Privacy · Security

Your words stay yours.

Spoken, understood, forgotten — in a fraction of a second, on your own computer. Your script, your voice and your rehearsals never leave it.

Nothing leaves your PC.

Speech recognition and the speech coach run on your computer. There's no cloud for your content; the app's windows can't even reach the internet.

No recordings. Ever.

Your voice becomes words as you speak, and a moment later the sound is wiped from memory. It's not saved and not uploaded, so there is no audio file to leak.

Locked to you.

What's kept (your last script, your notes, the coach's marks) is encrypted with your Windows account. Or keep nothing at all, with one switch.

Invisible in screen shares.

The light, the prompter and your notes don't appear in Teams, Zoom, Meet or recordings.

Shared notes stay in the room. They travel only on your own Wi-Fi, end-to-end encrypted, with the key only in the link.

What happens to…

Thing	Where it lives	How long	Leaves the PC?
Your voice	Memory, 10 ms at a time	Milliseconds, then overwritten	Never
The words you speak	Memory, the last few words	Replaced as you go	Never
Your script	Memory, plus an encrypted copy (or none)	Until you delete it	Never
The coach's analysis	Memory, plus an encrypted copy (or none)	Until you delete it	Never
Your licence	Windows Credential Manager	Until you deactivate	Only the key and an anonymous machine hash, at licence checks

Don't take our word for it. Read the code.

This is the actual code that handles your data — not a summary.

fn wipe(samples: &mut [f32]) {
    for s in samples.iter_mut() {
        unsafe { std::ptr::write_volatile(s, 0.0) };
    }
}
stream.accept_waveform(sr as i32, &chunk);
wipe(&mut chunk); // recognised: these samples are gone now

Your voice, wiped the moment it's understood.

connect-src ipc: http://ipc.localhost

The app's windows can't reach the internet — their security policy only allows talking to the app itself.

pub fn seal(plain: &[u8]) -> Option<Vec<u8>> {
    CryptProtectData(&blob(plain), None, Some(&entropy), None, None,
                     CRYPTPROTECT_UI_FORBIDDEN, &mut out).ok()?;
    …
}

What's kept is sealed with your Windows account (DPAPI). No key on our side, no plaintext fallback.

Everything that goes online

The licence check: your key, an anonymous hash of this PC, its name (your IT can withhold it), and the app version.
The one-time download of the speech models (open-source, verified byte for byte).

That's it. No analytics, no tracking pixels, no crash reports, no update pings, no AI training on your words.

For IT and security teams

One policy file, every user.

{ "keep_nothing": true, "downloads": false, "models_dir": "C:\\ProgramData\\Lumo\\models", "device_name": false }

%ProgramData%\…\policy.json — admin-only, deploy with Intune or Group Policy. Unreadable policy = strictest settings (fail closed).

Firewall allowlist: the licence server, plus Hugging Face only if you don't provide the models.
Offline activation for restricted networks.
No telemetry, no logs of content.
We never receive scripts, transcripts or audio, so we're not a processor of your content.
Request the security brief →

Verify it yourself

01
Block Lumo in Windows Firewall after setup — it keeps working.
02
Watch it with Process Monitor while you speak — no files written.
03
Open the saved script file — it starts with LPV1 and the rest is unreadable.

We publish everything that touches your data. Our prompter engine and the coach's know-how are our craft — they ship encrypted and run only on your machine.