# Privacy (/privacy) Lumi is a keyboard utility: it watches every keystroke on the machine, reads the text in front of your caret, and can be handed your clipboard and your selection. So it is worth saying plainly where any of that goes. **None of it leaves your Mac.** Two things reach the network at all — the updater, and usage data if you switch it on — and neither carries content. ## Share usage data [#share-usage-data] **General → Share usage data** is a single switch, and it is **off unless you turned it on**. The first-run tour puts the question on a panel of its own with two choices and neither pre-selected, and will not move past it until one is picked — so reporting is never the result of a default nobody changed. Leaving by Skip or Escape is a no, and an install that predates the question stays off until somebody visits Settings. ### What is sent [#what-is-sent] Counts and switch positions. One report a day, at most. | About | What the report carries | | ------------- | ----------------------------------------------------------------------------------- | | **Flows** | how many exist, how many are switched on, how many the free plan is capping | | **Snippets** | how many exist, and whether snippets are on | | **Shortcuts** | how many bindings exist, and whether shortcuts are on | | **Features** | whether the Hyper key and Fn are on, whether Lumi starts at login, which appearance | | **Plan** | whether this copy is entitled to Pro — one bit | | **Build** | Lumi's version and the macOS version | | **Country** | two letters, resolved at the edge (below) | ### What is never sent [#what-is-never-sent] * **Content of any kind.** A number of snippets, never a snippet. A number of bindings, never a combination. A number of flows, never a name. * **Nothing about your licence** — no key, no order, no seat id, no email. The code that builds the report is never handed the licence at all, so there is nothing there to leak by accident; one bit reaches it and the caller worked that out. * **No profile.** The report is a count from an installation, not a record about a person, and it says so to the analytics vendor explicitly. ### Where it goes [#where-it-goes] Reports are posted to **Lumi's own domain**, not the analytics vendor's, and relayed from there. Two things follow, and both are the reason for the indirection: * A desktop app cannot change a host it has already shipped. Anyone who never updates would keep talking to whatever was compiled in, for ever — so the vendor, the region, or the whole arrangement can change without stranding those copies. * **Your IP address stops at that edge.** It is never sent by the app and never reaches the vendor; what is resolved from it there is a two-letter country code, added to the body, which is why a country can be reported at all without the address behind it. Vendor-side geolocation is switched off in the same request. ### Turning it off [#turning-it-off] The switch is in **General**, one click, and it is deliberately not filed under an Advanced section — a consent that takes two clicks to find is a consent that is hard to withdraw. Turning it off **deletes the install id**, so nothing left on disk ties this Mac to anything already sent. Turning it back on starts a new one. A **debug build never reports**, whatever the switch says. ## What stays on your Mac [#what-stays-on-your-mac] Everything else. It lives in `~/Library/Application Support/dev.thiennguyen.lumi/`, in plain files you can read: | File | Holds | | ---------------- | ---------------------------------------------------------------- | | `config.json` | shortcuts, snippets, the Hyper key, every setting | | `flows/` | one file per [flow](/features/flows) | | `history.json` | the last 200 [snippet expansions](/features/snippets#history) | | `telemetry.json` | the install id and when the last report went, if reporting is on | Two of those are worth a second look: * **`history.json` is plain text**, which matters if you generate passwords with `{{$randomPassword}}`. The switch at the foot of **Snippets → History** stops the recording, and **Clear history** empties it. * **A `{{$clipboardText}}` expansion is never written to history**, whatever the pasteboard says about itself — that is where one-time codes and session URLs end up, and Lumi cannot tell one from a copied paragraph. Uninstalling does not remove that directory; see [Uninstalling](/get-started/installation#uninstalling). ## Things that touch the network [#things-that-touch-the-network] | What | When | | ------------------------------- | -------------------------------------------------------------------------------------------------------------- | | **The updater** | on its own schedule, and when you press **About → Check for updates** | | **Usage data** | once a day, only if you switched it on | | **Licence checks** | at launch and on window focus, at most once a day, only if a licence is stored — see [Pro](/pro#going-offline) | | **A feedback report** | only when you send one | | **An `HTTP Request` flow node** | only when a flow you wrote and armed runs one | Nothing else. Reading the clipboard, running a command and reading your selection are all local. The full policy is on the [privacy page](https://lumikeys.app/privacy).