A report sends: a random report id, when you reported, what kind of content it is, the app’s id for it, the model name, whether it was made on your device or on LU Cloud, the reason you picked, your note (optional, up to 500 characters), the reported text (up to 500 characters; you can leave it out, and media are never sent), the edition of the app and the platform. A report carries no account and no device id, and we do not store your IP address with it. We review reports and use them only to deal with the content, improve our safeguards and meet our duties to the app stores and the law. A report is deleted 12 months after we receive it.

Cancelling without signing in

You can cancel a plan on the cancel page without signing in. The form sends us your name and the email address of your account, and, if you give them, the plan, a reason, a note and whether you ask to end it right away for an important reason. We store these with the time we received them. We mail a receipt to that address at once. If the address belongs to an account with a running plan, we also mail a one-time link and store a hash of it, never the link itself; after your click we store when you confirmed, the subscription and the date your plan ends. Requests that match no plan, or are not confirmed, go to a person on our team who answers them. We use this data only to carry out and prove your cancellation and to keep the form from being misused. Each request is deleted 400 days after we receive it.

Using your computer from your phone

If you let the LU desktop app be reached from anywhere, it tells us where your computer can be reached right now, so your paired phone can find it away from home. We store your computer’s random id, its public key, its current tunnel address and when it last told us. There is no account, no name and nothing you do over the connection in it: phone and computer encrypt what they send each other end to end, and we never see it. Only a phone that knows the id gets the address back. An address that is not renewed for 7 days is deleted.

“Sign in with my computer” signs your phone in to the account your computer uses. Your computer asks us for a one-time code that only your phone can use and passes it on; the phone exchanges it for a sign-in of its own. We store a hash of the code, the account and your phone’s public key, and delete them once the code has expired, after 2 minutes. Your computer’s own sign-in never leaves it.

What we explicitly do not do

• No product analytics, telemetry, session replay, or ad pixels. The website page count described under Cookies runs only with your consent. The one counter in the apps is the Cloud switch in the LU apps. Each press adds one to a daily count: which way it was pressed, the platform and the app version, with no identifier attached. In the desktop app the window that opens without a plan counts three more presses the same way: picking a model from a list, choosing a plan and choosing credits, never which model was picked. From version 3.1.0 a click on any other way into LU Cloud counts the same way: a plan, a credit pack, signing in, the Cloud offer on a model or in the setup, or hiding the Cloud features, never which model. In the desktop app, when you are signed in, these presses are also counted for your account, together with whether the account pays. The LU app on Android and iPhone only sends the anonymous count, never your account. It is on by default, and you can turn it off under Settings, Privacy.
• Campaign tags: a link to lu-labs.ai can carry a short tag that says where it was posted (src, or the utm_fields many sites and our desktop app add). We count a visit, a download and a checkout start per tag and day, with no identifier. If you create an account, the tag you arrived with is kept with your account, so we can see which links bring people who stay. The tag lives in the page address only, nothing is stored in your browser for it.
• No device fingerprinting.
• No logging of prompt or reply content. Our server logs are operational metadata only (event, model, status code, token counts, never message content). For each request our web server records the time, IP address, method, path without its query, status, browser name and how long it took, never cookies or sign-in tokens.
• No IP address kept for longer than 7 days. Server logs including IP addresses are kept for 7 days for security and abuse prevention, then deleted.
• No training on your data. No selling of your data.

Retention

• Prompts & uploaded inputs: discarded as soon as the generation finishes. (Our inference partner may hold the opening of a prompt in a short-lived cache so a follow-up answers faster. It is a speed-up, not a record: neither they nor we keep it.)
• Generated media: automatically deleted after 7 days. (Media that briefly transits a GPU partner’s own store is likewise dropped by them within 7 days.) You can delete any result yourself at any time, one by one or several at once in the gallery: it is removed from our storage right away and cannot be restored. Signing out removes the gallery and prompts this browser kept.
• Trained character models, their base images & synced chat history: kept until you delete them, or your account. A base image goes when you delete its character.
• Account data: as long as your account exists. Stripe billing records: 7 years (German tax law). Consent records: 1 year after the last update.
• Synced memories: until you delete them, or your account.
• Content reports: 12 months after we receive them.
• Cancellations sent without signing in: 400 days after we receive them.
• Server logs: 7 days, then deleted.
• Computer addresses for the phone: 7 days after your computer last renewed it. Sign-in codes: once they expire, after 2 minutes.

Delete your account any time: in the LU app on Android or iPhone under Settings, your account, Delete account; on the website under Account, Danger zone; or by emailing us. The steps, and what is kept, are on Delete your LU account. Deleting cancels a running subscription, ends the Sign in with Apple link where we hold a token for it, and removes the account with its database rows and stored media. Invoices and payment records stay with our payment processor for as long as tax law requires. We keep a record of each credit pack bought (amount, credits, date, the payment reference), no longer linked to the account.

Sub-processors

• DigitalOcean: website + API hosting.
• Supabase: auth + database (EU region).
• Managed GPU inference & render partners: cloud LLM inference and image/video rendering; they process your chat and Create prompts and inputs when you use LU Cloud.
• Speech recognition and speech synthesis partners: they process your recording or the text to read when you use dictation, attach an audio file to a chat message or use read aloud through LU Cloud.
• Stripe: payment processor (Stripe Payments Europe, Ireland).
• Zoho / Resend: transactional and auth email.
• Cloudflare: DNS (global).
• GoatCounter: the website page count, only if you allow analytics in the cookie banner.

Cookies

We split cookies into three categories. You can change your choice any time from the banner that appears at the bottom of the page on your first visit.

• Essential: Supabase auth session, CSRF protection, and the consent record itself. Cannot be switched off; without them you can’t log in.
• Analytics: off until you switch it on. With it on, lu-labs.ai counts page views with GoatCounter: the page address without its query, the site you came from without its query, the page title, your screen size and the campaign tag of the link, plus presses of a few buttons such as Sign in and View plans. No cookie is set and nothing is stored in your browser for it. GoatCounter does not keep your IP address and builds no profile of you. The desktop and phone apps send nothing of this kind.
• Marketing: LU does not currently load any marketing pixels; the toggle exists so this notice stays honest if that changes.

Your rights (GDPR)

Email hello@lu-labs.ai to get a data export, correct, or delete your account. We’ll act within 30 days. You also have the right to lodge a complaint with your data-protection authority (Art. 77 GDPR).

Lawful basis

Account + license data and serving the cloud requests you make: Art. 6 (1) (b) GDPR, performance of a contract. A cancellation sent without signing in: Art. 6 (1) (c) GDPR, because the law requires us to take it and confirm it (section 312k of the German Civil Code), and Art. 6 (1) (f) GDPR, our legitimate interest in proving the cancellation and protecting the form from misuse. The page count of the website runs only on Art. 6 (1) (a) GDPR, your consent, revocable at any time via the banner.

Data-processing agreements

Where required, we have signed data-processing agreements (AVV) with the sub-processors listed above per Art. 28 GDPR.

Plain-language summary. The legally binding text is in the Terms.