Privacy

The controller is Maksim Sabunov, trading as Lumilay, Kaupmehe 6, Tallinn, Estonia. You can reach him at contact@lumilay.com.

Lumilay is a named individual, not a company. The General Data Protection Regulation (GDPR) allows a natural person to be a controller, and this policy is written on that basis. There is no registry code or VAT number to give because no such registration exists.

lumilay.com is a static site. It sets no cookies of its own, runs no analytics, and loads no third-party scripts, fonts or trackers; its typefaces are served from this domain.

The site is delivered by Cloudflare, Inc. from its network. To serve a page Cloudflare processes the technical data every web request carries: IP address, browser identification, the URL requested and the time. Cloudflare keeps these logs under its own retention rules and may set a short-lived security cookie when it challenges a request it considers suspicious. Lumilay sees aggregate request counts and nothing about individual visitors.

Mail to contact@lumilay.com is forwarded through Cloudflare Email Routing to the controller’s mailbox. Your message and address are kept for as long as the correspondence needs and then deleted. The lawful basis is Lumilay’s legitimate interest in answering you (Article 6(1)(f)).

Keepin is an app for the things you want to keep, on the Mac and on the iPhone. It needs an account, and it has a service that signs you in, keeps your devices in step if you turn sync on, and does the parts of reading a page that need a model or a browser in the cloud. The documentation at docs.keepin.app describes all of it; its page What leaves your device is the short version of this section.

Keepin is invite only. An invitation is tied to an email address, only an invited address can sign in, and the invitation carries a plan. Lumilay keeps the invitation: the address, the plan, how long it runs, and a short note.

Signing in

Keepin signs in with a Google account, a GitHub account, or a six-digit code sent to an email address. Google and GitHub sign-in runs through Clerk (Clerk.com, Inc.): the app opens Keepin’s own page at auth.lumilay.com, which hands you to Clerk at clerk.lumilay.com, and Clerk to Google or GitHub. From either provider the service receives only what the openid, email and profile scopes carry: an identifier, the email address, the display name and the profile picture. Nothing else in those accounts is requested or read. Clerk keeps its own record of the sign-in, and may put a Cloudflare Turnstile check in front of a first one, to tell a person from a bot.

The six-digit code is made by Lumilay’s own service, stored only as a hash, and sent from no-reply@lumilay.com through Cloudflare Email Service. It is valid for fifteen minutes and can be used once. An address without an invitation is sent no code.

Your account

For each account Lumilay stores the email address, an internal user ID and, after a Google or GitHub sign-in, Clerk’s identifier for you; the plan and when it ends; one record per signed-in device with its name and when it was last seen; and how many model requests and page renders the account used each month, which is the count and not what was asked.

Sync

Sync is off on a Mac until you turn it on; on the iPhone it is on from the start. With it on, your records (items with their notes and tags, rooms, properties, readings and shared settings) go to the service, and, when your plan includes cloud storage, a copy of each file and picture you saved. Records are stored in Cloudflare D1 and files in Cloudflare R2, both placed in Cloudflare’s Eastern Europe region; see 8.0 for what that does and does not mean.

Everything sync stores is encrypted at rest with a key that belongs to your account, itself sealed with a master key only the service holds, on top of the storage’s own encryption. What stays readable is the framing (a record’s kind, id, versions and timestamps and the device that wrote it; a file’s hash, size and type) and the account details above. This is not end-to-end encryption: the service can unseal your library, because a connected assistant reads it through the service. The rule is that nobody at Lumilay reads it. If support ever needed to look at something, you would be told first and the read would be logged, and every administrative action on the service is logged. If you would rather nothing of your library were readable by anyone but you, keep sync off.

The service keeps thirty days of database history. From time to time the operator also takes an encrypted copy of the whole service by hand, kept in Dropbox, which cannot read it.

Reading what you save

When a link is read, your Mac or iPhone fetches the page itself, so the site sees your device, as it would if you visited it. The sites Keepin knows, such as YouTube or GitHub, are asked through their own public services in the same way. What goes to Lumilay’s service, and only on the subscription:

• When a page’s own data falls short, its text, up to about twelve thousand characters, goes to a model with its address, its title and any note you left telling the reader where to look. To suggest tags, the model also sees the item’s title and summary and your list of tags.
• For a picture, a copy at most 768 pixels across goes to the model, with the words read out of it and any note you left for the reader; for another kind of file, its preview thumbnail. The words, codes and colours of a picture are read on your device.
• A page that will not load in a browser on your device is loaded, for that one address, in a fresh hosted browser that keeps nothing (Cloudflare Browser Rendering), so the site sees Cloudflare rather than you. Before that, the site’s name is looked up with Cloudflare’s public DNS, or Google’s if that one does not answer, to make sure it is a public address; only the name is sent. Asking for alternatives to a product uses the same browser, and the model, to search shops in one country for it.

