1. Introduction
This Privacy Policy explains how Luzora collects, uses, stores, shares, protects, and deletes personal information when you use the Luzora browser extension, Luzora websites, password reset pages, data deletion pages, newsletter forms, support channels, and related services. In this Policy, "Luzora", "we", "us", and "our" refer to the team or legal entity responsible for providing Luzora.
Luzora is a browser-first recurring task manager. It helps you save website routines as tasks, schedule recurring reminders, open saved task links, track completions, and sync your account across supported browsers. Because Luzora works close to your browser, we want this Policy to be clear about what the extension can see, when it can see it, and what we do not collect.
By using Luzora, you acknowledge that we will handle personal information as described in this Policy. If you do not agree with this Policy, please do not use Luzora.
2. Plain-language privacy commitments
These commitments are central to how Luzora is designed:
-
2.1 User action first
Luzora inspects the current page only when you open the extension, use Add current website, trigger Luzora Bolt, save a page, or otherwise ask Luzora to work with the active page.
-
2.2 No sensitive-field reading
Luzora is not designed to read passwords, payment details, card numbers, bank details, seed phrases, private keys, API keys, secret tokens, private form values, or hidden sensitive form values.
-
2.3 No sale of task data
We do not sell your task titles, saved links, project names, reminder settings, or completion history.
-
2.4 Purpose-limited browser data
Data from browser permissions is used to provide user-facing Luzora features, such as saving the current page as a task, opening saved links, displaying reminders, syncing tasks, and improving reliability.
-
2.5 Do not store secrets in Luzora
Luzora is for tasks, routines, and website follow-ups. Do not save passwords, API keys, private keys, seed phrases, card details, bank information, or other sensitive secrets in task titles, folders, notes, project names, or links.
2.6 Chrome extension data disclosure
This section describes the current Luzora browser extension data flow in one place. It is intended to make clear what the extension handles, why it handles it, where it is stored, and which external providers receive it.
-
Data kept in your browser
Luzora stores authentication session data, task drafts, a local task cache, folders, schedules, completion history, preferences, notification state, Auto Return state, language and shortcut settings, and analytics identifiers in browser storage. This local data is used to keep the extension working across popup closures and browser restarts.
-
Data sent to Supabase
Luzora sends your email address, authentication information, Luzora user identifier, profile settings, tasks, task titles, projects, folder names, saved URLs and domains, favicons, schedules, reminders, task versions, completion history, preferences, referral records, and limited usage metadata to Supabase. Supabase provides authentication, database storage, account management, Edge Functions, and cross-browser sync. Passwords are processed by Supabase Auth and are not stored in Luzora task or profile tables.
-
Data sent to PostHog
The extension sends PostHog a randomly generated analytics identifier, event names, event timestamps, extension version, current Luzora screen, time zone after login, feature activity, task count, project count, folder count, completion count, session status, sync status, and similar product-use measurements. After login, the analytics identifier is associated with the internal Luzora user identifier so activity across sessions can be measured.
The extension's analytics filter removes properties identified as email addresses, passwords, authentication tokens, secrets, API keys, private keys, task titles, task links, saved URLs, folder names, project names, website names, and domains before analytics events are sent. PostHog does not receive task content or saved browsing destinations through Luzora analytics.
-
Data sent to Google's favicon service
When Luzora generates an icon for a recognised website, the extension may request that icon from Google's favicon service. The request contains the website domain and may expose ordinary request information such as your IP address, browser information, and request time to Google. This service is used only to display the website icon beside a task or project.
-
Data not sent by the extension to website analytics or email providers
The extension does not send extension activity to Google Analytics, Vercel Web Analytics, or Resend. Google Analytics and Vercel Web Analytics are used on Luzora website pages. Resend is used by Luzora website and backend flows for verification, transactional, Manifesto, deletion, and subscription emails.
Chrome Web Store Limited Use: Luzora's use and transfer of information received from Chrome APIs complies with the Chrome Web Store User Data Policy, including the Limited Use requirements. Luzora uses Chrome API data only to provide or improve the extension's disclosed, user-facing task, reminder, page-capture, sync, and return features. We do not sell Chrome API data, use it for personalised advertising, use it for credit or lending decisions, or allow humans to read it except with the user's specific consent for support, when required for security, when required by law, or after the data has been aggregated and anonymised for internal operations.
