Privacy
Luma’s privacy story is short because the list is short. The device talks to exactly two things beyond your own network: a time server, and GitHub — where its firmware releases live.
| Destination | When | Why |
|---|---|---|
pool.ntp.org | Hourly | Setting the clock, so schedules fire on time. |
GitHubraw.githubusercontent.com, api.github.com | Only when you check for updates | Reading the public release feed to see whether newer firmware exists. Nothing automatic, nothing identifying — the request looks the same from every Luma in the world. |
GitHubgithub.com, release-assets.githubusercontent.com | Only during an update you started | Downloading the firmware image, over a pinned connection, verified against its published fingerprint. |
Everything else stays on your network: devices talk to each other over your LAN, discovery is local Bonjour, and Bluetooth is used only during setup. There are no scheduled check-ins of any kind — a Luma that you never update touches nothing but the time server.
What is never sent
No telemetry, no analytics, no crash reports, no heartbeats. Nobody — including the people who made it — can tell from the network that you own a Luma, when it glows, or what your reminders say. There is no account to attach a profile to, because there is no account.
The companion app is held to the same bar: it talks to your Luma and to nothing else. No analytics SDK, no crash reporter, no cloud backend; its App Store privacy label declares zero data collected.
This website
The one place any measurement runs is this website. It uses PostHog, hosted in the EU and keyed to a random ID in your browser’s local storage — no cross-site cookies, no advertising identifiers — to count pageviews and waitlist signups (never the email you enter, only that a signup happened) and to see how the site itself is read, including session replays in which anything you type is masked before it is recorded. It honours Do Not Track: with DNT switched on, nothing is sent at all. None of this runs in the device or the app, which remain exactly as described above.
Diagnostics, done consentfully
Because nothing reports home, debugging is pull-based and in your hands. The device keeps its own local diagnostics — boot history, restart reasons, memory statistics. When something needs investigating, Settings → Report a Problem in the app:
- bundles the app’s last 30 minutes of logs, the device’s diagnostics, and version numbers into a plain-text file,
- shows it to you first— it’s readable JSON, and the app invites you to read it,
- then hands it to the iOS share sheet. You pick where it goes — or nowhere. The app cannot send it by itself.
Reports are built to exclude secrets by construction: the pairing key, PIN, session cookies, and Wi-Fi credentials are not in the report’s vocabulary.