Legal
Privacy Policy
Last updated: July 14, 2026
Lumeway is an early-stage product. This policy reflects our current practices and will be updated as the product grows. We are committed to being transparent about how we handle your information.
Who we are
Lumeway ("we," "us," or "our") is a Transition Navigator available at lumeway.co. We help individuals navigate major life changes by providing planning tools, process guidance, and support.
Information we collect
We collect information in the following ways:
- Account information: When you create a Lumeway account, we collect your email address. You may also choose to provide your display name and U.S. state to personalize your experience.
- Chat conversations: When you use the Lumeway chat, your messages are sent to Anthropic's Claude API to generate responses. We store your chat sessions and message history in our database so you can review past conversations from your dashboard. Anthropic retains API inputs and outputs for up to 30 days for abuse monitoring and does not train models on this data — see their API terms.
- Dashboard data: If you use the Lumeway dashboard, we store the checklists, calendar events, goals, and documents you create to provide a persistent planning experience.
- Uploaded files: If you upload files to your dashboard (My Files), we store those files securely on your behalf. See "File storage and security" below for details.
- Usage data: We may collect basic analytics such as page views to understand how people use our site.
How we use your information
- To send you product updates and announcements (if you signed up)
- To provide and improve the Lumeway chat and dashboard experience
- To personalize your dashboard with state-specific guidance (if you provide your state)
- To understand how our product is being used
File storage and security
We take the security of your uploaded files seriously. When you upload a file to Lumeway:
- Encryption at rest: All uploaded files are encrypted before storage using industry-standard AES encryption. Files are encrypted at the application level and again at the storage level.
- Secure cloud storage: Files are stored in Amazon Web Services (AWS) S3 with server-side encryption enabled. Access is restricted to your account only.
- Access controls: Only your account can view, download, or delete your files. Lumeway staff do not view your file contents in the ordinary course of business — we may need technical access to diagnose a specific issue if you ask us to, and we'll say so before we do.
- Secure transmission: All data is transmitted over HTTPS (TLS encryption in transit).
- File validation: Uploaded files are validated to ensure they match their stated file type, helping prevent malicious uploads.
- Deletion: You can delete your uploaded files at any time. Deleted files are permanently removed from our storage.
Lumeway stores files as a convenience to help you keep important documents organized in one place. We do not review, analyze, or share the contents of your uploaded files.
Third-party services
Lumeway uses the following third-party services:
- Anthropic Claude API: Your chat messages are processed by Anthropic. See Anthropic's Privacy Policy.
- Amazon Web Services (AWS): Used for secure file storage. Files are encrypted and stored in AWS S3. See AWS Privacy Policy.
- Stripe: Used to process template purchases and plan payments. We do not store your payment information — it is handled entirely by Stripe. See Stripe's Privacy Policy.
- Resend: Used to send you account emails — login codes, receipts, download links, and account notifications. See Resend's Privacy Policy.
- OnlyOffice: Used to render the in-dashboard Word and Excel editor when you open one of your files. The file content is streamed through our server to the OnlyOffice editor (self-hosted by us on Railway) and back — it is not sent to any third party. See OnlyOffice terms.
- Railway: Used to host our application and Postgres database. Your account data and dashboard content live in a Railway-managed Postgres instance in the US. See Railway's Privacy Policy.
- Google Analytics: Aggregate page-view and referrer analytics. Uses cookies. See Google's Privacy Policy.
Sensitive information
We understand that conversations about life transitions may involve sensitive personal circumstances. We treat all information shared with Lumeway with the utmost discretion. We do not sell, rent, or share your personal information with third parties for marketing purposes.
Data retention
Dashboard data (checklists, goals, calendar events, notes, chat history, uploaded files, and everything else you create in your account) is retained as long as your account is active. You can delete individual items at any time from within your dashboard, or delete your entire account and all associated data at any time from Account Settings → Danger zone.
When you delete your account, purchase and gift-code records are retained (with your name and email scrubbed) so we can accurately report revenue for tax and accounting. All other personal data is permanently removed from our systems.
Subscriber email addresses are retained until you unsubscribe. Server logs may retain IP addresses and request metadata for up to 30 days to help us detect abuse and investigate issues.
Your rights
You have the right to:
- Delete your account and all associated data yourself — Account Settings → Danger zone → Delete my account, or email us if you'd prefer we handle it
- Delete any uploaded files from your dashboard at any time
- Ask what information we hold about you
- Request a copy or export of your data
- Opt out of any communications from us
To ask about any of these, email us at cara@lumeway.co.
Cookies and sessions
We use a session cookie to keep you logged in to your dashboard. It is signed, HTTPS-only, HttpOnly (not readable by JavaScript on the page), and SameSite=Lax (won't be sent on cross-site requests). It expires 30 days after your last visit. Google Analytics sets its own cookies to measure aggregate site usage — no personal information is tied to that data.
Children's privacy
Lumeway is not intended for use by individuals under the age of 18. We do not knowingly collect personal information from children.
Changes to this policy
We may update this Privacy Policy as our product evolves. We will post any changes on this page with an updated date.
Contact us
If you have any questions about this Privacy Policy, please contact us at cara@lumeway.co.