3. Who this Policy applies to
This Policy applies to visitors, extension users, account holders, newsletter subscribers, referral users, people who contact support, and anyone who uses a Luzora page or service that links to this Policy.
Some privacy laws use terms such as "personal information", "personal data", "personally identifiable information", "controller", "processor", "business", or "service provider". When we use "personal information" in this Policy, we mean information that identifies, relates to, describes, can reasonably be associated with, or can reasonably be linked to an individual or household, as those terms are understood under applicable privacy laws.
4. Information you provide directly
We collect information you choose to provide to Luzora, including:
-
4.1 Account information
Email address, account identifiers, authentication status, password reset requests, and related account information. Passwords are handled by Supabase Auth. We do not intentionally store your raw password in Luzora-owned task or profile tables.
-
4.2 Profile information
Username, avatar emoji, avatar background color, language preference, referral information, username change count, and other profile settings you create or update.
-
4.3 Task and project information
Tasks, task titles, project names, website or app names, folder names, saved links, domains, URLs, favicons, schedules, start dates, one-time dates, recurrence rules, task times, custom dates, paused states, edits, task versions, task completion history, and related task metadata.
-
4.4 Settings and preferences
Notification preferences, daily summary time, snooze duration, shortcut preferences, language settings, local UI state, and other choices you make in the extension.
-
4.5 Newsletter information
Email addresses submitted through Luzora newsletter forms, together with limited submission metadata such as the page URL, referrer, and user agent.
-
4.6 Support and feedback
Information you send to us by email, feedback forms, surveys, social messages, bug reports, screenshots, or other communications, including your email address and the contents of your message.
-
4.7 Deletion requests and feedback
If you request deletion or delete your account, we may collect the deletion reason, optional explanation, deletion timestamp, and related request information. Deletion feedback may be retained in an anonymous or non-account-identifying form.
5. Information collected through browser permissions
Luzora is a browser extension and uses browser permissions to provide its core features. Browser stores may describe these permissions broadly. The descriptions below explain how Luzora uses them.
-
5.1 Active tab
Luzora uses active tab access when you interact with the extension or trigger Luzora Bolt. This helps Luzora detect the current page you are choosing to save or use as a task source.
-
5.2 What Luzora reads from the active tab
Luzora does not request standing access to your tabs and cannot see tabs you are not actively using with Luzora. When you use a current-page feature, Luzora reads the active tab's title, address, and icon where the browser provides them. Luzora also opens saved task links and extension pages in a tab when you ask it to.
-
5.3 Scripting
When you use current-page features, Luzora may run a safe page-inspection script in the active tab. This can read limited page signals such as title, URL, favicon, metadata, headings, visible labels, and common page patterns to suggest a useful task. Luzora does not use this permission to read passwords, payment details, private form values, or hidden sensitive form values.
-
5.4 Storage
Luzora uses browser storage to keep local session data, draft task progress, local task cache, preferences, notification settings, shortcut settings, language settings, avatar settings, toast state, and analytics identifiers.
-
5.5 Alarms and notifications
Luzora uses alarms and notifications to schedule task reminders, daily task summaries, snoozed reminders, badge counts, and test notifications. Browser notifications may display task titles or reminder text on your device screen.
-
5.6 Optional access to websites
Auto Return is the only feature that asks for access to websites, and it is switched off until you turn it on. Luzora does not request this access when you install the extension. It is requested at the moment you enable Auto Return, and it is withdrawn from Luzora when you turn the feature off. Section 7 explains what the access is used for.
6. Luzora Bolt and page inspection
Luzora Bolt helps create a task from the current page. It may use the active tab title, URL, favicon, page metadata, headings, visible labels, and known page patterns to suggest a task. This is intended to reduce manual copying and typing.
Page inspection happens for the page you are actively using with Luzora. Luzora does not use Bolt to build a full browsing history, run background surveillance of every website you visit, or sell web browsing activity. Saved links and page details are stored only when they become part of a task, project, or related Luzora record.
7. Auto Return
Auto Return brings you back to the page a task belongs to when that task falls due. It is switched off unless you turn it on, and turning it off withdraws everything described here.
