Lurix AI Privacy Policy

Last updated: October 11, 2026

This Privacy Policy explains how the Lurix AI Android application ("Lurix AI," the "app," "we," or "us") processes personal data and user content. Contact lurix.support@gmail.com for privacy questions or data-protection requests.

1. Information we process

Depending on the features you use, we may process:

• Account data: your email address, stable Google account identifier, and authentication token when you sign in with Google. A name or profile information displayed in the app may be obtained from your Google session on the device.
• Device and security data: an app-specific one-way hashed device identifier, random installation identifier, session identifier and expiry, device model and brand, Android and app versions, device language, approximate country, and Google Play Integrity result.
• Account and usage data: your plan, point balance, per-feature request and point totals, last request time, rewarded-ad time and transaction identifier, and account or device restrictions.
• Gift-code data: We process the code you submit to verify it. Records may include account-linked attempt counts and first/last attempt times; a successful redemption's identifier, time, code type, points awarded, and resulting balance; and one-way code and account digests. Your attempt allowance and information needed to safely retry an unfinished request may also be cached on your device. One-way account digests are pseudonymous data, not anonymous data.
• Purchase data: Google Play product and purchase tokens, subscription state, renewal, and entitlement information. Lurix AI does not receive your full payment-card details; Google Play processes payments.
• Content you submit for processing: translation text, questions, speech-recognition transcripts, selected on-screen text or images, uploaded or cropped images, and search queries created when an internet search is performed.
• Support and rights requests: the contact address, request, optional attachments, and information needed to verify an account or purchase that you submit to us. Do not include passwords, full payment-card details, or unnecessary third-party personal data in a support request.
• Local app data: language, theme, target-language and feature preferences; if history is enabled, question and translation history and temporary image cache stored on your device.
• Technical and transaction records: account-linked request time, feature, outcome, latency, points used, input/output token counts, search counts, and error codes; point-balance changes and reasons; and the time, outcome, and before/after state of administrator actions involving plans, points, accounts, or devices. These records are not anonymous. These monitoring tables do not store prompts, answers, translation text, images, passwords, or raw purchase tokens. Infrastructure providers may process IP addresses and similar connection data in their own logs.

2. Why we use information

We use information to:

• sign you in, protect your account, and enforce the one-device session rule;
• provide translation, speech, OCR, image question, quick question, and eligible live web-search features;
• calculate points and verify plan entitlements, gift codes, rewarded ads, and subscriptions;
• prevent fraudulent accounts, reward replay, unauthorized clients, abuse, and security incidents;
• diagnose errors and keep the service safe and reliable; and
• comply with law and respond to user requests.

Depending on applicable law, our legal bases may include performing our agreement with you, your consent or permission, our legitimate interests in operating and securing the service, and compliance with legal obligations. Disabling a permission may prevent the related feature from working.

3. Accessibility service

Lurix AI uses the Android Accessibility service for message translation and assistant tools. When message translation is enabled in your selected apps, keyboard and editable-message-field positions may be detected on your device to display the tools. When you initiate translation or an assistant action, access may be used to:

• read text you selected or text in the active message field;
• process the screen area you selected; and
• insert translated text into a message field.

The app does not send messages automatically. You review the text and recipient and initiate sending yourself. Accessibility access is not used for ad targeting, collecting passwords, contacts, or app-usage history, and it does not continuously record your screen. Content you choose for translation or analysis is transmitted to Lurix AI servers and the relevant AI service provider to fulfill your request. You can disable the permission at any time in Android settings.

4. Microphone, speech recognition, and OCR

• When you start a voice feature, microphone permission is used. Audio may also be processed on remote servers by the speech-recognition service selected on your Android device, which may be provided by Google or your device manufacturer. That provider's retention and processing rules apply; offline recognition is not guaranteed on every device. Lurix AI sends the recognized text, rather than the audio recording itself, to its server. Android speech-recognition documentation.
• OCR is performed where possible by on-device ML Kit or Tesseract components. ML Kit does not send OCR input images/text or results to Google servers, but may contact Google for API performance/usage metrics and model updates. Tesseract is not a remote API service in this use. Sending recognized text or a selected image to the Lurix AI server for translation or an image answer is a separate operation. Details: ML Kit Terms & Privacy.
• Lurix AI does not continuously listen to your microphone or record your screen in the background without you starting a feature.

5. Artificial intelligence and internet search

Translation and question content is sent to our AI provider to generate a response. Lurix AI does not retain prompts, answers, or translation text as permanent content in its account database. Optional on-device history, account and technical records, and provider records are different data categories.

5.1. OpenAI

We use the OpenAI API for translation and assistant responses. OpenAI states that API content is not used to train its models by default unless the customer explicitly opts in. Text, selected images, and context needed for your request are sent to OpenAI.

