Privacy policy

Who operates Lumiward

Andrey Kobrin, an individual, operates the Lumiward service and is responsible for this policy. In this policy, “Lumiward,” “we,” and “us” refer to him as the service operator. You can contact him at support@lumiward.com.

Zero-knowledge by design

Lumiward is built so that we cannot read your data. Everything in your vault — passwords, passkeys, notes, documents — is encrypted on your own devices with keys derived from credentials only you hold, before it is ever sent to our servers. What our servers store is ciphertext they cannot decrypt.

What we store

To run the service, Lumiward’s servers keep the minimum they need: your account identity (the email address you signed up with and the cryptographic verifiers used to authenticate you — not your password, which never leaves your devices), your encrypted vault data, household membership and subscription state, and the short-lived operational records needed to sync your devices. When paid subscriptions go on sale, payments will be processed by a payment provider; Lumiward will not store your card details.

No advertising or third-party tracking

The Lumiward applications contain no advertising identifiers or third-party tracking. We do not use vault contents to build advertising or usage profiles. The service may produce content-free security and operational records needed to keep accounts and synchronization working.

This website

The website at lumiward.com serves static pages only. It sets no cookies, uses no analytics or tracking of any kind, loads nothing from third-party servers, and runs no scripts in your browser.

Sharing and disclosure

We do not sell or rent your information to anyone. We use infrastructure and service providers to operate Lumiward and, when paid subscriptions go on sale, a payment provider to process purchases. They receive only the information needed to provide those services. We may also disclose information when the law requires it. For your vault contents, what exists to share or disclose is ciphertext we cannot decrypt.

Your rights and choices

You can export your vault from the apps at any time, and you can download a copy of the account data our servers hold about you (profile, household membership, devices, session metadata, recovery-contact designations and billing status) from Settings › Account › Download my account data in the apps or from Account in the web vault.

Deleting your account

You delete your account yourself, without contacting us, from Settings › Account › Delete account in the apps or from Account › Delete account in the web vault after unlocking. Both paths ask for your master password, show you what the deletion does to your household, offer the account-data download, and take a typed confirmation. Deletion is immediate and irreversible. If you administer a household, or you are its only member, deleting your account closes the household for every member; other adults and teens keep their own accounts and vaults and can start a new household. The account deletion page has the step-by-step instructions.

What is deleted at once

Your account identity (email address and authentication verifiers), the encrypted vault key material our servers hold for you, your household membership, device and session records, recovery-contact designations and sync routing are deleted immediately. Encrypted vault copies in cloud storage you connected yourself stay under your control; the apps can remove reachable copies if you choose that option, and the deletion page tells you how to remove any others.

What is retained, and for how long

• Invoice references and payment records, keyed to your former household and carrying no email address or name, for seven years, for billing disputes and accounting.
• Parental-consent records for child accounts for seven years, as the law on children’s privacy requires.
• A keyed, one-way trace of your email address for seven years, so that a deleted account cannot start a second free trial. It cannot be turned back into your email address.
• Your billing contact at our payment provider until the paid period ends; the provider’s own financial history may survive the deletion of its customer record.
• Opaque serialization anchors that hold only random identifiers and no personal data.
• If you leave a household that continues, the signed history of changes you made in it, including opaque identifiers, keyed email hashes and consent or grant metadata, for as long as that household continues.

If you cannot unlock your account

Deleting from the apps or the web vault requires your master password. If you can no longer unlock, email support@lumiward.com from the address you signed up with; we will verify that the request comes from the account holder and then delete the account with the same retention described above. Use the same address for access, correction or any other privacy question.

Changes to this policy

If we change this policy, we will post the updated version on this page with a new effective date. We will not weaken the zero-knowledge posture described above without asking for your explicit consent first.