The model is Google’s Gemini 2.5 Flash, or Gemini 2.5 Flash-Lite when the first will not answer, reached through OpenRouter, which routes to Google with zero data retention and no training on your data. Lumilay’s service passes each request on and keeps nothing of the page, picture or text, only the count. A developer can put their own keys in the Mac app instead; requests then go straight from the Mac under those keys and do not pass through Lumilay.

Text notes and videos are never read. Your passwords, API keys and sessions are never sent.

Reading as you

On a Mac you can let Keepin read pages that need your login, in a browser on that Mac carrying your sessions for those sites. The sessions stay in the app’s own storage on that Mac and are never uploaded or synced, and Keepin never sees a password. A page read this way is then read like any other, so its text can go to the model as above.

Assistants

You can connect Claude, or another assistant that speaks MCP, through mcp.keepin.app. You sign in there with an email code and tick what it may do: read, save and tag, move to trash. It reads the synced copy of your library through the service, so sync has to be on, and it cannot reach files, pictures, settings or your account. Every call is logged against the connection by tool, outcome and time, never what was asked or returned, and the log is kept until the account is deleted, including after you disconnect. What the assistant does with what it reads is between you and its provider.

Payments

There are none. An invitation carries the plan and there is nothing to buy. A payment path through Polar Software Inc. exists in the code and is switched off in every build, so no payment details are collected and nothing is sent to Polar.

On your devices

On a Mac the library is a folder of readable JSON files in ~/Library/Application Support/Keepin/; on the iPhone it is in the app’s own storage. Keepin does not encrypt them; FileVault and the iPhone’s own protection do. The sign-in session is kept in the keychain. The apps have no analytics and no crash reporter. Once a day the Mac app asks downloads.keepin.app, on Cloudflare, whether there is a new version; the request carries the technical data every web request does (see 2.0) and nothing from your library.

The website

keepin.app, and the documentation at docs.keepin.app, are delivered by Cloudflare in the same way as this site (see 2.0). They set no cookies of their own, run no analytics, and load nothing from any other domain; the documentation keeps the state of its sidebar in the browser tab, which never leaves it.

The questions section on keepin.app has a box you can type a question into. What you type is sent from Lumilay’s server to OpenRouter and on to the AI model provider it routes to, with the instruction that the provider keep nothing and train on nothing, and the answer comes back the same way. Lumilay does not store the question, the answer, or who asked. The box is for questions about Keepin; do not type personal details into it. The lawful basis is Lumilay’s legitimate interest in answering the question you asked (Article 6(1)(f)).

Plikka is a personal assistant that is being made ready for other people. Today it runs for its author, connected to his own accounts. What is public is its website, plikka.app, and a waitlist on it. The parts of this section about the box, Google data and the model describe how Plikka works for each person who uses it, and already work that way for him.

The website

plikka.app is delivered by Cloudflare in the same way as this site (see 2.0). It sets no cookies of its own, runs no analytics, and loads nothing from any other domain.

Its questions section has a box you can type a question into. What you type is sent from Lumilay’s server to OpenRouter and on to the AI model provider it routes to, with the instruction that the provider keep nothing and train on nothing, and the answer comes back the same way. Lumilay does not store the question, the answer, or who asked. The box is for questions about Plikka; do not type personal details into it. The lawful basis is Lumilay’s legitimate interest in answering the question you asked (Article 6(1)(f)).

The waitlist

If you join the waitlist, the email address you enter is kept in a list at Resend, the service that will also send the one email it is for. The entry holds that address and nothing else: no name, and nothing about your browser or IP address, because the address reaches Resend from Lumilay’s server rather than from your browser.

It is used for one thing: a single email when it is your turn to use Plikka. It is not used for anything else, shared with anyone else, or added to any other list. The lawful basis is your consent, given by joining (Article 6(1)(a)). You can withdraw it at any time by writing to contact@lumilay.com, and the address is then deleted.