-
7.1 Why it needs access to websites
To return you to a page, Luzora needs to be able to open that page and to show a short countdown on it. Because a task can point at any website, the permission covers websites generally rather than a list we could fix in advance. Luzora asks for it when you enable Auto Return, not when you install the extension.
-
7.2 What Luzora does with that access
Luzora uses it to open or switch to the page saved on a task, and to display a countdown notice on that page with the task name, so you can go now, cancel, or dismiss it. The countdown notice is rendered in an isolated container so that the content of your task cannot alter the page it appears on.
-
7.3 What Luzora does not do with it
Luzora does not use this access to read the pages you visit, record your browsing history, collect page content, monitor activity in the background, or build a profile of the sites you use. It is used only to open a page you saved and to show the countdown on it.
-
7.4 Returning after your browser has been closed
A browser extension cannot run while the browser is closed, so a return that falls due during that time cannot happen at the moment it was scheduled. When you next open your browser, Luzora may open the pages whose time has already passed that day, up to a small limit, and it will not repeat a return you have already been given or cancelled.
-
7.5 Turning it off
Switching Auto Return off in settings stops the feature and withdraws the website access from Luzora. You can also remove the access at any time through your browser's extension settings.
8. Hive Points, the Manifesto, and referrals
Luzora runs community features on the Luzora website that are separate from the extension. Taking part is voluntary and you can use Luzora without them.
-
8.1 Signing the Manifesto
When you sign the Manifesto we collect your email address, the username you choose, and the time you signed. We send you a verification email, and verifying is what confirms the address belongs to you. Verification is required before most Hive Points can be earned.
-
8.2 Hive Points
Hive Points record activity such as signing the Manifesto, verifying your email, confirming social activity, and referring other people. We keep a record of each award so your balance can be explained and audited. Points are a record of participation and carry no monetary value.
-
8.3 Referrals
If you invite someone with your referral link, we record the connection between your signature and theirs so that the award can be made. This means we hold a record of who invited whom. We use it to award points and to prevent abuse, and we do not sell it or use it to advertise to the people you invite.
-
8.4 What other people can see
Your signer page and the Hive leaderboard are public. Anyone with the link can see your username, your public identifier, your rank, your points, and the people you have referred as shown on that page. Your email address is never shown publicly and is not included in the leaderboard.
There is currently no way to take part in Hive Points while keeping your position off the public leaderboard. If you would prefer not to appear publicly, please do not sign the Manifesto, or contact us to have your signature removed.
-
8.5 Signatures are permanent
Signing the Manifesto is a public act and the signature is permanent. We do not remove signatures, Hive Points, or referral records, and they are not removed by deleting your Luzora account. Your signature, username, rank and points remain visible on your signer page and on the Hive leaderboard.
What you can always do is stop hearing from us. Contact us and we will remove you from the newsletter and from any other correspondence. We will not email you again.
Please take this into account before signing. If you would prefer not to have a permanent public entry, do not sign.
9. Natural-language task entry
Luzora can parse natural-language task text to infer dates, times, recurrence, websites, project names, and related task details. The current natural-language parsing runs locally in the extension bundle. Task text is not sent to an AI provider for parsing in the current product.
If Luzora later adds cloud AI or third-party AI processing, we will update this Policy before using that feature in a way that changes how personal information is processed.
10. Information collected automatically
When you use Luzora, we may collect limited technical and usage information, including:
-
10.1 Device and browser information
Browser type, operating system, extension version, language, approximate device information, and other technical information needed to operate, secure, and troubleshoot Luzora.
-
10.2 Usage metadata
Feature usage, screen views, task count, project count, completion count, last active timestamp, session duration, sync status, first task created timestamp, first completion timestamp, password reset request status, and similar product usage metrics.
-
10.3 Logs and security data
Server logs, request metadata, authentication events, error reports, and security-related records that help us protect users, detect abuse, debug problems, and maintain the service.
-
10.4 Website form metadata
For website forms such as newsletter signup, we may collect the email submitted, page URL, referrer, user agent, and submission timestamp.
