Privacy Policy

1Who we are and what this covers

Light-Lux is a meeting notes service operated by Your Roster, Inc., a Washington corporation ("we", "us"). This policy covers light-lux.com, the Light-Lux web app, the phone app you add to your home screen, and, once they're released, the Light-Lux Mac app and browser extension (together, the "Service").

It explains what we collect, why, who processes it, how long we keep it and the choices you have. It has a part for teams and companies and a part for government accounts; everything else applies to everyone.

2Information we collect

We collect only what the Service needs to work.

• Account. Your name, email address and profile picture from Google or Microsoft when you sign in (from Apple, your name and email address, or the private relay address Apple forwards to you; or your email address, if you sign in with an emailed code), a profile photo if you add one, and the role, job title, time zone and team you give us. Your photo shows beside your name to your team and to people whose meetings you're invited to. We also record how you signed up, when you sign in and last used Light-Lux, and how many times you use features such as Ask. If you add the Light-Lux browser extension, we record its version, which browser it's in and when it was last seen, and if you remove it, when, and the reason you pick if you pick one.
• Calendar (only if you allow it). Read-only access to your upcoming events: title, start and end time, attendees, join link and description, or the events in a calendar link you add. We never create, change or delete anything in your calendar.
• Meeting content. The notes you type, the transcript of what was said, the minutes Light-Lux writes, the template used, the actions and who owns them, sharing settings, and the people invited.
• Audio. While you record, your microphone, on supported devices your computer's sound, stream live to our transcription provider and are turned into text. If you import a call recording (for example one made with your iPhone's call recording), the file goes to our transcription provider the same way. For team accounts (never government accounts), we keep a temporary copy of the audio of a live recording for one hour after its last sound, for backup only, so a recording that was cut short can be recovered. It is deleted automatically after the hour. It is not a recording we keep: it isn't used for playback, training, analytics, sharing or licensing. Only you can download it while it is held, and when several recordings of the same conversation were made at once we keep only the longest. Imported call recordings aren't held.
• Questions you ask. Questions to Ask and Hover are sent with the relevant meetings to our AI provider to write the answer. We keep each question and its answer, with the names and dates of the meetings it cites, as a thread only you can see, so you can come back to it, follow up and update it. An answer can quote meetings you could read when you asked. Saved questions you set to run each week run on their own and their answers are added to the thread and your Monday email. With Hover, a picture of the window in front of you is sent with the question and isn't stored.
• Scanned notes. When you scan photos of written notes into a note in the web app, the photos are sent to our AI provider to read the writing and aren't stored; what was read is added to your notes. The Mac and iPhone apps read the photos on your device and send nothing.
• Meeting briefs and research. Before meetings with other people, Light-Lux writes a brief from the invite, your earlier minutes, anything you add and, for guests outside your team, a short web search about them and their organization. That research is saved so it isn't repeated: public facts about organizations are shared across Light-Lux, while research about people, and anything researched for a government account, stays with your team. You can tell Light-Lux to forget or never look up someone.
• Directory. Names, roles, organizations and notes about the people, organizations and terms in your meetings, written by your team or picked up by Light-Lux from what you tell a brief and what's said in your meetings. They stay with your team.
• Sharing records. Who you shared minutes with, when, and whether they opened their link. For guests you share with, their name and email address and which of their own actions they ticked.
• Surveys. If you're one of Your Roster's experts and are sent a survey, Light-Lux keeps your answers and when you agreed to take part. If you answer by talking, it keeps the words: the sound goes to our speech provider to be typed and is then dropped. To decide who may be sent a survey, or paid for one, Light-Lux asks Your Roster for its people lists and whether a current federal employee's agency has approved the work. It receives names, email addresses and that answer, nothing more. Answers go to Aegis Eval without your name or email. The link at the end of a survey withdraws you and deletes your answers.
• Notifications. If you turn notifications on, we keep the address your browser, phone or computer gives us to deliver them (encrypted), a name for the device, and which notifications were sent, when and where, never what they said. A notification shows a meeting's title and one line at most, never your minutes, notes or transcript; for government accounts it names no meeting. Remove a device or turn notifications off in Settings, Notifications.
• Email records. Which emails Light-Lux sent (sign-in codes, minutes, team invites and the weekly email), on whose behalf, to which addresses and when, and whether delivery failed. Never their content.
• Screen memory (Mac app, coming soon, off by default). If you turn it on, the Mac app reads the text of the window in front of you, never a picture of it, so Ask and Hover can answer about what you saw. It skips password managers and private windows, blanks out card numbers, is available to you only, and can be paused or deleted at any time.
• Technical. Our server logs record each request and its time, with sign-in codes and link tokens removed. Our hosting provider may keep its own network logs. The web app keeps your sign-in and preferences in your browser's storage, and uses one short-lived cookie during Apple, Google or Microsoft sign-in. There are no advertising trackers. We count visits to the website and the web app with Plausible, which uses no cookies and collects no personal data; it receives the page's address with note and link identifiers removed, the referring site, and the browser, device type and country. Guest minutes links, the desktop app and government accounts aren't counted.
• Billing. If you buy a plan or extra hours, you pay on our payment processor Stripe's page, and Stripe keeps your card details. We keep your plan, its status and dates, your seats and credit, and Stripe's reference for you, never your card number. Deleting your account cancels any plan you pay for.

