Privacy policy

This is a translation. The Czech version is legally binding.

This policy explains what personal data we process when you use the Lussi Voice app, a Lussi account, the voice assistant Lussi and lussivoice.com, why we do it and what rights you have.

Effective from 12 November 2026.

1. Who is responsible

The controller of personal data is everything 2 human s.r.o., company ID 03382435, registered office Světova 523/1, Libeň, 180 00 Prague 8, Czech Republic, entered in the Commercial Register kept by the Municipal Court in Prague, section C, file 230961 (“we”).

Send questions about personal data to info@lussivoice.com. We have not appointed a data protection officer.

2. How the service works

• Your home: the Lussi Voice hub and the voice devices in your home. They control the lights, music, heating and other devices and process commands for Lussi. At home the app connects to them directly and encrypted.
• Lussi cloud: our service at api.lussivoice.com. It holds accounts, households and invitations, grants access to the home and, away from home, relays the connection between the app and the home.
• The Lussi Voice app on a phone or computer.

Commands, settings and the state of the home are processed by the hub in your household. We access the hub only when the administrator of your household approves it in the app (service access for a limited time).

3. The sample home and Lussi Demo

The sample home (the Try the sample home option on the Lussi Voice start screen) and the Lussi Demo app from the website work without an account and without a real home. They collect no personal data and send nothing to the internet. Everything you change in the demo stays on the device only and is erased with “Reset demo”, “End demo” or by uninstalling.

4. What data we process and why

Lussi account

• The account holds your email address, the account identifier and the app language, in which the email with the code arrives. It is used to sign in without a password, with a code from an email or a passkey, and to manage the account.
• For a passkey we store its public part, the name of its provider, the date it was added and the date it was last used.
• The sign-in code is sent by email through Amazon SES (Frankfurt, eu-central-1).

Devices

• We store the name of the phone or computer from its settings (it may include a first name), the platform, the device's public keys and the device identifier.
• This is used to verify that it is your device talking to the home, and to revoke the device after you sign out.

Household

• We store the members' names (entered by the administrator when inviting them), roles (administrator, adult, child, guest), the rooms a member may use, when a guest's access ends, and invitations.
• This makes clear who belongs to the household and what they may control.

Event log in Lussi cloud

• To secure the account and the home and to investigate misuse, only metadata is recorded: the time, the kind of event (for example a sign-in, a new key, an invitation), the account, the member, the device, the result, where from (at home, remotely), the country and the IP address shortened to /24.
• The text of commands, recordings and device states are not recorded. The operational logs of Lussi cloud contain no IP addresses.

Connection to the home while away

• Away from home, Lussi cloud relays commands, the state of the home, chats with Lussi, voice commands, music, files to print and other content between the app and the home.
• The content is not stored; it is held in memory only while it is relayed. The connections to and from the cloud are encrypted, but there is no end-to-end encryption between the app and the home.
• Away from home, the test version of the app in the pilot household connects to the home server over an encrypted connection through Home Assistant Cloud from Nabu Casa.

Phone notifications

• Notifications from the home are delivered to Android phones by Google's Firebase Cloud Messaging, even when the app is not running.
• For this it uses the Firebase token, the installation identifier, the phone's name and the app version. The content of the notification also passes through Firebase.

Crash reports

• When the app crashes, it sends a report through your home with the version, variant, thread and a technical trace, without error texts, names, rooms, addresses or tokens. It is used to fix bugs and is tracked on GitHub.
• You can turn the reports off in Settings → Privacy (“Send crash reports”). A guest sends no reports.

The Lussi voice assistant

• Lussi listens only once she is addressed. Until then no sound leaves the household.
• After the wake word, speech, as well as a voice command from the app, is turned into text by Soniox in the EU. The app does not store the sound and does not send it to Google for recognition.
• Sound is not normally recorded. Only when the administrator turns on debugging are recordings stored temporarily on the hub, and they are deleted after 7 days.
• The text of a request is processed by the AI Claude from Anthropic so that Lussi understands and answers. Only what is needed for the answer is sent. Under its terms, Anthropic does not use API data to train models.
• The text of the answer is turned into speech through Lussi cloud by Microsoft Azure Speech in the EU (regions Germany West Central and Sweden Central).
• In the pilot household, Lussi's voice is also provided by Home Assistant Cloud from Nabu Casa via Microsoft Azure. Nabu Casa therefore also processes the text of the answers.
• Only what is needed to handle a particular request leaves the household.
• The microphone can be switched off at any time with the switch on the voice satellite.

Reporting a Lussi answer

• When you report a Lussi answer as inappropriate in the app, the app sends a report to Lussi cloud. A report is only ever created by this step in the app, never on its own.
• A report contains the text of the question (at most 2,000 characters) and the text of Lussi's answer (at most 4,000 characters), the reason (offensive, dangerous, untrue, unsuitable for children, other), an optional comment (at most 500 characters), the language of the conversation, the app version and the time of the answer.
• A report carries the identifiers of the account, member, household and device it came from, not an email address or a name. The question, the answer and the comment may still contain personal data mentioned in them, such as names or room names.
• Reports are used to assess the reported answer and improve Lussi, to protect against harmful content, especially for children, and to meet Google Play's requirement for apps with generative artificial intelligence.
• A report is stored in Lussi cloud with Cloudflare in the EU jurisdiction (D1 database). For every report we receive an email with its text, sent by Amazon SES (Frankfurt, eu-central-1). The mailbox the email arrives in may not be in the EU.
• Operational logs record only the report's identifier, the reason and the time, never the text.
• Only we have access to reports. We pass them on to no one else and do not use them to train artificial intelligence models.

