- Your photos, videos, RAW files and projects are processed on your machine and are never uploaded. Not once, not partially, not as thumbnails.
- The only data that leaves your device is a license key and an anonymous device ID, at activation and at most every 28 days.
- If you create an account, we store your email. Payment details go to Lemon Squeezy, never to us.
- No third-party analytics, no ad pixels, no tracking cookies. Local storage only, for your preferences and license.
- You can ask for a copy of your data, or its deletion, at lumaowl@pm.me.
01Your images never leave your device
Luma Owl processes everything locally. RAW decoding, grading, film simulation, Scene Match, sharpening and every export run on your own computer, inside the app. There is no upload, no cloud render and no server that ever sees your pixels. Cut the internet and Luma Owl keeps working.
This is true for the web app at lumaowl.app and for the desktop app. The web app loads the software from our servers once, then does all the work in your browser. Files you open stay in your browser's memory and are gone when you close the tab, unless you save them yourself.
We do not collect thumbnails, histograms, metadata, file names, camera models or any statistic derived from your images.
02What we do collect
Di Capitan Ltd, a UK company, is the data controller for the small amount of data described here. We collect only what we need to sell and activate a license.
- License key: the key you received at purchase.
- Device identifier: a random ID generated on your device the first time you activate, plus a short device name so you can recognise it (for example "MacBook Pro"). It is not tied to your hardware serial numbers and is not used for tracking.
- Email address: if you buy a plan, create an account, or start the 5-day free trial of the web app. Used for your receipt, license delivery, sign-in, trial access and important product notices. No marketing without your explicit opt-in.
- Purchase records: plan, date, amount and country, as needed for accounting and tax. These come from our payment provider.
- Support emails: whatever you write to us, kept so we can help you.
Legal basis under UK GDPR and EU GDPR: performance of a contract (delivering and activating your license), legal obligation (tax and accounting records) and legitimate interest (preventing license abuse, answering support requests).
03When data is sent
- At activation. When you enter a license key, the app sends the key and the device identifier to our license server so the server can record the device against your license and return a short-lived token.
- Every 28 days at most. The app renews that token by sending the same key and device ID again. Nothing else is included in the request.
- When you deactivate a device. The app asks the server to remove that device from your license.
- When you sign in. If accounts are enabled, your email and password go to our authentication provider over an encrypted connection. We never see your password in clear text.
The free version, without a license key, sends nothing at all. Loading the web app fetches the software files from our hosting provider, which sees your IP address in its standard server logs like any website you visit.
04Payments
All payments are handled by Lemon Squeezy, our merchant of record. Your card number, billing address and tax details are entered on their checkout, stored by them and governed by their privacy policy. Lemon Squeezy sends us your email, the plan you bought, the amount and your country. We never receive or store card details.
06No analytics, no tracking
We do not use Google Analytics or any other analytics service, advertising pixels, session recording, fingerprinting scripts or social media widgets, on the website or in the app. We do not sell data and we do not share data for advertising. The fonts on the website are loaded from Google Fonts, which receives your IP address to serve the font files; the app itself uses system fonts.
07How long we keep data
- License and device records: for as long as your license is valid, then up to 12 months so we can handle refunds, disputes and reactivations.
- Account data: until you delete your account or ask us to.
- Purchase records: 6 years, as required by UK tax law.
- Support emails: up to 2 years after the last message.
09Your rights
Under UK GDPR and EU GDPR you can ask us to:
- give you a copy of the personal data we hold about you;
- correct it if it is wrong;
- delete it (unless we must keep it for tax or legal reasons);
- restrict or object to how we use it;
- hand it over in a portable format;
- withdraw any consent you gave, at any time.
Email lumaowl@pm.me and we reply within 30 days. You also have the right to complain to the UK Information Commissioner's Office (ico.org.uk) or to your local data protection authority in the EU.
10Security
All connections use HTTPS. Passwords are hashed by our authentication provider and are never stored in clear text. License data is kept in a database with access limited to the license server. Because your images never leave your device, the most valuable thing you work with is not exposed to us or to any breach on our side.
11Children
Luma Owl is not directed at children under 16 and we do not knowingly collect their data. If you believe a child has given us personal data, write to us and we will delete it.
12Changes
If we change this policy we update the date at the top. If a change affects what we collect or why, we tell you in the app or by email before it takes effect.
13Contact
Di Capitan Ltd
Edinburgh, Scotland, United Kingdom
lumaowl@pm.me