Our requests use `store: false` and do not create saved OpenAI conversations or use background processing. This does not mean zero data retention: OpenAI's default abuse-monitoring logs may contain request and response content and are retained for up to 30 days, unless a longer period is required by law or reasonably necessary to protect its services or a third party from harm. Images flagged by safety screening may be retained for manual review. Usage and other operational metadata may be processed separately. We do not promise Zero Data Retention. Details: OpenAI API data controls.

5.2. SerpBase and internet search

For supported text questions permitted by your plan, search queries, language/country context, and technical request information may be sent to SerpBase. Retrieved sources may be sent to the AI. SerpBase may retain queries in operational logs and transmit them to upstream search/infrastructure providers to perform searches. Its policy does not specify one fixed retention period or a customer-configurable zero-retention option. Details: SerpBase Privacy Policy.

AI output may be inaccurate or incomplete. Do not rely on it as the sole basis for medical, legal, financial, safety-critical, or other high-impact decisions.

Text, images, or speech transcripts you submit may include health, financial, or other sensitive information. Avoid submitting unnecessary sensitive information or other people's personal data. This content may be transmitted to the providers described above to fulfill the action you choose; the on-device history, provider retention, and deletion rules also apply to it. Lurix AI does not provide a separate medical-record or investment-portfolio record service. The scope and limits of health and financial answers are explained in section 3 of the Terms of Service.

6. Advertising and subscriptions

If you choose to earn free points, Google AdMob may display a rewarded ad. Where required, advertising consent and personalization choices are managed through Google User Messaging Platform. Google may process IP addresses and derived approximate location, device/advertising identifiers, ad and app interactions, and performance/diagnostic data for advertising, analytics, and fraud prevention under its own policies. Details: AdMob data disclosure and Google Privacy Policy.

Subscriptions are purchased through Google Play Billing. Lurix AI verifies subscription authenticity and status through Google Play APIs; we do not receive or store full payment-card details.

6.1. Meta ad measurement

After you accept the Terms and Privacy Policy and successfully sign in, Lurix AI starts the Meta Android SDK to measure installations, app openings and advertising effectiveness. Returning users with an existing signed-in account also use this measurement unless they have turned it off. The SDK sends installation and app-opening events, app/device information, an app-instance identifier and, when available, your advertising identifier to Meta. Meta also receives network information such as your IP address and may process this data for measurement and advertising under its own privacy policy. We do not attach your Lurix email, Google sign-in credentials, messages, translation text or images to these events. Automatic purchase logging and automatic advanced matching are disabled. We do not send a separate Google sign-in event or an uninstall event.

There is no separate Meta registration or permission dialog. Provider retention, processing and rights are described in the Meta Privacy Policy. For data-processing questions and rights requests, you can also contact us using the details in this policy. Google AdMob/UMP advertising choices are managed separately, and no Facebook sign-in is required.

7. Who receives information

Information may be shared as needed to provide and secure the service, comply with law, or measure advertising as described in section 6.1:

• Cloudflare: API, network-security, and database infrastructure; processes content passing through the server and stored account/transaction records to provide the service. Network/security data and subprocessor/legal disclosures are governed by its policy — https://www.cloudflare.com/privacypolicy/
• OpenAI: translation/question text, selected images when needed, and context required to generate responses; content and retention conditions are described in section 5.1 — https://developers.openai.com/api/docs/guides/your-data
• SerpBase: search query, language/country context, and technical request information only when internet search is needed — https://serpbase.dev/privacy
• Google: Google Sign-In, Google Play Billing, Play Integrity, AdMob/UMP, Android speech recognition, and ML Kit — https://policies.google.com/privacy
• Meta: installation and app-opening measurement described in section 6.1 — https://www.facebook.com/privacy/policy/
• Tesseract OCR: an open-source on-device OCR component that does not itself transmit content to a remote service.

We do not sell personal data. We may disclose information to competent authorities when legally required or to a successor in a merger or acquisition subject to appropriate confidentiality and security safeguards.

8. International transfers

Our providers may operate infrastructure in multiple countries. Your data may therefore be processed outside your country under the provider's privacy policy and applicable data-protection rules.

