This policy explains how we process personal data on getlumin.dev, on docs.getlumin.dev, and in the Lumin service at app.getlumin.dev. Effective 10 September 2026.
The controller is Frederik Martin, Alfred-Kästner-Str. 59, 04275 Leipzig, Germany. Contact: [email protected].
Lumin runs on servers of Hetzner Online GmbH in Germany. Your data is stored in the European Union. All connections use TLS.
Each page load on this website sends one anonymous request to our own servers so we can count visitors. It carries no cookies, no advertising identifiers, and it stores nothing on your device.
We do not keep your IP address. The server shortens it first, then combines the shortened address with your browser family and operating system, and converts the result to a one-way hash. The secret used for the hash changes every day and the previous secret is destroyed. Only the hash and a timestamp are stored. The record cannot be traced back to you, and two visits on different days cannot be linked.
The legal basis is our legitimate interest in knowing how many people visit the site (Article 6(1)(f) GDPR).
We also offer optional usage measurement, and it stays off until you allow it. A consent bar asks first. If you choose Allow, we store a random id in your browser (lumin.anonymous_id in local storage and lumin.session_id in session storage) and record which pages you view and which links and buttons you use. This data goes only to our own servers and we do not share it.
Your choice is stored in your browser under lumin.consent, so the bar does not return on every visit. You can change your choice at any time with the "Cookie settings" link in the footer. Choosing Decline removes the stored ids from your browser and stops the measurement. The anonymous visitor count in section 3 continues either way, because it stores nothing on your device.
The legal basis is your consent (Article 6(1)(a) GDPR). You can withdraw it at any time with effect for the future.
We advertise Lumin on Google Search. If you arrive from one of our ads, the advertising network adds parameters to the address of the page you open. These parameters name the campaign, the ad group, and the keyword that matched, and they include a click identifier.
The parameters travel in the address only. We place no advertising script on this website, we set no advertising cookie, and we store nothing on your device for this purpose. If you do not create an account, we keep nothing.
If you do create an account, we store these parameters with your account, together with the address of the page you opened and the website you came from. We use them only to learn which campaign brought you. We build no profile from them, and we send them to no third party. The legal basis is our legitimate interest in measuring our own advertising (Article 6(1)(f) GDPR). We delete this record when you delete your account.
When you create an account, we store your email address, a one-way hash of your password, your workspace membership, your role, and timestamps. We never store the password itself. We use this data to operate your account. The legal basis is the contract with you (Article 6(1)(b) GDPR). We keep this data while your account exists.
If you sign in with GitHub or Google, we receive your verified email address and your account id from the provider. We store no provider password. The provider's own privacy policy governs its side of the sign-in.
We send account email, such as the verification link, through Resend Inc. Resend processes the recipient address and the message on our behalf. Resend is a US company; the transfer is protected by the EU standard contractual clauses.
Paid subscriptions run through Stripe. When you subscribe, Stripe receives your email address and your billing details. Your card number goes directly to Stripe and never reaches our servers. The legal bases are the contract with you and our legal duty to keep tax records. Invoices are kept for the retention periods of German tax law.
The logs, metrics, checks, and session events that your systems send to Lumin are your content. It can contain personal data of your own users. For that data you are the controller, and we process it only on your behalf to provide the service, under Article 28 GDPR. It expires after the retention window of your tier, and it is deleted when you delete the project or your account.
Inside the app, we record which screens you open and which product actions you take, tied to your account. We use this only to improve Lumin, and we do not share it. It uses the same browser storage keys as section 4. The legal basis is our legitimate interest in improving the product (Article 6(1)(f) GDPR).
The app sets two cookies: lumin_session keeps you signed in, and lumin_csrf protects forms against cross-site requests. Both are necessary for the service and are removed when you sign out. If you sign in with GitHub or Google, the app also sets lumin_oauth_state for the duration of that sign-in. It protects the sign-in against cross-site requests, it expires after ten minutes, and the app removes it as soon as the sign-in completes. The app also stores functional settings in local storage, such as the theme and per-project view settings. There are no third-party cookies and no advertising trackers.
If you connect a Slack workspace for alerts, the alert content goes to that workspace. Your agreement with Slack governs the data there.
Our servers keep technical logs about requests, errors, and abuse signals. We use them to operate and to secure the service (Article 6(1)(f) GDPR), and we delete them on a short schedule.
We use these processors: Hetzner Online GmbH (hosting, Germany), Stripe (payments), and Resend Inc. (email). GitHub or Google are involved only when you use their sign-in. We do not sell personal data. We advertise Lumin on Google Search, and section 5 explains what we store when you arrive from an ad.
You have the right to access, to rectification, to erasure, to restriction of processing, to data portability, and to object to processing based on legitimate interest. You can withdraw a consent at any time. You can complain to a data protection supervisory authority. Write to [email protected] to use these rights.
We update this policy when the service changes. This page always shows the current version and its effective date.