11. Product analytics
The Luzora extension uses PostHog for product analytics. Luzora website pages use Google Analytics and Vercel Web Analytics. These services help us understand how features are used, whether sync and reminders are reliable, which website pages people visit, which screens need improvement, and how to make Luzora more useful. Extension activity is not sent to Google Analytics or Vercel Web Analytics.
We design analytics to avoid sending sensitive task content. Our analytics wrapper filters property names and values that look like emails, passwords, tokens, secrets, API keys, private keys, task titles, task links, URLs, folder names, project names, website names, or domains. We may still collect event names, timestamps, extension version, screen names, page paths, feature usage, task counts, completion counts, settings changes, session duration, and sync status.
There is currently no setting to turn product analytics off inside the extension. We would rather say so plainly than imply a choice that does not exist. If analytics matter to you, the filtering described above is what limits them: your task names, links, folders, project names and website addresses are removed before anything is sent, so what we receive describes how the product is used and not what you are using it for.
If you contact us about analytics deletion or privacy choices, we will review your request based on the information available to us and the capabilities of our analytics provider.
12. Cookies and similar technologies
The Luzora website may use cookies, local storage, or similar technologies for site functionality, security, analytics, or preferences. The browser extension also uses browser storage for extension functionality. You can control browser cookies and storage through your browser settings, but disabling storage may affect website or extension features.
13. How we use personal information
We use personal information for the following purposes:
-
13.1 Provide Luzora
Create and manage accounts, authenticate users, sync tasks, save projects, store completion history, process task edits, open saved links, maintain preferences, and deliver the extension features you request.
-
13.2 Operate browser features
Detect the active page when you choose to save it, suggest tasks through Luzora Bolt, store local drafts, show reminders, update badge counts, and open task links.
-
13.3 Communicate with you
Send account-related messages, password reset emails, security notices, account deletion confirmations, support replies, product updates, and newsletter messages where applicable.
-
13.4 Improve the product
Understand product usage, diagnose bugs, improve reliability, develop new features, measure onboarding, analyze aggregate usage, and evaluate user feedback.
-
13.5 Protect Luzora and users
Prevent fraud, abuse, spam, unauthorized access, security incidents, policy violations, or misuse of Luzora and related systems.
-
13.6 Comply with law
Meet legal obligations, respond to lawful requests, enforce our Terms, resolve disputes, preserve records where required, and protect our legal rights.
14. Legal bases for processing
Where laws such as the GDPR or UK GDPR apply, we rely on one or more legal bases to process personal information. These may include performance of a contract when we provide Luzora to you, legitimate interests in operating and improving Luzora, consent where required, compliance with legal obligations, and protection of legal rights or safety.
You may withdraw consent where processing is based on consent. Withdrawing consent does not affect processing that occurred before withdrawal, and some features may no longer work if the information is required to provide them.
15. How we share personal information
We do not sell your task data. We may share personal information in the limited circumstances below:
-
15.1 Current service providers
The current providers that receive Luzora user data are Supabase, PostHog, Google, Vercel, and Resend, as described below. We do not use an unnamed category of providers to receive extension user data. If we add or replace a provider that changes who receives personal information, we will update this Policy before the new sharing begins.
-
15.2 Supabase
Supabase provides authentication, account management, database storage, password reset, Edge Functions, website backend functions, and cross-browser sync. Supabase receives the account, profile, task, project, saved-link, schedule, completion, preference, referral, Manifesto, newsletter, deletion-request, and usage data described in this Policy when the relevant feature is used.
-
15.3 PostHog
PostHog provides analytics for the browser extension. PostHog receives an analytics identifier, the internal Luzora user identifier after login, time zone, event names and timestamps, extension version, screen and feature activity, counts of tasks, projects, folders and completions, session status, sync status, and similar product-use measurements. Luzora filters task titles, links, URLs, website names, domains, folder names, project names, email addresses, passwords, tokens, secrets, API keys, and private keys from analytics event properties.
-
15.4 Google Analytics
Google Analytics provides analytics for Luzora website pages, not extension activity. It receives website page views, page paths, traffic sources, browser information, approximate region, device type, consent state, and basic website usage. We do not send task content, passwords, saved task links, or private form values to Google Analytics.
