Privacy Policy

The privacy policy of LumDIY. Last updated 2026‑08‑12.

This policy explains what information LumDIY handles and how. LumDIY is a self-hosted smart-home hub: your devices, automations and their data live on your own hub, under your control. Our cloud service exists only to give you secure remote access and optional voice control.

Who we are

LumDIY provides and operates the LumDIY smart-home hub and the LumDIY cloud service described in this policy, and is the party responsible for the information covered here. For any privacy question or request, contact us at admin@lumdiy.com.

What we collect

• Account details — the email address you use to sign in.
• Hub identifier — your hub's serial and the connection metadata needed to route your session to it (for example, the encrypted-tunnel hostname).
• Operational logs — minimal diagnostic logs (timestamps, error codes) used to keep the service reliable.

Your device names, states and commands are stored on your hub. When you use remote access, they pass through our relay in transit only — we do not build a copy of your home's device data.

Remote access

Remote access works over an encrypted tunnel between your hub and our cloud relay. The relay forwards your already-authenticated session to your hub; we do not inspect the contents of that traffic beyond what is required to route it.

Google Home

If you link your Google account, LumDIY relays Google's smart-home requests (SYNC / QUERY / EXECUTE) to your hub so you can see and control your devices with the Google Home app and Google Assistant. To keep the Home app current, LumDIY also reports device state changes to Google's HomeGraph. This exchange includes your device names, types and on/off or similar states for the devices you have chosen to expose. We do not sell your data or use it for advertising. You can disconnect at any time from the Google Home app, which revokes this access.

How we use information

We use the information above only to provide the service: to authenticate you, connect you to your hub, enable the integrations you turn on (such as Google Home), and keep the service secure and working. We do not use your information for advertising, we do not build advertising or marketing profiles from it, and we do not sell personal information.

How information is shared

We do not sell your personal information and we do not share it with third parties for their own purposes. Information is shared only in these cases:

• With Google, when you link Google Home — the device names, types and states described above, so the Google Home app and Google Assistant can show and control the devices you chose to expose. Nothing is sent to Google unless you link your account, and it stops when you unlink.
• With our infrastructure providers — the hosting, networking and encrypted-tunnel services that run the LumDIY cloud. They process data only to operate the service on our behalf, under contract, and may not use it for their own purposes.
• Where legally required — if we must comply with applicable law or a valid legal request, or to protect the rights and safety of our users.

Because the LumDIY cloud runs on globally distributed infrastructure, this information may be processed in countries other than your own. We apply the same protections wherever it is handled.

Cookies and local storage

We use cookies and browser storage only to keep you signed in and to remember interface preferences such as your chosen dashboard. These are strictly necessary for the service to work. We do not use advertising cookies, tracking pixels, or third-party analytics that profile you across sites. Clearing them signs you out.

Security

Traffic between your hub, our cloud and your browser or app is encrypted in transit. Remote access runs over an encrypted tunnel that your hub opens outbound, so your hub does not need any inbound ports open to the internet. Access tokens are stored so they can be revoked, and they are invalidated when you sign out or unlink a service. No system is perfectly secure, but we design the service to hold as little of your data as possible — the bulk of it never leaves your hub.

Retention

We keep account and hub-link information for as long as your account is active. Session and linking tokens are removed when they expire or when you sign out or unlink a service. Operational logs are short-lived and kept only as long as needed to diagnose problems.

Deleting your data

You can remove your data at any time:

• Unlink Google Home — from the Google Home app, or from LumDIY. This revokes the linking tokens and stops any further exchange of device information with Google.
• Delete your account — email admin@lumdiy.com from the address on the account. We will delete your account details, hub-link records and any linking tokens we hold. We aim to complete requests within 30 days and will confirm when it is done.
• Your hub's own data — device names, history and automations live on your hub, so you delete them by removing them on the hub or resetting it. We cannot delete them for you, because we do not hold a copy.

Your choices and rights

You choose which devices are exposed to a voice assistant, and you can hide any of them at any time. You can unlink Google Home whenever you want. You can ask us for a copy of the account information we hold, ask us to correct it, or ask us to delete it, by contacting admin@lumdiy.com. Because your home's data lives on your hub, you remain in direct control of it.

Children

LumDIY is intended for adults installing and running a smart-home system. It is not directed at children, and we do not knowingly collect personal information from children. If you believe a child has provided us information, contact us and we will delete it.

Changes

We may update this policy as the product evolves. Material changes will be reflected here with an updated date.

Contact

Questions, requests, or anything else about this policy: email admin@lumdiy.com.