Effective 28 October 2026

Privacy policy

This policy describes the Luma Mail desktop application and this project website. The project is maintained by SleepyZzed. Privacy and support contact: mcverdict@gmail.com.

Google data Luma accesses

When you connect an account, Luma accesses your Gmail address, message and conversation metadata, labels, unread counts, and message contents needed for the views and actions you request. It loads conversation lists in pages, bodies when expanded, and attachments when you open, save, forward or edit them. Searches run on Gmail. Polling retrieves recent changes for notifications.

The gmail.modify permission enables reading, composing and sending email; creating and updating drafts and labels; and read/unread, star, archive and Trash operations. It does not allow immediate permanent deletion that bypasses Trash. You complete Google's consent in your browser; Luma does not request your Google password.

The initial sign-in offers optional Contacts, limited Drive and basic Gmail settings alongside required Gmail access. You can deselect or decline optional permissions; Luma enables only features whose permissions were granted. Skipped features can be connected later in Settings.

If you enable optional Drive integration, Luma requests drive.file permission for files created or explicitly authorized for the application. Selected files can be uploaded to Drive, linked in mail and shared with the recipients you confirm. Luma does not automatically make files public. Inserting a local signature picture is a separate, explicitly confirmed operation: Luma uploads an optimized copy to Drive and grants public, unlisted, read-only link access so recipients can load it. Anyone with that link can access the copy. Removing it from a signature does not delete the Drive file; manage unwanted copies in Drive. Existing-file selection is limited in the current early-access build.

If you choose Block sender or Save a Gmail signature, Luma requests optional gmail.settings.basic permission to create, inspect and remove sender filters in Gmail, or update only the selected primary sending address’s signature. Signatures are read on demand, saved online in Gmail, and included in outgoing mail without a local signature archive. These rules send future mail from the chosen address to Trash, including while Luma is closed. Luma stores only the sender address and server filter ID locally to manage rules it created. Disconnecting Luma does not remove server filters; unblock senders first or manage those rules in Gmail Settings. Turning off an optional feature in Luma stops that feature's requests but does not revoke an already-issued Google grant. To revoke authorization, use Google Account connections; to stop all app access, remove the account from Luma and revoke its Google connection. See the permissions and controls page.

If you enable saved-contact profile photos, Luma requests optional contacts.readonly permission. It searches Google Contacts for the email addresses of visible senders and retrieves only matching email addresses and photo URLs. It does not synchronize your address book or send contact data to a third-party avatar service. Matching photos are downloaded directly from Google’s image service without Gmail/Contacts bearer tokens, cookies or referrers. When Drive and profile photos are both enabled, the already-granted Drive permission can also retrieve the connected account’s own email and profile photo. This cannot look up arbitrary senders. Unmatched senders use initials.

Where data goes

The desktop application connects directly to Google over HTTPS. Luma has no application server that receives your mail, attachments or OAuth tokens. Sending mail and granting Drive sharing transmit the selected content to Google and the recipients you choose. Opening an external link uses your browser and the destination's own privacy practices.

Luma does not sell Google user data, use it for advertising, build advertising profiles, or use it to train generalized AI or machine-learning models. It does not include analytics or automatic telemetry. The maintainer does not receive or routinely review your mailbox contents. Information you voluntarily send for support is visible to its recipients; public GitHub issues are public. Do not include private mail, credentials or tokens in reports.

HTML email is sanitized and displayed in an off-record Qt WebEngine view on Linux or an InPrivate WebView2 view on Windows. Email scripts, forms and direct network or local-file requests are blocked. Inline images and attachment thumbnails are decoded with size limits in memory. Choosing Load images sends HTTPS requests to the message's external image servers without Google credentials, cookies or referrers; those servers can see your IP address and image-specific URL and may infer that you opened the email. External links open only after you click them.

The signature editor uses the native Qt rich-text document. It keeps supported formatting and image previews in bounded memory, with no local signature archive. Choosing to load or insert an HTTPS signature picture makes a bounded anonymous request to that image server, which can see your IP address and the URL. Signature HTML is capped at 64 KiB/eight pictures. Local picture copies are optimized in memory with no disk spool; optional Drive sharing is explicitly confirmed before upload.

Local storage and retention

Refresh tokens are stored in Linux Secret Service (with encrypted keyring transport) or Windows Credential Manager. Access tokens are held in application memory. Account identifiers, preferences, polling state and optional bounded cached content are stored locally in the platform’s per-user application locations. Your desktop session and keyring configuration control protection of data at rest.

Windows browser, codec, font and image-loader runtime metadata uses a private TEMP session directory, separate from the bounded mail cache. Browser documents and media input are supplied from memory. Interrupted sessions may leave disposable runtime metadata; this is not a mailbox or draft archive. The installed program and its runtime libraries are also separate from the mail-cache budget.

The content cache defaults to 100 MiB and supports disabling, size limits, expiry, immediate clearing and clearing on exit. Luma does not maintain a full-mailbox mirror, local historical search index or attachment archive. Credentials, essential settings/account metadata and files explicitly saved to a location you choose are outside the disposable content-cache budget. See the storage documentation for exact limits.

Draft saving is configurable: Ask on close (default), Save on close only with a valid recipient and authored body, or Manual Save only. Typing and attachments do not automatically create drafts. Explicitly saved drafts live in Gmail rather than a local draft store. Older unsent recovery copies from development builds are preserved until saved to Gmail or discarded. Optional recent-recipient suggestions remember only successful sends made in Luma, with at most 100 addresses, a 64 KiB file limit and 90-day expiry. They do not scan your contacts or Sent history and can be cleared in Settings; disconnecting removes that account's suggestions.

Pasted images remain in memory as bounded message attachments and are included in the Gmail draft; Luma does not create a clipboard-image spool. Optional contact photos are limited to 128 small decoded images in memory, expire after ten minutes, and are released on disable, disconnect or exit. There is no photo or contacts database on disk. Draft-conflict recovery creates a separate Gmail draft only when you choose that action; it does not overwrite Gmail’s newer version or add a local archive.

Your controls and deletion

You can clear cached content, disable notifications or an account, and remove an account in Settings. Removal deletes its local credentials and cache and attempts to revoke authorization at Google. It does not delete mail from Gmail. You can also revoke Luma's access in Google Account connections. Explicitly downloaded files remain until you delete them. Uninstalling the program alone may leave settings, cache and keyring items; use the uninstall instructions.

Website hosting

This static website is hosted on GitHub Pages. It has no sign-in form, analytics scripts or cookies set by Luma. GitHub processes connection information, including visitor IP addresses, under its privacy statement. Downloads and issue reports are also hosted by GitHub.

Google Limited Use

Luma Mail's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Changes and questions

Policy changes are published here with an updated effective date and recorded in the public repository. Contact mcverdict@gmail.com with questions or a deletion request for information you sent directly for support. The maintainer cannot delete data held only on your desktop or in your Google account on your behalf.