3How we use it

We use your information only to provide Light-Lux to you: to sign you in, record and transcribe your meetings, write minutes, list and prepare for your upcoming meetings, answer your questions, share what you choose to share, and keep the Service secure.

We don't sell your information, use it for advertising, or use your meetings, notes or questions to train AI models.

4Google user data

Light-Lux requests the Google scopes openid, email and profile to sign you in, and https://www.googleapis.com/auth/calendar.events.readonly to show your upcoming meetings.

• Calendar data is used only to show Coming Up, to start a note for a meeting you choose (using its title and invited people), and to prepare a brief for that meeting.
• We store the refresh token Google gives us encrypted, so we can keep reading your calendar without asking you to sign in each time. Event details are fetched when needed; we keep an event's title, time and invitees only on a note you create from it.
• When you stop sharing your calendar (Settings, Calendar) or delete your account, we delete the token and revoke the grant with Google.
• Light-Lux's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements. We don't allow humans to read your Google data except with your consent, to investigate abuse, or to comply with law, and we don't transfer it to others except as needed to provide the features above.
• Your Google profile picture becomes your Light-Lux profile photo unless you add your own; you can change or remove it in Settings.
• You can also remove Light-Lux's access at myaccount.google.com/permissions.

Microsoft sign-in works the same way: Light-Lux asks for your profile and read-only calendar access (User.Read, Calendars.Read), uses it only for the features above, stores its refresh token encrypted, and deletes the token when you stop sharing your calendar or delete your account. You can also remove access in your Microsoft account's app permissions.

Sign in with Apple shares only your name and email address (or a private relay address) and gives Light-Lux no calendar access. We store the refresh token Apple gives us encrypted and revoke it with Apple when you delete your account. You can also stop using Sign in with Apple with Light-Lux in your Apple Account settings.

5Who processes and sees your information

We use these providers to run Light-Lux. Each receives only what it needs.

• Your team sees the minutes you share with the team, never your private notes. Someone you tag on an action sees that one action, its meeting's title and your name, and can tick it off. If they don't use Light-Lux yet, we email them once, with your name and the meeting's title (never the action's words), and the action is theirs when they sign in with that address.
• People you share minutes with get the minutes only, never your notes or transcript.
• The law. We disclose information when the law requires it.
• Your Roster, the expert marketplace we also run, is asked whether your email address belongs to one of its accounts or expert signups, so Light-Lux can show you its Expert section. It receives your address only, never anything from your notes or meetings. Surveys share more with Your Roster, as the Surveys line above says.

6How long we keep it

We keep your information until you delete it or your account, except where a shorter time applies:

Deleting a note deletes its transcript, minutes, shares and brief. Deleting your account deletes your notes and everything tied to them; minutes you shared with a team stay with that team.

7Your choices and rights

In Settings you can stop sharing your calendar, turn off screen memory, turn off any guest link, delete notes or delete your account.

Depending on where you live, you may have the right to access, correct, export or delete your information, and to object to or restrict how we use it. To ask for a copy of your information, or for any of these, write to [email protected]. We won't treat you differently for asking.

8Security

Information is encrypted in transit. Calendar refresh tokens are encrypted at rest. Access to every meeting is checked on every request, and teammates can never change someone else's meeting.

No system is perfectly secure, and Light-Lux doesn't yet hold a SOC 2, ISO 27001 or FedRAMP certification. If you find a security problem, please tell us at [email protected].

11Children

Light-Lux is a work tool and isn't directed to anyone under 16.

12Where your information is stored

Light-Lux stores information in the United States. If you use it from elsewhere, your information is transferred to and processed in the United States.

13Changes to this policy

If we change this policy we'll update the date above and, for changes that matter, tell you in Light-Lux before they take effect.

14Contact

Questions or requests: Your Roster, Inc., [email protected].