Privacy policy

What Lumo does not do

• no advertising;
• no audience measurement, tracking or profiling tool, neither on the website nor in the apps;
• no selling or renting of your data;
• no relaying of your streams: video never goes through Lumo's servers.

Data controller

[Name and address of the controller to be completed]. Contact: [contact address to be completed].

Your account

Your email address, your password, an optional display name, your language, the date the account was created and the date your address was verified. The password itself is never stored: only its hash (Argon2id) is. This data is used to identify you and to write to you to verify your address or reset your password — never for anything else.

Your sources

What you enter: a name, the address of an M3U playlist and of a programme guide, or the address of an Xtream server with a username and a password. The Xtream password is encrypted in the database (AES-256-GCM) with a key kept outside the database, and is never sent back to the apps.

Lumo's server contacts your provider to read the playlist, the catalogue and the guide. That is the only exchange between Lumo and your provider; it comes from Lumo's server, not from your device.

The imported catalogue

The names of channels, films, series and categories, the addresses of their logos and posters, the programme guide and the stream addresses. A stream address may contain your Xtream credentials, the way your provider builds it: it is kept so it can be handed to your app when you start playback, one at a time, and it never appears in a listing or in a log.

Your activity

Your favourites and their groups, your watchlist, your playback positions and time watched, your recent channels and the items you hid. They let you find the same things on all your devices.

Your devices

For each signed-in device: its type (website, phone, TV), its name and model as the device reports them, the app version, the date it was linked and its last activity. Session tokens are stored as hashes. A TV activation code expires after a few minutes.

Playback

Playback is direct: your browser or app opens the stream at your provider. Your provider therefore sees your IP address, as with any player. If your provider refuses direct playback in the browser, Lumo says so; it does not route it through its servers.

Chromecast

When you send playback to a Chromecast, your phone or browser passes the stream address — which may contain your Xtream credentials — and the title to the Chromecast on your network. The Chromecast plays the stream with Google's default receiver, directly from your provider. Lumo itself sends nothing to Google; using Chromecast is covered by Google's privacy rules.

What stays on your devices

On the website: an encrypted session cookie that scripts cannot read, and preference cookies (active source, display, language). Your playback preferences stay in the browser's local storage. These cookies are necessary for the service; there are no advertising or measurement cookies, hence no consent banner.

In the Android apps: your session tokens, encrypted with a system key, a copy of the catalogue for display, and your preferences. Everything is erased when you sign out.

Technical logs

The server keeps logs to run and protect itself: errors, source synchronisations, sign-in attempt limits. They never contain a password, a token or a stream address. Your IP address is used, in memory, to limit sign-in attempts; [retention of IP addresses by the front server: to be completed].

Emails

Lumo sends two emails only: verifying your address and resetting your password. They are sent through [email provider to be completed]. No newsletter.

Hosting and providers

The service is hosted by [host and country to be completed]. The Android apps are distributed through Google Play. No payment is requested in this version.

Retention

Your data is kept as long as your account exists. A deleted source goes with everything imported from it; a deleted account goes with everything attached to it, immediately. Database backups are erased after [duration to be completed].

Your rights

You can delete your account yourself, from the website or the app. You can also ask to access your data, to correct it, for a copy in a readable format, or object to its processing. For any request: [contact address to be completed]. You can also lodge a complaint with your data protection authority (in France, the CNIL).

Changes

This page will be updated if the service changes how it processes your data; the date at the top gives the version in force.