Effective July 31, 2026

Privacy, without vague promises.

Lunem is a Windows learning companion built around local storage. This policy explains what stays on your computer, what leaves it when you enable an external service, and what your Google account is used for.

Google and Supabase authentication

All Lunem features are gated by Google sign-in through Supabase Auth. A new installation cannot be activated offline. Supabase may process your Google account identifier, email address, display name, profile image, session timestamps, IP address, and authentication security data. Lunem requests only OpenID, email, and profile scopes. Lunem does not request access to Gmail, Drive, Calendar, contacts, or your Google password.

The desktop app stores the Supabase session, email, display name, profile image URL, last verification time, and device binding encrypted with Windows DPAPI. A previously verified encrypted session may unlock local features while offline. The first Google account used is permanently bound to that Windows profile in v0.9.1 to prevent another account from seeing existing local data. Signing out does not remove that binding.

Data stored on your device

Lunem stores memories, lessons, learning progress, focus threads, reminders, preferences, model-transmission metadata, screen-access metadata, saved animation files, whiteboard content, and configuration under your local Windows user profile, browser local storage, or Documents folder. A raw provider or AssemblyAI key exists in the trusted renderer form while you type it and is sent over Electron IPC to the main process. Saved keys are encrypted using Windows secure storage and are excluded from memories, prompts, and application logs.

Automatic memory is on by default. It locally examines text you submit to recognize user-stated preferences, goals, decisions, routines, personal facts, and repeated learning or work patterns. It excludes recognized secrets and fleeting commands. You can disable automatic memory and inspect or delete stored memories in the app.

Local data is not synchronized to a Lunem-operated cloud database in v0.9.1. Advanced managed or developer installations can explicitly configure a Mem0 endpoint; when configured, memory content, searches, user ID, and memory metadata are sent to that endpoint. Standard public builds do not configure Mem0.

AI model providers

You choose either local Ollama or a supported external provider such as Anthropic, OpenAI, Google Gemini, or Azure-hosted Anthropic models. When you use an external provider, Lunem sends the text and context needed to answer your request. Depending on your privacy settings and request, that context may include selected memories, focus context, application context, or a screenshot. Those providers process data under their own privacy terms.

Screen context and sensitive screens

Screen access has three modes: Never, Ask every time, and Allow visual requests. New installations default to Ask every time. Ask mode shows a native confirmation before pixels are read and states whether the image will remain local or may be sent to the active cloud provider. Choosing “always allow” changes the mode to Allow. Never mode blocks both agent-driven and manual screen-capture paths before sensitivity probing or pixels.

Allow mode does not create continuous monitoring: capture remains routed only for requests that need visual context or an explicit screen tool. Before pixels are read, Lunem checks for focused password fields and known password-manager, sign-in, verification, banking, wallet, and email-inbox windows. Matching screens are blocked. After a capture, a green full-screen border states that Lunem looked; while screen access is active, the tray reports it. The tray and Privacy view both provide an immediate “Disable all screen access” control.

Lunem keeps a local screen-access history of at most 500 metadata events. Each event contains a timestamp, agent-versus-manual source, reason category, local-versus-cloud-eligible destination, provider name, outcome, and an optional predefined failure or block reason. It does not contain screenshot pixels, base64 image data, prompts, window titles, or visible screen text. You can clear this history in Privacy. A successfully captured image is held in memory only long enough to process the request; a recent frame may be reused for up to 2.5 seconds and is not written to this history file.

The sensitive-screen safeguard is heuristic and cannot identify every confidential document. You should use Never or Ask mode and close or hide private material before asking Lunem to inspect your screen.

Foreground application context

Lunem can read the active process name and window title locally to tailor an answer, detect supported learning tools, offer context-aware help, or detect a coding-break interval. It does not read file contents through this mechanism. Context-aware offers and coding-break behavior can be disabled in Privacy settings. When a cloud model is active, the app name and title are sent only when screen-context sharing is enabled.

Web search and browser actions

Browser actions and learning searches are on by default and can be disabled in Privacy settings. For current factual or market questions, Lunem may send up to 300 characters of your query to DuckDuckGo and use returned titles, URLs, and snippets as model context. Explicit browser and YouTube actions open external websites, which receive normal browser request information and operate under their own privacy policies.

Voice transcription

If you configure voice, short microphone recordings are sent to AssemblyAI for transcription using your API key. Audio and transcription are subject to AssemblyAI's terms and retention controls. You may use Lunem in text-only mode and add or remove the AssemblyAI key later.

Diagnostics and telemetry

Lunem does not include product analytics in v0.9.1. Local diagnostic logs, the model transmission log, and the screen-access history may record the metadata described in this policy. They are intended for transparency and troubleshooting and do not contain raw prompts, API keys, memory text, screenshot pixels, or model responses.

Website and waitlist

The Lunem website is hosted by Vercel. Like other web hosts, Vercel receives request metadata such as IP address, user agent, requested URL, and timestamps for delivery, security, and operational logs. The website loads font files from Google Fonts, so Google receives normal web request information such as your IP address and user agent. The desktop also contacts the Lunem website at startup to retrieve the public Supabase project URL and publishable client key; this request contains no Lunem memory or Google session token.

If you join the waitlist, Lunem stores your email address, signup source, and signup time in Supabase. New signups do not store a precise IP address or inferred location. Some waitlist records created before July 31, 2026 may include coarse city, region, and country inferred from Vercel request headers.

Retention, deletion, and sign-out

Local data remains until you delete it in Lunem, reset the application data, or remove the corresponding files. Signing out removes the active authentication session but does not delete local memories or remove the device-to-account binding. Provider keys can be cleared from their settings. A complete local reset is required before a different Google account can safely use the same Windows profile.

Security and limitations

Lunem uses process isolation, a restricted preload bridge, encrypted credential storage, and explicit privacy controls. No system is perfectly secure. Protect your Windows account, keep the application updated, and never paste secrets into prompts or issue reports.

Children and regional rights

Lunem is not directed to children under 13. Depending on where you live, you may have rights to access, correct, export, object to, or delete personal information held by Supabase or another provider. Most Lunem application data is local and can be inspected or removed directly on your computer.

Contact and changes

For a private privacy or security request, use GitHub private vulnerability reporting. General support requests can use the public issue tracker; never include credentials or private personal data in a public issue. Material policy changes will update the effective date on this page.