Privacy
Lumafoil is built so your photographs stay yours. This page explains what happens to your images and your account information in plain language, drawn from the controls the project actually enforces.
Photos are processed on your device
Editing and watermarking run on your device. A preview does not upload your originals to Lumafoil.
You choose whether to download the output, save it to Watermarked Images, transfer it to connected cloud storage, or create a sharing link.
Accounts, saved work and offline copies
Cloudflare hosts account records, saved watermarks, gallery photos, thumbnails, uploaded logos, sharing records and recent-work history. Saved content belongs to its workspace; other users need explicit membership or a sharing link.
Account-scoped copies and queued edits are kept on this device for offline use. Reconnecting with the same account retries them. Pending edits block sign-out; completed sign-out clears the app’s offline data. Session expiry locks access without erasing pending work. Clearing browser data can erase unsynced edits.
Personal metadata and artwork notices
Image exports remove camera and location metadata by default. Supported options can retain camera fields without GPS, or retain supported original metadata. This processing happens in your browser.
Exports using bundled artwork retain its license notice in metadata, a document attachment or an archive sidecar. Other software may remove these notices; retain the applicable notice when redistributing that artwork.
Sharing links
Anyone with a Lumafoil gallery link can view its selected saved photos until the link expires or is revoked. A site invitation creates access to a separate private account; it does not share the inviter’s workspace or content.
Cloud providers’ own links follow their permissions and revocation rules. Revoking a link cannot recall downloads or copies already made.
Your account
New accounts require an invitation and a verified email. Sign in with a password or configured Google/Microsoft sign-in. Existing accounts need no new invitation. Adding another sign-in method requires authenticated account linking.
Sessions use HttpOnly, SameSite=Lax cookies, marked Secure on HTTPS. Password-reset links expire after an hour and revoke other server sessions when used.
Cookies and outside services
Lumafoil includes no analytics beacon or advertising cookies. Essential cookies maintain sessions; device storage holds settings, offline copies and queued changes.
When enabled, Cloudflare Turnstile checks account requests for bots; see its privacy notice. Google/Microsoft handle chosen sign-in. Google Drive, Dropbox and OneDrive receive requests through cloud features you choose; their own privacy policies apply.
Audit trail
Workspace audit logs require a workspace owner/admin role. The site owner and admins can manage accounts and review totals, moderation, audit entries and health/error records. Recent-work history is user-specific. Application failure logs omit tokens and request bodies.
Reporting a problem
For support, email support@lumafoil.com. Report vulnerabilities through GitHub’s private reporting form or that email address. Do not put tokens or personal content in public issues.