Luma Privacy Policy

Scope

This Privacy Policy applies to the Luma dashboard available at this domain. Luma is a self-hosted media dashboard used to manage Jellyfin-connected accounts, live streams, recordings, clips, playback, system health, and optional YouTube archiving.

The administrator who provides access to this dashboard controls the deployment, storage locations, network exposure, backups, and retention settings for this Luma instance.

Information Luma Processes

• Account and session data: Jellyfin user IDs, usernames, display names, profile images, authentication state, and HTTP-only Luma portal sessions.
• Streaming and media data: Stream keys, active session state, recordings, clips, thumbnails, previews, metadata, file paths, durations, codecs, file sizes, and publication status.
• Diagnostic data: Recording integrity results, repair status, archive status, service health, storage status, connectivity results, errors, and operational logs.
• YouTube connection data: Connected channel details, granted OAuth scopes, upload defaults, OAuth expiration metadata, and an encrypted Google refresh token when a user connects YouTube.

How Luma Uses Information

Luma uses information to authenticate dashboard access, operate live streams, create and validate recordings, repair media when configured, generate clips and previews, show system status, troubleshoot failures, and archive eligible recordings to YouTube when authorized by the connected user.

YouTube API Services

Luma uses YouTube API Services only after a signed-in user connects a YouTube account. Luma requests the youtube.upload and youtube.readonly OAuth scopes. The upload scope is used to upload selected or automatically eligible recordings to the connected channel. The read-only scope is used to identify and verify the connected YouTube channel shown in the dashboard.

Luma stores the connected channel ID, channel title, channel thumbnail URL, granted scopes, upload preferences, and an encrypted refresh token. Uploaded video metadata may include title, description, tags, category, privacy status, subscriber notification preference, and made-for-kids setting.

Luma does not sell Google user data, use Google user data for advertising, or use Google user data to determine creditworthiness or similar eligibility decisions. Luma's use of information received from Google APIs is intended to comply with the Google API Services User Data Policy, including the Limited Use requirements. Use of YouTube API Services is also subject to the YouTube API Services Developer Policies, the Google Privacy Policy, and the YouTube Terms of Service.

No Third-Party Sharing

Luma does not sell, rent, broker, disclose, or share dashboard data with outside parties for advertising, analytics, profiling, or unrelated services. Luma does not include third-party trackers or advertising profiles.

Jellyfin, Redis, MediaMTX, Caddy, Docker metrics, and configured storage are local components of the same Luma deployment. Data moving between those components is internal processing for this dashboard, not third-party sharing.

The only external transfer built into this feature set is user-authorized YouTube archiving. When a signed-in user connects YouTube and enables or starts an upload, Luma sends the selected video file and its configured metadata to Google and YouTube only for that authorized YouTube API Services action.

Retention and Deletion

Recordings, clips, previews, metadata, and logs are retained according to the deployment's storage and logging configuration. Portal sessions expire automatically. YouTube connection data remains until the user disconnects YouTube, access is revoked in Google Account settings, or the administrator removes the connection.

Security

Luma protects YouTube refresh tokens with the configured YOUTUBE_TOKEN_ENCRYPTION_KEY, stores application secrets in environment variables, uses HTTP-only portal session cookies, and requires the current portal user to manage only their own YouTube connection. The administrator is responsible for HTTPS, host security, firewall rules, backups, and access to deployment secrets and volumes.

Your Choices

You can disconnect YouTube in Luma settings or revoke Luma's access from your Google Account security settings. Contact the administrator who provided access to this dashboard for questions, deletion requests, export requests, or access changes involving recordings, clips, logs, diagnostics, or Jellyfin account data.