DRAFT – not final, pending legal review

Lumtap – Privacy Policy

Draft, last updated 2 November 2026. Not final; pending legal review.

Lumtap lets an AI assistant you connect (for example Grok Bot, Claude, ChatGPT or Cursor) see and operate your Android phone when you ask it to. This policy explains what the app and the Lumtap relay service handle, and what we keep.

What the app accesses on your phone

With the Accessibility permission you grant, the app can read on-screen text and layout, take screenshots, and perform taps, swipes, typing and navigation. It does this only:

• in response to a request from an assistant you connected and approved,
• while the link is switched on and the "controlling your phone" notification is showing (with the on-screen glow and STOP button).

It does not act on apps on your blocked list or while the screen is locked. Password fields are masked.

What leaves your phone

To carry out a request, screen contents, screenshots, the foreground app's package name and your list of launchable apps (blocked apps excluded) are sent over an encrypted connection (TLS) to the Lumtap relay and on to the assistant that asked for them. The assistant's provider handles that data under its own privacy policy.

What the relay stores

• Your account: email address (or Google sign-in identifier), name, sign-in sessions.
• Paired phones: device name and model, a hashed device token, last-seen time.
• Connected assistants: the app name you approved and hashed access tokens.
• A security audit log (sign-ins, connections, revocations) with hashed IP addresses, kept for 90 days.
• If registration payments are on: whether you have paid, the amount, currency, date and the payment provider's reference.

The relay does not store screenshots, screen text or text you type; typed text is never logged. The action history lives only on your phone, and you can clear it.

Payments

If a registration fee applies, payment is handled by our payment provider (for example Paystack or Stripe). Your card details go directly to the provider; we never see or store them. The provider processes your payment under its own privacy policy.

Email

We send one-time sign-in codes to your email address through an email delivery provider. We don't send marketing email.

Who receives your data

These are the only parties that receive data from Lumtap:

• Hetzner Online GmbH (hosting, Germany). The Lumtap relay runs on a Hetzner server. Everything the relay handles (your account details, paired phones, connected assistants, the audit log, and the screen data passing through to your assistant) is processed on that server. Hetzner provides the machine only; it does not use the data.
• Resend, Inc. (email delivery, USA). Resend receives your email address and the contents of the emails we send you: one-time sign-in codes and security notices such as "a new phone was paired". It does not receive anything from your phone.
• The AI assistant you connect (for example Grok Bot, Claude or ChatGPT). When you ask it to use your phone, it receives the screenshots, on-screen text, app names and app list needed for that request, plus the results of its taps and typing. Its provider handles that data under its own privacy policy and settings. Lumtap only sends data to assistants you approved, and you can disconnect them at any time.
• Google, only if you choose "Continue with Google": Google confirms your email address to us under Google's privacy policy.
• A payment provider, only if a registration fee is switched on (it is off during the free beta): it receives your email address and payment details as described under Payments.

We don't sell your data, share it with advertisers or data brokers, or use it to train AI models.

Your controls

• Master switch and STOP button in the app; blocked apps list.
• Unpair a phone or disconnect an assistant at any time from the app or your account page; this revokes its tokens immediately.
• Turn off the Accessibility permission at any time.
• Delete your account from the account page; this removes your phones, connected assistants and sign-in data from the relay. Payment records may be kept where the law requires it.

Sharing

We don't sell your data or use it for advertising. We share data only with the recipients listed under "Who receives your data", or where the law requires it.

Children

Lumtap is not intended for children under 13 (or the minimum age in your country).

Changes

We'll post any update here and change the date above.

Contact: support@techlava.ng.