9. Retention and deletion

• Account, plan, point, and usage-counter data is kept while your account is active or as needed to provide the service.
• Local history and settings remain on your device until you delete them, clear app data, or uninstall the app.
• The History page is an optional on-device record, not a cloud-synced conversation archive. Deleting an entry removes its locally saved text and associated history image; clearing history removes all saved history entries and their associated images. Turning history recording off stops new entries but does not delete existing ones. Lurix AI excludes this local app data from Android's automatic cloud backup and device-transfer backup. Local deletion does not delete content or technical records already processed by providers under section 5, or account/transaction records subject to the separate retention rules below. We do not promise forensic secure erasure from the device's physical storage.
• Lurix AI does not retain question, answer, or translation content as permanent chat history in its account database.
• The primary user record is deleted 15 days after an account-deletion request. A one-way device record used to prevent repeated sign-up rewards and abuse, verified ad transaction records, security records, and transaction records required by law may be retained for as long as necessary for those purposes. Purchase-ownership and usage-allocation records are retained indefinitely to prevent purchase reuse and repeated grants for the same subscription period, including after account deletion. They contain one-way account/purchase digests and the allocation limit, remaining points, renewal date, and update time; they do not contain an email address or raw account identifier or purchase token. These are pseudonymous security records, not anonymous data.
• Error logs and point-reservation records are subject to 30-day cleanup; verified rewarded-ad transaction records are subject to 90-day cleanup.
• Account-linked request metrics, point movements, and administrator action history are subject to 90-day cleanup. When the primary user record is deleted, associated request metrics and point movements are deleted; email-targeted administrator records have their target and before/after state removed. Device-targeted or other separate security records follow their own retention rules.
• Gift-code attempt records are subject to cleanup 7 days after the last attempt; successful redemption records are subject to cleanup 90 days after redemption. Account deletion removes the email association from these records; one-way account/code digests and related transaction information may remain until those retention periods expire to prevent bypassing attempt limits and repeated reward grants. Plan entitlements and point balances follow the separate retention rules for account data.
• Cleanup runs through scheduled jobs; there may be a delay between reaching the retention limit and execution. Legally required records may need different retention periods.
• Providers' content, log, and backup retention is governed by their terms and policies; OpenAI and SerpBase details are explained in section 5.
• Support correspondence and verification documents are retained only as long as necessary to resolve the request, protect security, and meet applicable legal obligations. If a legal dispute or mandatory retention requirement applies, only the records needed for that purpose are retained.

9.1. Permanent service closure

Closure does not mean that personal data will be sold or retained indefinitely. Records needed for refunds, account requests, security, or legal obligations are kept only for the relevant purpose and legal period; data no longer needed is deleted or anonymized. Data contained in backups is removed according to the existing backup retention cycle and legal requirements. If a backup is restored, previously verified deletion requests are reapplied. Deletion of on-device history and third-party provider records follows separate processes.

10. Deleting your account and data

Use Profile > Delete My Account in the app. After confirmation, you are signed out and a 15-day deletion period begins. Signing in again with the same Google account before that period expires cancels the deletion request and resets the timer. You can also request account and associated-data deletion by emailing lurix.support@gmail.com. Use the subject Lurix AI Account Deletion and identify the Google email address associated with your Lurix AI account. We may need to verify that the account belongs to you. Do not send passwords or full payment-card details. This option is available even if you cannot access or no longer have the app.

When deletion is completed, the primary account record, plan and point data, and associated request metrics and point movements are deleted. Data that may be retained, the reasons, and retention periods are described in section 9. On-device history follows the separate local-deletion process described there.

Deleting the account does not automatically cancel a Google Play subscription. You must separately cancel it in Google Play under Payments & subscriptions > Subscriptions.

11. Security

We use HTTPS in transit and server-side verification for sessions, account-device binding, Google identity, purchases, ad rewards, and Play Integrity results. The device identifier is transformed into an app-specific hash before transmission. No security method is perfect, so absolute security cannot be guaranteed.

11.1. Security incidents and notification

When we learn of unauthorized access, data loss, or another security incident, we assess its scope and impact, take appropriate containment and remediation measures, and keep necessary incident records. Where required by applicable data protection law, we notify competent authorities and affected individuals within the periods and by the methods required by that law. Not every service interruption is itself this type of personal data breach. To the extent known, the notification explains the nature of the incident, affected data categories, possible consequences, measures taken, and steps the user can take.

11.2. Data loss, recovery, and deletion requests

If a technical error or unauthorized action prevents access to your account or data, you may request review through our contact address. We verify account ownership, available technical records, and Google Play purchase information where needed; recovery options are assessed case by case. Complete recovery or a particular recovery time is not guaranteed. A properly completed account deletion is different from accidental data loss; recovery procedures do not reverse a verified deletion request.

Access to data during security or recovery work is limited to the necessary people and purposes. Using infrastructure providers does not remove our statutory data-security or notification duties. The absence of an absolute security guarantee does not limit your statutory rights or remedies for unlawful data processing.

12. Your rights

Depending on the data-protection law where you live, you may have rights to access, learn the source and purpose of, correct, delete, restrict, object to, or obtain a portable copy of your data, withdraw consent, and complain to a competent data-protection authority.

Send requests to lurix.support@gmail.com. We may verify your identity to protect your account.

13. Children's privacy

Lurix AI is only for users aged 13 or older. Users under 18 must use the service with permission from a parent or legal guardian. If a higher minimum age applies to digital services where you live, that higher age applies. Contact us if you believe we processed data from a child under 13.

14. Automated security decisions and appeals

Account or device access may be temporarily or permanently restricted through automated rules and administrator review when fraud, reward replay, an unauthorized client, or service abuse is detected. If you believe a decision is incorrect, request review at lurix.support@gmail.com.

15. Changes

We may update this policy when the service, providers, or legal requirements change. Material changes will be announced in the app or by another appropriate method, and the date above will be updated.