Your box

Each person who uses Plikka gets a box: a small server rented in their name from Contabo GmbH (Munich, Germany) or Hetzner Online GmbH (Gunzenhausen, Germany), both in the European Union, running only their Plikka. Everything Plikka knows about you (its memory of you, the things it is keeping an eye on, your conversations with it, your files and plugins, and the credentials for the accounts you connect) is stored on that box and nowhere else. There is no shared database behind it, and Lumilay keeps no copy.

The box’s storage is encrypted with a key that is generated on the box itself and sealed with a key derived from a passphrase you choose when the box is set up. The passphrase is turned into that key in your browser, and only the key is sent, straight to your box; Lumilay never sees either, and holds neither. Lumilay operates the box as its host, installs software updates on it, and can see that it is running and healthy; it does not read what is inside. If you forget your passphrase, nobody can recover the data.

Your account

Apart from your box, Lumilay keeps a small account record so that you can sign in and your apps can find your box: the identifier Clerk gives your sign-in, the email address you sign in with, your Plikka ID, your invitation, which box is yours, and your plan once there are plans. It holds nothing your box knows about you. You sign in with Google, Apple, GitHub or a code sent to your email, through Clerk at clerk.plikka.app.

When you connect Google or Microsoft to Plikka, your browser passes through auth.plikka.app, which only sends it on to your box. The box itself finishes the connection and keeps what the provider gives it; nothing is stored or logged on the way, beyond a count that it happened. If you delete your account, you are first offered an export of everything on your box; then the box’s key is destroyed, the box is wiped, and the account record is deleted.

Google data

If you connect a Google account, Plikka asks Google for these permissions and no others: to read your Gmail messages (gmail.readonly), to send email as you (gmail.send), to read your calendars (calendar.readonly), and to create and change calendar events (calendar.events). You grant them on Google’s consent screen, and you can withdraw them at any time in your Google account’s third-party access settings, which disconnects Plikka at once.

Plikka reads your mail and calendar on your box to do what you connected it for: to notice what needs your attention (a payment that is due, a question waiting for an answer, a booking, a deadline, two events that clash) and tell you; to answer your questions about them; to draft the replies you ask for; and to create, move and cancel the events you ask for. An email is sent only after you have approved it or given the exact recipient and content yourself. A change Plikka proposes on its own is made only after you agree to it.

Google data stays on your box. It is not sent to Lumilay, not sold, not used for advertising, not used to train or improve any model, and not shared with anyone. The one movement is the same as for anything else you ask Plikka: the parts of a message or event needed to answer you go to the AI model you have chosen, described below. No person at Lumilay reads it. The only exceptions are with your express consent, to investigate abuse or a security incident, or where the law requires it. Plikka’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

The AI model

Plikka thinks with a model you choose. If you connect the ChatGPT plan you already pay for, your box sends what the model needs to OpenAI under your own account and OpenAI’s own terms; the training setting on that account is yours to check, and Lumilay is not party to it. Lumilay’s own AI option, for people who would rather not connect anything, will be described here before it is offered.

Voice

If you send Plikka a voice message, the audio goes from your box to ElevenLabs, Inc. (New York, USA) to be turned into text, and when you ask Plikka to answer aloud, the text of that reply goes there to be turned into speech. Nothing else is sent, Lumilay keeps no copy, and ElevenLabs processes it on Lumilay’s behalf under its data processing terms. Plikka never speaks unless you ask it to.

Messaging

Plikka talks to you through its own apps, which connect directly to your box, and, if you choose, through Telegram, where your messages pass through Telegram under its own policy.

Leaving

You can export everything on the box in one action, in files you can read without Plikka, and you can destroy the box. Destroying it deletes the data and the key with it, and nothing of yours stays with Lumilay.

• Performance of a contract (Article 6(1)(b)) for creating an account from an invitation, signing in, syncing a library, reading what you save, and connecting the assistants you choose; and, for Plikka, for renting a box and running Plikka on it, including reading the accounts you connect to it.
• Consent (Article 6(1)(a)) for the Plikka waitlist, and nowhere else. It can be withdrawn at any time; see 10.0.
• Legitimate interest (Article 6(1)(f)) for keeping the invitations Lumilay has made, security logging, abuse prevention, the record of administrative actions on Keepin’s service, answering correspondence, and answering a question typed into the question boxes on plikka.app and keepin.app.

