1. Summary
This Privacy Policy explains how Lumiere collects, uses, stores, shares, exports, and deletes information for the Lumiere beta, including account access, protected app workflows, Local Connector materials, journal workflows, AI mentor features, forecast preview surfaces, and optional research telemetry.
Lumiere is an education, research, paper-planning, journaling, voice mentoring, screen-read, and optional Local Connector product. Customer production live trading is outside the V1 commercial product. The Local Connector is read-only for IBKR Paper TWS market context.
| Data |
Current use |
Current controls |
| Account, login, billing, and entitlement data |
Authenticate users, manage plans, gate protected features, and maintain billing status. |
Signed-in users can export account data. Logout clears the session cookie. |
| Journal, paper-plan, and workflow data |
Save user-requested setup notes, trade-plan review fields, chart-state summaries, and outcomes. |
Journal data is account-scoped and included in the privacy export. |
| Screen, voice, upload, AI, and market context |
Generate requested educational analysis and show source-labeled market context. |
Entitlement gates apply. Raw audio, screenshots, uploads, raw prompts, and API keys are not intended for persistent storage. |
| Optional research telemetry |
When enabled and separately consented, records limited metadata for diagnostics and calibration review. |
Disabled by default. Users can manage consent, withdraw consent, export events, and delete local research events from the account page. |
| Anonymous web analytics |
Measures pageviews, acquisition, device context, and coarse completed funnel outcomes so Lumiere can operate and improve the beta. |
Vercel Web Analytics uses no advertising cookies and resets its anonymous visitor hash daily. Fixed event schemas exclude Lumiere account identifiers and sensitive product content. |
2. Account and authentication data
Lumiere collects account email, user id, role, requested plan, billing status, entitlement state, login challenge metadata, session metadata, legal acceptance versions, research consent versions, connector version, connector download timestamps, and account timestamps.
Email login codes are stored as hashes and expire by the configured login-code time limit. Signed-in sessions use the lumiere_session HttpOnly cookie with SameSite=Lax and an optional Secure flag in HTTPS production.
3. Billing data
Lumiere stores billing status, Stripe customer id, subscription id, checkout session id, price id, current period end when available, and webhook event metadata. Payment card details are handled by Stripe and are not stored by Lumiere.
4. Journal and workflow data
Lumiere stores saved journal entries, symbols, setup titles, setup descriptions, tags, selected side, trade-plan fields, chart-state summaries, compact evidence, outcome fields, notes, and timestamps when a signed-in user saves or updates a setup.
Journal notes are user content. They are included in the signed-in privacy export and are not part of optional research telemetry.
5. Market-data and analysis data
Lumiere processes stock symbols, chart timeframe, session settings, thresholds, quote data, candle data, provider status, source provenance, news metadata, chart patterns, risk calculations, forecast requests, model status, and analysis outputs to provide the requested workflow.
For a protected sample, Lumiere stores the selected analysis symbol and completion timestamp to enforce the one-sample boundary and permit the same review to resume. These fields are included in the signed-in privacy export.
Market context can come from local IBKR Paper TWS, Polygon, Yahoo fallback endpoints, local forecast workers, or configured AI providers. Lumiere labels the data source in the product workflow.
6. Local connector diagnostics
The Local Connector runs on the user's machine and provides read-only IBKR Paper TWS market context. Lumiere processes connector health, socket status, worker status, provider status, request metadata, connector version, connector download timestamps, and market-data provenance.
Lumiere's hosted V1 product does not store broker credentials, broker account numbers, balances, fills, or raw order history.
7. Screen, voice, and AI data
When a user chooses screen-read, upload, capture, voice, or AI mentor features, selected user-provided content and context are sent to configured AI providers to generate the requested educational analysis.
Lumiere is designed not to persist raw microphone audio, transcripts, screenshots, uploaded images, raw model prompts, OpenAI API keys, cookies, bearer tokens, auth codes, webhook secrets, database URLs, or broker credentials. Do not submit passwords, API keys, broker credentials, account numbers, balances, screenshots containing private financial profile data, or other sensitive data through these features.