Data in the home

These data are processed by the hub in your home, not by Lussi cloud:

• commands, chats with Lussi and voice commands from the microphone;
• messages between household members (the home keeps them for 7 days), the shopping list, scenes and renamed devices;
• documents and photos you send with “Send to Lussi”, to print or to the TV, and the events from them you add to the home's calendar;
• the sign-in to the home's music service (entered only by the administrator and sent only to the home);
• the home security log: who controlled the gate, locks and alarm, when and from where (kept for 90 days).

Google Calendar

• When a household connects its family Google Calendar, the home server reads and writes its events so that Lussi can say what is planned and add an event by voice. From the Google account we use Google Calendar only, nothing else.
• The access key to the calendar is stored on the home server. When you ask about an event, its text may be part of the request Claude processes.
• Calendar data is not used for advertising, not sold and not used to train artificial intelligence models.
• Lussi Voice's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
• Access can be removed at any time in the Google account settings or by disconnecting the calendar in the household.

School timetable

• When a household connects the school timetable, the home server only reads timetable changes and school events from the Edookit school system.
• The data stays on the home server. When you ask about the timetable, its text may be part of the request Claude processes.
• The school timetable can be disconnected at any time.

Music and lyrics

• Only in a version of the app that offers lyrics (not yet the version from the stores): when you open the lyrics of a song in the player, the app asks the public service LRCLIB (lrclib.net) for them with the artist, title and length of the track. It sends nothing else about you or the phone.
• When you tap “Play on phone”, the app hands the track to the Spotify or YouTube Music app on the phone. From then on, that service's policy applies.
• Internet radio on the phone plays straight from the station's server, which sees your IP address.

The lussivoice.com website

• The home page, the demo and several other pages of the website are public, and anyone can view them without signing in and without a cookie. The other pages are by invitation only.
• After you enter with a personal invitation, the browser stores one strictly necessary cookie that keeps the session for at most 30 days. It holds no name and no e-mail address.
• For a personal invitation we keep only its identifier, when it was used and on how many devices. We store no name or email address with the invitation, except the contact you give in the questionnaire for a test home.
• The site uses no analytics or advertising cookies and keeps no log of individual visits.
• Technical data needed to deliver a page and to protect against attacks, such as the IP address, is processed by Cloudflare, whose network the site runs on.
• The website itself does not store IP addresses. Only for a questionnaire sent without an invitation does it compute a fingerprint from the address against misuse, as described in the section Test house questionnaire.
• Your choice of language, a collapsed menu and a muted voice in the demo are stored only in your browser.
• The apps available for download from lussivoice.com are stored in Cloudflare R2 in the EU.

Test house questionnaire

• Anyone considering Lussi at home can fill in the questionnaire about the house and its technology, with a personal invitation or without one. The answers are used only to work out what the house will need and what it will cost, to get back to you with a tailored proposal and to prepare the visit and the connection of Lussi.
• We store the answers, a contact for arranging the visit (name and email or phone), the language and the time of sending. The number of adults and children who will use Lussi is optional and without names.
• For a questionnaire sent with an invitation, they include the invitation's identifier. For one sent without an invitation, a random identifier and a note that the questionnaire came from the public website.
• The answers are stored with Cloudflare, on whose network the website runs, and only the controller can access them. Operational logs record only the identifier and the time of sending, never the content of the answers.
• Protection against misuse for a questionnaire sent without an invitation: a keyed fingerprint (HMAC-SHA-256) is computed from the sender's IP address and stored with Cloudflare for at most 24 hours, so that at most three questionnaires a day can be sent from one address. The IP address itself is not stored.
• For a questionnaire sent with an invitation, the controller gets a notification on their phone with only the invitation's description and the time, and an email with only the invitation's identifier and a link, without the answers.
• For a questionnaire sent without an invitation, the controller gets only a notification on their phone with the random identifier and the time. No email and no draft proposal is made from it; the controller prepares the proposal by hand.
• Before sending, you tick that you know this policy. By filling in and sending the questionnaire you ask for a tailored proposal; the legal basis is described in section 5.
• Unfinished answers stay only in your browser until you send them.

The demo on lussivoice.com

• The demo is a simulation with no connection to any real household.
• The prepared requests are handled right in your browser and sent nowhere.
• A free command the demo does not know is processed by Claude, the artificial intelligence from Anthropic. The site stores neither the command nor the answer; it keeps only daily counts of commands and costs.
• The public demo plays only the prepared requests. The field for a free command and the microphone are in the demo for invited visitors only.
• The microphone turns on only when you press the button, and your browser asks for your consent first. The sound goes from your browser directly to Soniox in the EU, which turns it into text. The site neither receives nor stores the sound; for an invitation it keeps only the number of recordings per day. According to Soniox's documentation, real-time transcription is not stored.

