DocsPrivacy and security
What Luma sends
No telemetry and no account: the few connections Luma makes on its own, when, and to where.
Luma has no telemetry, no usage statistics, no crash reporting and no account. Your history, bookmarks, passwords, open tabs and privacy statistics stay on your computer. Luma has no AI features either.
Like any browser, Luma connects to the sites you open. Besides those, it makes a few requests of its own, listed here.
Requests Luma makes
| What | When | Where |
|---|---|---|
| Checking for updates. The request carries the version you have. | 30 seconds after Luma starts, then every hour | lumabrowser.dev |
| Downloading an update | When a newer version exists | lumabrowser.dev |
| Filter lists for blocking | Checked a minute after start and every six hours; downloaded when older than four days | easylist.to, easylist-downloads.adblockplus.org, raw.githubusercontent.com |
| Lists of dangerous sites | Downloaded about every 12 hours | malware-filter.gitlab.io, or its mirrors curbengh.github.io and malware-filter.pages.dev |
| Translation models | Only when you translate a page: the list of models at most once a day, each language once | firefox.settings.services.mozilla.com, firefox-settings-attachments.cdn.mozilla.net (Mozilla) |
| Extensions from the Chrome Web Store | When you install one; then every five hours, to check the ones you installed from there for updates | chromewebstore.google.com, clients2.google.com (Google) |
| Search suggestions | Only if you turn them on: what you type in the address bar | Your search engine |
| Secure DNS lookups | When you open a site | Your DNS provider (Quad9 by default) |
| Luma’s website, in a tab | Once, the first time you open Luma | lumabrowser.dev |
These requests are made without cookies. Apart from search suggestions, which send what you type, they carry nothing from your browsing. As with any connection, the server sees your IP address. Luma’s website counts update checks by version and day, as its privacy policy explains.
Updates, filter lists and dangerous-site lists are downloaded over HTTPS and checked before use. An update is installed only if it is signed with Luma’s own key (see Updates).
What never leaves your computer
- Page translation: the page’s text is translated on your PC. Only the language model is downloaded. See Translate.
- The check for dangerous sites: the lists are downloaded, the addresses you visit are not sent.
- Your privacy statistics, passwords, addresses and cards.
- Spell checking, which uses Windows’ own spellchecker.
- Your synced data leaves only encrypted, for the folder or server you chose. See Sync.
Turning things off
- Search suggestions in Settings › Search is off by default.
- Secure DNS and its Provider are in Settings › Privacy & security.
- Extensions contact Google only if you install them from the Chrome Web Store.
- Translation contacts Mozilla only when you translate.