8. Optional research telemetry
Optional research telemetry is disabled by default. If the feature is enabled for an environment, it still requires a signed-in user to opt in by scope on the account page. Accepting the Terms or acknowledging this Privacy Policy does not opt a user into research telemetry.
Forecast improvement consent records metadata such as event id, salted anonymous user id, salted session id, event type, symbol, timeframe, horizon, model id, forecast run id, provider id, latency, UI surface, timestamp, and app version.
Paper outcome research consent records metadata such as linked forecast run id, symbol, timeframe, side, bucketed planned entry/stop/target/risk ranges, outcome status, opened timestamp, reviewed timestamp, event timestamp, and app version. Product analytics is reserved for coarse product diagnostics.
Discipline Benchmark consent records a salted anonymous user id, salted review id, event and saved timestamps, consent and privacy versions, app version, and ten boolean fields indicating whether the saved review contained the methodology's source/freshness, setup, invalidation, entry, risk-budget, risk-per-unit, valid-size, execution-limitation, no-trade, and saved-before-outcome fields. The benchmark event does not contain email, Lumiere user id, symbol, journal text, exact prices, broker data, screenshots, or a performance outcome.
Benchmark statistics remain withheld unless the current methodology, consent version, privacy version, minimum sample, account-contribution cap, small-cell suppression, reproducibility, and legal/privacy wording gates all pass. An eligible result describes only the included consenting beta sample and does not measure investment performance or causation. The current public methodology defines those gates and states when results are withheld.
8A. Anonymous operational analytics
Lumiere uses Vercel Web Analytics on hosted production pages. It may process page path, filtered query and UTM parameters, timestamp, referrer, approximate country or region, browser, operating system, device type, and fixed-schema event names. It does not use advertising cookies. Vercel derives a privacy-oriented visitor hash from request context and resets that hash daily, so the visitor metric is not a persistent identity across days or websites.
Operational funnel events are sent only after completed account or billing outcomes. Event properties use fixed allowlists and do not include email, Lumiere user id, stock symbol, journal text, broker credentials or account data, private financial profile data, authentication payloads, or URLs containing tokens. Detailed product events such as successful analysis, journal, connector, or voice use require the signed-in user's separate Product Analytics consent.
9. Research telemetry exclusions
Research telemetry rejects or avoids broker credentials, account numbers, balances, fills, raw order history, free-text journal notes, exact trade prices, screenshots, API keys, cookies, raw authentication payloads, emails supplied by the browser, and private financial profile data. Server-side filters reject unknown fields rather than storing arbitrary payloads.
10. Anonymous research identifiers
Research events use salted hashes for user and session identifiers. The server derives these identifiers. Browser event payloads cannot supply their own identity fields.
11. Sources of information
Lumiere receives information directly from users, account flows, protected app interactions, local connector requests, configured market-data providers, payment providers, email/login providers, AI providers, browser/runtime diagnostics, Vercel Web Analytics, and server logs.
12. How Lumiere uses information
Lumiere uses information to operate accounts, authenticate users, provide app features, manage plans and billing, provide educational analysis, save journals, run local connector workflows, enforce safety gates, prevent misuse, debug errors, improve reliability, honor privacy controls, comply with legal obligations, and conduct optional consented research diagnostics.
13. Model improvement boundary
User behavior and paper outcome metadata may prioritize diagnostics, tuning, personalization research, and calibration review. They cannot promote Kronos, TimesFM, trained variants, or baselines into the default UI. Default model visibility remains controlled by the exact IBKR walk-forward evaluation gate and the separate default UI flag.
14. Consent and withdrawal
Research consent is separate from Terms acceptance and can be managed by scope in account settings, including a separate Discipline Benchmark choice. Users can withdraw all optional research scopes. Withdrawal stops future optional research collection for those scopes. The delete-research control deletes local research telemetry events associated with the signed-in user's current salted anonymous id and withdraws research consent.
15. Sharing and service providers
Lumiere shares limited information with service providers that help operate the product. Current provider categories include Vercel hosting and cookie-free Web Analytics, configured Postgres database storage, Stripe billing, Resend or a configured email webhook for login-code delivery, OpenAI or another configured AI provider for user-requested AI features, Polygon for professional cloud market data, Yahoo fallback endpoints, and local IBKR/TWS software running on the user's machine.