E-mail

• When you write to info@lussivoice.com, we process the message and your contact details so that we can reply.

What we do not do

We show no ads, sell no data, do not track you across apps and websites, do not determine the phone's location (the app does not ask for it) and do not read the contacts, calendar or messages on the phone.

5. Legal basis

• Performance of a contract and steps before entering into one (Art. 6(1)(b) GDPR): the account, devices, household, connection to the home, notifications, Lussi's voice, access by invitation, the questionnaire for a test home with or without an invitation (by filling it in you ask for a tailored proposal) and replies to emails.
• Legitimate interest (Art. 6(1)(f) GDPR): the security of the website, the account and the home, including the event log, the address fingerprint against misuse of the questionnaire without an invitation, assessing reported Lussi answers and protecting against harmful content, and fixing bugs from crash reports. You object to crash reports by turning them off in the app.
• Consent (Art. 6(1)(a) GDPR): connecting Google Calendar and the school timetable. Consent can be withdrawn at any time, also by disconnecting.

6. Who receives the data

The data is processed by these processors under the data processing terms each provider offers:

Other recipients only on your instruction or by law: Google Play and Microsoft Store process download and purchase data under their own policies, the services in Music and lyrics receive only what is described there, and public authorities only what the law requires of us.

7. Transfers outside the European Union

• The data of Lussi cloud (D1, Durable Objects and R2) is stored with Cloudflare in the EU jurisdiction. A request is, however, handled by the nearest Cloudflare data centre, so when used outside the EU it may also pass outside the EU.
• Soniox processes data in the EU and does not transfer it outside the EU.
• The other processors (Cloudflare, Anthropic, Microsoft, Amazon Web Services, Google, Nabu Casa and GitHub) are companies from the United States or affiliated with them. If data leaves the EU, this happens on the basis of a European Commission adequacy decision (the EU–US Data Privacy Framework) or standard contractual clauses.

8. How long we keep data

9. How we protect data

• All connections are encrypted (HTTPS and WSS). At home the app accepts only a hub certificate whose fingerprint it knows from Lussi cloud.
• Signing in needs no password. Device keys are created in the secure storage of the phone (Android Keystore) or the computer (Windows key storage) and cannot be exported from it. Sign-ins and tokens are stored encrypted.
• You confirm opening the gate, unlocking and disarming the alarm with your fingerprint or face. The alarm panel's code is never stored.
• You can lock the app with your fingerprint or face (App lock).
• Tokens, passwords and the content of documents are never written to the app's logs or to crash reports.

10. Children

The app is meant for households and the account is managed by an adult. The household administrator can invite a child in the child role: the child then controls only their own room and does not see the home's security, scenes for the whole home or the shopping list. About a child we process the name entered by the administrator, the rooms and the email address the child signs in with. A child under 15 may use the account only with a parent's consent; that consent is given by the administrator who invites the child.

11. Your rights

You have the right:

• to access your data and get a copy of it;
• to have inaccurate data corrected;
• to erasure (“to be forgotten”);
• to restrict processing;
• to the portability of data you provide to us;
• to object to processing based on legitimate interest (you turn crash reports off right in the app);
• to withdraw consent, also by disconnecting Google Calendar or the school timetable.

Send your request to info@lussivoice.com. We reply within one month at the latest.

A complaint can be made to the Czech Office for Personal Data Protection, Pplk. Sochora 27, 170 00 Prague 7, Czech Republic.

12. Account deletion

• Signing out in the app deletes the sign-in and the keys on the device and revokes the device in Lussi cloud. The account, however, remains.
• Deleting the account right in the app (Settings → Account → Delete account) is still being prepared. Once it is in the app, the account will be deleted at once after a fresh check with your fingerprint, face or passkey, and a confirmation will be sent to the account's email address.
• Without the app, ask for deletion by email to info@lussivoice.com from the address you sign in with. The steps are on the page Account deletion. The operator handles the request without undue delay, at the latest within 30 days of verification.
• The sign-in details (email address, link to Google), passkeys, devices, household memberships, invitations and reported Lussi answers are deleted.
• The last administrator of a household first hands the role to another member, or asks for the household to be deleted too. The household is then deleted together with the profiles of children without their own account, and the hub is disconnected.
• The household's event log stays without personal data: the deleted account appears in it only as “former member”, and the log is kept for 12 months.
• The personal data of a deleted account disappears from the Lussi cloud backups (Cloudflare, EU) within 30 days at the latest.
• Data in the home (messages, documents, gallery, security log) is on the household's hub. The household administrator decides about it, and Lussi cloud does not delete it.
• The passkey stays in the phone's password manager. It can no longer be used to sign in, and you can delete it in the password manager.

13. Changes to this policy

We may change this policy when the app or the law changes. We publish the new version on this page with its effective date and announce significant changes in the app. The Czech version is decisive.

14. Contact

everything 2 human s.r.o., Světova 523/1, Libeň, 180 00 Prague 8, Czech Republic, info@lussivoice.com