Who can see your information?
The public waitlist collects an email address. In the product preview, each adult has private chats and chooses which records to share with the household.
Waitlist email addresses
If you join, we store your email address and signup date in a private Cloudflare database. The Lumstead team uses your address to contact you about access. Other visitors cannot see it.
To remove your address, use the browser you signed up with. It holds a private receipt for your latest new signup. If you no longer have that receipt, you can reply to the invitation to request removal.
Your signup was removed.
This browser has no active signup receipt. Use the browser you first signed up with.
Private and shared are separate.
Chats belong to the person who creates them. Personal health and wellness records stay in that person’s space unless a supported sharing control is used. Notes can be private or shared. Shared household records, such as film history and finances, are available to authorized family members.
A household owner can manage membership, connections, and shared settings. That role does not by itself grant access to another adult’s private conversations. Review the visibility shown beside a record before you save it.
Storage and AI processing are different choices.
When you self-host, the application stores records on your Mac. Hosted installations store application records on the service’s infrastructure. In either case, a remote model provider receives the conversation and the selected information needed to answer your request. A provider API key is kept on the server and is not included in the model’s tool input.
Choose a local model endpoint if you want inference to run on your own network. Model providers can have different retention, training, logging, and region policies. Read their current terms before you send sensitive information.
Which changes need my approval?
You can give the assistant standing permission to update selected records, such as tasks and meal plans. Outside that scope it needs approval for supported changes. It checks your current access before acting. Device command receipts report what the software sent; they do not prove that a physical device changed state.
Inspect, export, and remove access.
Use the privacy controls in your family space to export the records visible to you. Review signed-in devices and revoke a device you no longer use. A revoked device must be paired again. Keep exported files and server backups on protected storage; a full server backup can contain all family records and secrets.
Personalization is explicit. Review your saved profile and instructions. Do not place another person’s sensitive information in shared instructions without their agreement.
What can I share today?
The public site accepts waitlist signups. Keep family records, account credentials, and health information out of the form.