Service providers receive only the information needed for their role. For example, Stripe handles payment details; Lumiere stores billing metadata. AI providers receive only the selected user content and context needed to produce requested analysis.
16. No sale or targeted advertising
Lumiere does not sell personal information and does not share personal information for cross-context behavioral advertising in the current beta. Lumiere does not use advertising cookies in the current beta. If those practices change, Lumiere will update this policy and provide required choices before using the new practice.
17. Retention
Lumiere keeps personal information as long as needed for the purpose collected, legal requirements, security, auditability, billing, dispute resolution, product operation, or user-requested retention. Account, billing, legal acceptance, entitlement, journal, and connector metadata are retained while the account remains active and as needed for audit or legal obligations.
Login codes expire by the configured login-code time limit. Session cookies have a 14-day max age and are cleared on logout. Browser localStorage and sessionStorage are controlled by the user's browser. Optional research telemetry is disabled by default; when enabled and consented, signed-in users can export and delete research events associated with their current salted anonymous id.
18. Export, deletion, and correction
Signed-in users can export account, journal, connector, legal, consent, and anonymized research-event data through the account page. Signed-in users can delete local research telemetry events associated with the current salted anonymous id through the account page.
For access, correction, deletion, portability, opt-out, appeal, authorized-agent, or account-impacting requests that are not available self-serve, contact support@lumiere.money. Lumiere will use reasonable verification before changing or disclosing account data.
Vercel Web Analytics is maintained separately from Lumiere's local research telemetry store and is not included in the local delete-research control. Contact support@lumiere.money for verified requests involving provider-hosted analytics data.
19. State privacy rights
Depending on user location and business thresholds, users may have rights to know, access, delete, correct, opt out of sale or sharing, limit certain uses of sensitive personal information, receive portability, and avoid discrimination for exercising privacy rights. Lumiere does not deny service, charge a different price, or provide a different level of service because a user exercises privacy rights, except where the requested deletion or restriction prevents Lumiere from providing the requested feature.
20. International privacy rights
Lumiere is operated for the United States beta unless a separate launch process opens additional regions. If Lumiere serves users outside the United States, additional rights and obligations may apply, including legal bases for processing, consent withdrawal, international transfer safeguards, data-protection contacts, and regulator complaint rights.
21. Security
Lumiere uses technical and organizational safeguards appropriate for a beta product, including strict research event schemas, sensitive-field rejection, CSRF controls, security headers, local-first telemetry defaults, secret scanning, rate limits, entitlement gates, and separation of forecast promotion from research behavior. No system is perfectly secure.
22. Incident response
Lumiere maintains operational procedures to detect, respond to, recover from, and notify affected users or regulators about unauthorized access to sensitive information where legally required. Report privacy or security concerns privately to support@lumiere.money.
23. Children
Lumiere is not intended for children or minors. Users must be able to form a binding contract and comply with applicable laws. If you believe a minor submitted information to Lumiere, contact support@lumiere.money so the request can be reviewed.
24. Cookies and local storage
Lumiere uses cookies and browser storage for product operation, not advertising, in the current beta. Vercel Web Analytics does not use analytics cookies.
| Item |
Type |
Purpose |
Duration |
lumiere_session |
HttpOnly cookie |
Signed-in session and protected-route access. |
Up to 14 days or until logout. |
| Trading/chart preferences |
localStorage |
Remember trading mode, chart view, chart frame, chart session, and zoom. |
Until changed or cleared in the browser. |
| Optional session OpenAI key |
sessionStorage |
Developer/local session support where client keys are explicitly allowed. |
Browser session only. |
| Screen-read consent marker |
sessionStorage |
Remember per-session consent for screen-read features. |
Browser session only. |
25. Changes to this policy
Lumiere may update this Privacy Policy. Material changes bump the privacy version and can require renewed acceptance before protected workflows open. Optional research consent versions can also be bumped when consent language materially changes.
26. Contact
For privacy requests, security concerns, support questions, or questions about this policy, contact support@lumiere.money. Do not send passwords, API keys, broker credentials, account numbers, or other sensitive secrets by email.