Version: 1.0. Effective and updated October 23, 2026. Applies to the current functions of Luma Portrait 1.0 (2026102302). Maintainer and support: AILife Lab. Contact: sherardchina@gmail.com.
1. Local editing and person analysis
Photos, RAW files, references, overlays and text you choose are used for photo editing. Projects may store originals or external-file references, authorization bookmarks, names and paths, editing settings and related records, ratings and retouch flags, export records, thumbnails and reusable caches.
Built-in person, face and pose detection, skin/clothing segmentation, masks, local repair and local Color Expert processing run on your device. Person identifiers, landmarks, outlines and masks support editing rather than verification of a person's real identity. These results can be saved with the project. Manual editing requires neither a developer account nor a remote AI service. We do not operate a cloud-retouching backend that receives your local photo library.
2. Optional AI transmits information to configured services
The assistant is a separate optional feature. Its service may run on your computer, local network or a third-party remote server. Requests go to the service actually used; local photo editing does not make an AI request offline.
- Model lists: the app requests model information from the configured service and may use that connection's Token. Your editing photos are not sent for this action.
- Connection tests and first save: a locally generated digit image and test instruction are sent to verify image support and may incur charges. The test image is not your current photo.
- Editing requests: requests can include your text, relevant conversation history, model name, editing parameters, person/mask identifiers, names, positions and region information. Depending on the function and selected attachments, they may also include the current preview, reference, base image, coordinate grid, face crops, local details and region-evidence images. Disabling the current preview does not stop transmission of text and editing context.
Images are re-encoded, resized and orientation-corrected locally, rather than uploading the entire library or original RAW file. Compressed images can still clearly show faces, clothing and private scenes and are not anonymous merely because they are smaller. Text, layer/person names and visible image content may also contain personal information.
One assistant action may involve multiple requests, tool calls and result feedback. The service receives request content, its authentication key and normal connection information such as source address and timing. Use trusted HTTPS for remote transmission. A custom HTTP address does not provide the same transport encryption.
3. Actual provider, automatic switching and provider terms
The app offers configuration entries for DeepSeek, Kimi, Qwen, Hunyuan / TokenHub and custom services. These are not services operated by us and do not share a single retention or training policy. If Prefer DeepSeek at Night is enabled, a saved, image-verified DeepSeek connection may take precedence over the selected connection for conversations from 20:00 to 08:00. The preference defaults to on, but no service is created when a suitable saved connection is unavailable. You can turn it off in Settings.
Before configuring or using a service, check the actual recipient, account terms, charges, processing location, retention and deletion arrangements. The provider handles requests under its own policy and your agreement with it. We do not promise that providers retain nothing, never train on data, always process locally or allow us to delete data for you. A cross-region service may process data in another country or region. If you do not want to provide content to a service, do not configure or invoke it. Even your own local service should be checked for logging and external network activity.
4. Permissions, Photos and system services
File and folder access uses system pickers, the sandbox and authorization bookmarks. Local-network permission connects to a configured LAN AI service. The system photo picker provides selected items; saving exports to Photos may request add-photo permission. You can revoke permissions in system Settings, which may affect related import, export or connection functions.
iCloud-only photos and cloud-drive files may need downloading by the system. Backups, file providers, photo synchronization, Apple diagnostics and store services follow their own policies and your settings; see Apple's privacy policy. The app does not request microphone, camera, contacts or location permissions and contains no advertising trackers or third-party analytics/crash-upload SDK. Apple sign-in, developer-operated accounts and an official Agent service are not currently available.
5. Keys, local retention and deletion
Service addresses, models, aliases, directory authorizations and preferences stay on the device. Tokens are stored in the system Keychain and used to authenticate with the corresponding service, rather than included in project copies. Removing a service connection deletes its app configuration and corresponding Keychain Token. Do not rely solely on uninstalling the app to clear Keychain records.
Projects can store conversations, assistant suggestions and reference attachments. Originals, person masks, previews and other caches may also exist in projects or local files. There is no single automatic expiry for all data. Removing a photo is an undoable project action, not secure erasure of every history item, cache or original.
Back up important work before separately cleaning projects, import copies and caches through the app and system file tools. Deleting a project package can remove its embedded originals, masks and records. Externally referenced originals, separate import copies, exports, Photos originals, backups and recipient copies need separate management. Undo and local deletion cannot recall content already sent to an AI service or another recipient. Contact the relevant provider for server-side deletion.
6. Sharing, support and security
Sharing or moving a .lumaportrait copy may also give the recipient originals, references, editing records and person-analysis data. Original photographs may contain capture time, location or other metadata. Re-encoding AI transport images does not mean all projects and exports have been stripped of sensitive information. Obtain appropriate authorization before handling clients' or other people's portraits, especially before sending them to third-party AI.
If you email support, we receive your address and voluntarily supplied information to handle the request. Do not send Tokens, complete client projects or unauthorized portraits. You may request deletion of support correspondence we control, except legally required records. We cannot remotely access or delete projects stored only on your device and cannot guarantee absolute security for any device, service or recipient.
7. Minors and changes
This is a photo editor, not a public children's content community, and it does not actively request age information. Guardians should guide minors in choosing photos, recipients and AI services. Changes to data handling will be reflected in this notice and applicable store privacy information, with notice and authorization where required. Contact the address above for privacy questions.