-
15.5 Vercel Web Analytics
Vercel hosts the Luzora website and provides website analytics. Vercel may receive page views, page paths, referrers, device and browser information, approximate region, request logs, IP-derived network information, and information submitted to Luzora website API routes. We do not send task content, passwords, saved task links, or private form values to Vercel Web Analytics.
-
15.6 Resend
Resend sends Luzora verification, transactional, Manifesto, deletion, newsletter, and subscription-related emails. Resend receives the recipient email address, message content and subject, sending and delivery identifiers, delivery status, subscription topic or audience information, and limited metadata needed to deliver, troubleshoot, suppress, and unsubscribe email. Extension activity and task data are not sent to Resend.
-
15.7 Browser vendors and extension stores
Your browser vendor or extension store may process information related to extension installation, updates, permissions, browser APIs, and store interactions under their own policies.
-
15.8 Favicon and website icon services
Luzora displays favicons supplied by the active browser tab and uses Google's favicon service to generate icons for recognised websites. A Google favicon request contains the requested website domain and can expose ordinary request information such as IP address, browser information, and request time to Google. The request is made only to display the relevant website icon.
-
15.9 Legal, safety, and enforcement
We may disclose information if we believe disclosure is required by law, legal process, regulation, security needs, fraud prevention, protection of users, enforcement of our Terms, or protection of our rights and property.
-
15.10 Business transfers
If Luzora is involved in a merger, acquisition, financing, reorganization, sale of assets, or similar transaction, personal information may be transferred as part of that transaction, subject to appropriate confidentiality and legal safeguards.
16. Third-party links and social pages
Luzora may link to third-party websites and social platforms, including X, Reddit, YouTube, LinkedIn, browser stores, support tools, and other websites. If you click those links, you leave Luzora and the third party's privacy policy applies. We are not responsible for the privacy practices, security, content, or policies of third-party websites.
17. Local browser storage and synced storage
Some information is stored locally in your browser. This may include session cache, profile cache, task cache, unsaved draft progress, preferences, notification settings, language, shortcut settings, avatar settings, analytics identifiers, and reminder delivery state. Local data may be removed if you uninstall the extension, clear browser data, reset the browser profile, or use browser tools that delete extension storage.
Some information is synced to Supabase so you can access your account and task data across supported browsers. Synced data may include profile data, tasks, projects, links, schedules, task versions, completion history, preferences, and usage metadata.
18. Notifications and on-device visibility
Luzora notifications may show task titles, reminder text, or counts of unfinished tasks on your device screen. Anyone with access to your unlocked device or notification center may be able to see those notifications. You can manage notification preferences in Luzora settings and in your browser or operating system settings.
19. Data retention
We keep personal information for as long as reasonably necessary to provide Luzora, operate our business, comply with legal obligations, resolve disputes, enforce agreements, protect users, prevent abuse, and maintain security.
-
19.1 Account and profile data
Kept while your account is active, unless deleted earlier or retained for a limited legal, security, or operational reason.
-
19.2 Task data
Kept until you delete tasks, clear task data, delete your account, or we delete the data according to our retention practices.
-
19.3 Local browser data
Kept in your browser until overwritten, cleared by you, removed by the browser, or removed when the extension is uninstalled.
-
19.4 Analytics and usage data
Kept according to our analytics settings and provider retention periods, unless deleted or anonymized earlier where required or practical. Analytics events never contain task names, links, folder names, project names, or website addresses, because these are removed before anything is sent.
-
19.5 Hive Points, Manifesto and referral records
Kept permanently. Signing the Manifesto is a public act and is not undone by deleting your Luzora account. See section 8.
-
19.6 Records kept after account deletion
Your username, email address and lifetime task totals are kept permanently after your account is deleted, as described in section 21. Your email address is kept so we can suppress future contact and recognise a returning address, not so we can write to you.
-
19.7 Support communications
Kept as long as needed to respond, maintain business records, improve support, and protect legal rights.
-
19.8 Backups and logs
Deletion removes your information from our live systems straight away. Encrypted backups are kept on a rolling basis and may still contain deleted information for up to 90 days, after which the backup containing it is discarded. We do not restore deleted information from backups for ordinary product purposes, and we do not use it after deletion is complete.
