Your recordings never leave your Mac.

Anonymous usage statistics in the app

Lumae reports anonymous usage, performance and stability data to PostHog so that I can see which features people actually use and where the app breaks. You can turn this off at any time in Settings › Privacy › Share anonymous usage statistics. Turning it off stops collection and discards anything that has been queued but not yet sent.

There is no identity attached. On first launch the app generates a random UUID and stores it in its own preferences. That ID is how repeat launches from the same Mac are counted as one installation. It is not linked to your name, your email, your Apple Account or anything you have ever sent me.

What is sent with each event:

• About your Mac: the Lumae version and build, macOS version, Mac model and chip, core count, memory, number of displays, main display size, your system locale and time zone.
• About your session: launch counts and timings, how long the app ran, how many edits, undos and playbacks happened.
• About feature use, as numbers and choices: how many clips, zooms and captions a project has, which annotation tools a screenshot uses, which background kind, which export codec and size, how long an export took, whether a recording captured audio.
• About failures: error domains, codes and categories, crash and hang reports from Apple's MetricKit including the call stacks, and which stage a recording or export failed at.

What is never sent:

• Captured pixels, video, audio or screenshots, in any form.
• Project, clip or file names, or any file path.
• Caption text, transcribed speech, or text you type into a screenshot annotation.
• Error messages, which can name your files. Only the type and code of an error travel.
• Keystrokes, or which keys you assign to a shortcut.
• Your name, email address or IP-derived location. PostHog receives the connection's IP address as any web server would, and no location profile is built from it.

Events are queued in the app's sandbox container and sent in batches to PostHog's ingestion endpoint. If the app is offline they wait; if a batch is rejected it is dropped.

When an AI agent drives Lumae

Lumae can act as an MCP server, so a tool such as Claude Code can list your projects and edit them. If you have left usage statistics on, agent activity is reported the same way everything else is: which tool was called, how long it took, whether it failed, and the shape of the arguments. Times, counts, scales and identifiers are kept; project names, clip names, caption text and file paths are replaced with a placeholder before anything is sent.

One exception is worth stating plainly. Every MCP tool asks the agent for a one sentence reason for the call, and that sentence is sent as written. It is the agent's prose rather than yours, but it can paraphrase what you asked for and it can name your project. It is the only free text the app ever transmits. Switching off usage statistics in Settings › Privacy switches this off too.

Updates and downloads

Lumae checks for updates about once a day, and immediately when you choose Lumae › Check for Updates. The check reads a small feed file published on GitHub. Downloading the app from this website also fetches from GitHub.

Lumae attaches no identifier to those requests, but GitHub is a web host: it sees the IP address and user agent of the request, and its own privacy statement governs what it does with them. Updates are cryptographically signed and verified before they install.

This website

lumae.app is hosted on Vercel, which keeps ordinary server logs of requests, including IP addresses and user agents, for operations and abuse prevention.

The site uses PostHog to count visits and to see which parts of the page people use: page views, clicks on the download button and which FAQ questions get opened, plus JavaScript errors so I can fix broken pages. Requests are proxied through lumae.app/ingest so that they are first-party rather than blocked as third-party, but the data still goes to PostHog. PostHog may also record a replay of your visit, meaning the pages, clicks and scrolling in your browser window, which I use to understand where the site confuses people.

Visitors stay anonymous. The site never calls PostHog's identify function, so no person profile is created and there is nothing to tie a visit to a real name. PostHog stores an anonymous device identifier in a first-party cookie and in your browser's local storage so that two page views in one visit are not counted as two people.

If your browser sends Do Not Track or Global Privacy Control, nothing is sent at all. That includes Brave and Firefox private windows by default. A content blocker also works. There are no advertising trackers, no ad networks, no cross-site tracking and no third party buying any of this.

The feedback form

The feedback form turns what you write into an email to me, sent through Resend. There is no database. The message exists in my mailbox and nowhere else.

• The email contains your address, your message, the Lumae and macOS versions you filled in, the time you sent it, and your browser's user agent string.
• Your email address is used to reply to you. It never goes on a mailing list, and I do not send anything you did not ask for.
• Your IP address is held in memory for a few minutes to stop a script from flooding the form. It is not written to a database and not included in the email.

Please do not paste anything confidential into the form. If a bug needs a file to reproduce, say so and I will tell you what would help.

Who else handles any of this

These are the only services involved. Each one processes data on my behalf under its own terms and privacy policy, and none of them receives your recordings.

Nothing is sold, rented or shared for advertising. The only circumstance in which I would hand any of it over is a valid legal order, and there is very little to hand over.

Your choices and your rights

• Stop app analytics: Settings › Privacy in Lumae. It takes effect immediately and drops anything still queued.
• Stop website analytics: turn on Global Privacy Control or Do Not Track in your browser, or use any content blocker.
• Stop everything else: quit the app. With statistics off, Lumae's only remaining network request is the update check, and it works offline without it.

Depending on where you live, you may have the right to ask for a copy of your personal data, to correct or delete it, or to object to it being processed. Two honest caveats: the app's statistics are anonymous, so in most cases I have no way to tell which rows came from you, and feedback emails are simply messages in a mailbox. Write to me and I will do what can actually be done, including deleting the events from a specific installation if you can tell me its anonymous ID.

Where the law requires a basis for this: anonymous statistics and abuse prevention rest on a legitimate interest in making the app work and keeping the site up, and answering your feedback rests on the fact that you wrote to me first.

How long any of it is kept

Analytics events stay in my PostHog project for as long as PostHog retains them under my plan. Feedback emails stay in my mailbox until I clear them out, which for a bug report usually means until the bug is fixed and shipped. Server logs at Vercel expire on Vercel's own schedule. Your projects last exactly as long as you keep them on your own disk.

Changes to this page

If Lumae starts doing something new with data, this page changes before that version ships, and the change is called out in the changelog rather than quietly edited in. The date at the top is the last time anything here moved.

Getting in touch

Lumae is built and maintained by one person, Mathieu Legault, and distributed from lumae.app. Questions about any of this, or a request about your data, go through the feedback form. It reaches me directly and I answer it myself.