These organisations process personal data on Lumilay’s behalf:

• Cloudflare, Inc. (San Francisco, USA): hosting of this site, plikka.app, keepin.app and docs.keepin.app, and of Keepin’s service and its downloads; D1, R2, Browser Rendering, Email Routing, Email Service.
• Clerk.com, Inc. (USA): sign-in to Keepin (Google and GitHub) and to Plikka (Google, Apple, GitHub and email codes).
• OpenRouter, Inc. (USA) and the model providers it routes to: reading what is saved in Keepin, which it routes to Google with zero data retention, and answering questions typed into the boxes on plikka.app and keepin.app.
• Polar Software Inc. (USA): payments, which are switched off; nothing is sent to it.
• Dropbox, Inc. (San Francisco, USA): storage for the encrypted backups of Keepin’s service, which it cannot read.
• Plus Five Five, Inc., which operates Resend (San Francisco, USA): the Plikka waitlist and the one email sent from it.
• Contabo GmbH (Munich, Germany) and Hetzner Online GmbH (Gunzenhausen, Germany): hosting of Plikka boxes, in the European Union.
• ElevenLabs, Inc. (New York, USA): turning voice messages sent to Plikka into text and, only when asked, Plikka’s replies into speech.

Google LLC, Apple Inc. and GitHub, Inc. act as independent identity providers when you choose to sign in with them, under their own privacy policies. When you connect a Google or Microsoft account to Plikka, Google or Microsoft acts under its own policy for that account; when you connect your own ChatGPT plan, OpenAI processes what your box sends it under your own agreement with OpenAI, not on Lumilay’s behalf.

Every processor above except Contabo and Hetzner is established in the United States; Plikka boxes are in Contabo’s and Hetzner’s data centres in the European Union. Transfers rely on the processors’ data processing agreements incorporating the EU Standard Contractual Clauses, and where a processor is certified under the EU–US Data Privacy Framework, on that adequacy decision. Keepin’s records and files are placed in Cloudflare’s Eastern Europe region, but neither the database nor the storage carries a jurisdiction restriction, the setting that would bind them to the EU, and the service itself runs on Cloudflare’s network worldwide. So Lumilay does not claim that data is stored or processed only in Europe.

• Keepin accounts, synced libraries and files, usage counts and the log of what connected assistants did: until the account is deleted. A file in the cloud stays until then even if its item is deleted, and the copy on the service is kept if a plan ends.
• Keepin invitations: until the account is deleted, or, for one never used, until it is withdrawn.
• Deleted Keepin data in the database history and in the encrypted backups: gone within thirty days.
• The log of administrative actions on Keepin’s service: kept after an account is deleted, as the record of how the service was run. A line in it names the address an action concerned.
• Plikka waitlist addresses: until the email saying it is your turn has been sent, or until you ask to be taken off, whichever comes first.
• A Plikka box, and everything on it including Google data and the credentials of connected accounts: until you destroy the box or your rental ends, when it is destroyed with its key. Disconnecting an account removes its credentials at once.
• Questions typed into the boxes on plikka.app and keepin.app: not stored.
• Sign-in codes: fifteen minutes.
• Correspondence: for as long as the matter needs.
• Request logs at Cloudflare: under Cloudflare’s own retention rules.

You may ask for access to, correction of, erasure of, or restriction of processing of your personal data; for a copy of it in a portable form; and you may object to processing based on legitimate interest. Write to contact@lumilay.com.

Where processing rests on your consent, as the Plikka waitlist does, you may withdraw it at any time and the data is deleted. Withdrawing does not make unlawful what was done before it.

Deleting a Keepin account is built in: Settings → Account → Leaving → Delete account, on the Mac or the iPhone, confirmed by typing your own email address. The key your data was sealed with is destroyed first, so nothing stored can be read again; then the files, the records, the devices, the sign-in codes, the connected assistants and their log, and the invitation are removed. What was in the database history or a backup is gone within thirty days. The library on your devices is not touched; it is yours, and deleting the app’s folder, or the app on the iPhone, removes it. Clerk’s record of a Google or GitHub sign-in is not removed by this; write, and it will be.

You may complain to a supervisory authority. Lumilay’s is the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon), aki.ee.

This policy changes when the software does. The date at the top is the date of the last change, and the version on this page is the version that applies.