20. Clear task data
Luzora may offer a Clear tasks and projects feature. Clear task data removes your tasks, projects, folders, saved task links, task versions, and task completion history from Luzora-managed task tables. Your account, profile, preferences, login, and some usage metadata may remain active.
Clearing task data is different from deleting your account. If you want to delete your account, use the account deletion flow or contact us.
21. Account deletion
Deleting your account is intended to permanently remove your Luzora account, profile, tasks, projects, task versions, and task completion records from Luzora-managed active systems. Account deletion may also remove optional usage rows from Luzora-managed tables where implemented.
We aim to complete verified deletion requests promptly and no later than 30 days after verification. Where additional time is legally permitted because a request is complex or unusually burdensome, we will notify you within the initial 30-day period and explain the reason for the additional time.
Deletion removes your account, profile, tasks, projects, folders, saved links, task versions, completion history, your daily consistency record, and any reminders queued to be sent to you. After removing them, Luzora checks that nothing belonging to you is left behind. If anything remains, the deletion is stopped and reported to us rather than being reported to you as complete.
Some information is kept after deletion, on purpose. We keep your username, your email address, and the totals of how many tasks you created, completed and deleted. We keep these permanently. They let us count what Luzora has been used for over its lifetime without those totals changing when someone leaves, and they let us recognise the address if it returns. Your email address is kept in a suppression list so that we do not write to you again.
Deleting your account also forfeits your place on the Luzora extension leaderboard. Rankings are built from active accounts only, so a deleted account no longer appears.
Your Manifesto signature, Hive Points and referral records are separate and are not affected by deleting your Luzora account. Section 8 explains that those are permanent.
We may also retain limited information where reasonably necessary for security, fraud prevention, legal compliance, dispute resolution, system integrity, backup retention, or anonymous product feedback. For example, anonymous deletion reasons may remain after your account is deleted, and they are stored without any link to you.
Analytics events already collected are not removed from our analytics provider when you delete your account. Those events describe how the product was used and never contain your task names, links, folders, project names or website addresses.
You can request deletion through the extension where available or through the data deletion page linked from this website. If you cannot access your account, contact us at hello@luzora.app.
22. Your privacy choices and rights
Depending on where you live, you may have rights to access, correct, delete, export, restrict, object to, or withdraw consent for certain processing of your personal information. You may also have the right to complain to a data protection authority.
You can exercise many choices directly in Luzora by updating your profile, changing notification settings, clearing task data, deleting tasks, logging out, or deleting your account. You can also contact us at hello@luzora.app.
We may need to verify your identity before fulfilling certain requests. We may decline or limit requests where permitted by law, including where a request is fraudulent, harmful to others, technically impossible, conflicts with legal obligations, or affects rights and freedoms of others.
23. Security
We use reasonable technical and organizational measures designed to protect personal information. These measures may include Supabase Auth, row level security for user-owned data, HTTPS, access controls, service-role key restrictions, password reset flows, current-password checks for sensitive account actions, analytics filtering, and safe page-inspection design.
No method of transmission or storage is completely secure. We cannot guarantee that Luzora or any third-party provider will be free from unauthorized access, misuse, data loss, vulnerabilities, or interruptions. You are responsible for keeping your account credentials secure and for using a trusted device and browser.
24. International transfers
Luzora and our service providers may process information in countries other than where you live. These countries may have privacy laws that differ from your location. Where required, we rely on appropriate safeguards, contractual protections, service provider terms, or other legal mechanisms for cross-border processing.
25. Children
Luzora is not intended for children under 16. We do not knowingly collect personal information from children under 16. If you believe a child under 16 has provided personal information to Luzora, contact us at hello@luzora.app and we will take appropriate steps to delete it.
26. Do not track
Some browsers offer "Do Not Track" signals. There is no consistent industry standard for responding to those signals, so Luzora does not currently respond to them. You can use browser settings, extension settings, and account controls to manage certain data choices.
27. Changes to this Policy
We may update this Policy from time to time. When we make changes, we will update the "Last updated" date. If changes are material, we may provide additional notice through the website, extension, email, or other appropriate means. Your continued use of Luzora after an updated Policy becomes effective means you acknowledge the updated Policy.
28. Contact us
If you have questions, requests, or concerns about this Policy or Luzora privacy practices, contact us at hello@luzora.app.