Privacy policy
What Lumistrel collects, why, where it is kept, who can see it and how long it stays. Lumistrel works without an account, and most of what you make never leaves your browser.
Last updated
Who we are
Lumistrel is run by Praharsh Nagpure, an individual in Mumbai, Maharashtra, India. "We" and "us" on this page mean him. He decides what personal data the service collects and why, so under India's Digital Personal Data Protection Act 2023 he is the Data Fiduciary, and under the EU and UK GDPR he is the controller.
This policy covers the website at lumistrel.com (opens in a new tab) and everything in it: the P&ID editor, the HMI training simulator, Lumistrel Academy and team accounts. Lumistrel was called IPD Studio until 26 October 2026; this policy also covers data you gave us under that name.
Lumistrel Academy has its own page with more detail about learners' records: Academy privacy. The two say the same thing; where the Academy page is more detailed, it applies.
The short version
- You can draw, check, simulate and export without an account. Then your work stays in your browser and in files on your computer, and nothing about it reaches us.
- If you make an account, we keep your email address, your sign-in details and whatever you choose to save to it.
- No analytics, no advertising, no tracking cookies. We do not sell your data or share it for advertising.
- Your drawings are yours. We do not use them to train AI, and we do not read them except as described below.
- The AI assistant is off until you add your own key from an AI provider. When it is on, your questions go from your browser straight to that provider, never through us.
- Account data is stored by Google (Firebase) in the United States.
If you use it without an account
The editor, the checks, the exports and the HMI simulator run in your browser. Without an account, your drawings are kept in your browser's own storage on your device and in the files you save to your computer. None of it is sent to us.
Your browser still has to load the pages. Google, which hosts the site (Firebase Hosting), receives the technical details any website receives, such as your IP address and browser type, to deliver the pages and keep the service secure. We do not use them to identify or track you.
What we collect, and why
Feature by feature: what is collected, what it is for, where it is kept and how long it stays. "Our database" means Cloud Firestore, run for us by Google.
| Data | Why we need it | Where it is kept | How long |
|---|---|---|---|
| Your account: your email address; your name, if you give one; how you sign in (password or Google); whether your email address is verified; when the account was made and when you last signed in. Your password is held by Google in protected (hashed) form; we never see it. If you sign in with Google, Google also passes on your name and a link to your profile picture. | To sign you in, keep your work in your account, and show your name to teammates and trainers you choose to work with. | Firebase Authentication (Google). | Until you ask us to close the account. |
| Drawings you save to your account: the whole drawing and its name. | To keep your drawings and open them on your other devices. | Our database, under your account only. | Until you delete them, or use Delete my account data. |
| Lumistrel Academy records: your progress and attempts; if you join a class, the name you give, your email address if you choose to share it, the results you send it and your trainer's sign-offs. | To keep your training record, and to let the trainers of a class you join see the results you send them. | Our database. | Until you delete them. Some class records stay with the class: see Academy privacy. |
| Teams: the team name and settings; each member's name, email address and role; invites and share links; the team's projects and drawings, with who has each drawing checked out; review notes; signed approvals; and the team's audit trail of who did what, and when. | To let the people in a team work on the same drawings, with roles, check-out locks, review notes and approvals. | Our database, readable only by members with the right role. | Until you leave the team or it is deleted. The audit trail and approvals are kept longer: see "How long we keep it" below. |
| Feedback reports you send: bug or suggestion, its title and text, the app version, which workspace you were in, your browser's name and version, the size of your browser window, how many sheets, symbols and lines the open drawing has (counts only, no content), a screenshot if you attach one, your account id and the time. | To find and fix the problem, or weigh the suggestion. | Our database. Nobody can read a report through the app, including the person who sent it. | Until it has been dealt with, and no longer than two years. |
| Your emails to us: your address and what you write. | To answer you, and to keep a record of requests and complaints. | Our mailbox, hosted by Hostinger, our email provider. | As long as needed to deal with it, and no longer than two years after the matter is closed, unless the law requires longer. |
We do not ask for your phone number, postal address, date of birth or any identity document. Paid plans are not on sale yet, so we hold no payment details. When they go on sale, card and bank details will be handled by a payment gateway, and we will name it here first.
Every place in our database
Every collection in our database, by the name it has there, in plain words. Access is enforced by our database's security rules on Google's servers, not just by the app, so a modified app cannot read what the rules refuse. "…" stands for an id.
| Name in the database | What it holds | Who can read it |
|---|---|---|
| users/…/drawings | Drawings you saved to your account: the drawing and its name. | Only you. |
| users/…/academyProgress | Your Academy progress for each lab: best score, number of attempts, when you last practised it, when a refresher is due. | Only you. |
| users/…/academyAttempts | Each Academy attempt: score, pass or fail, when, and your answers. For a simulator exercise, the answer is the run: its timeline, what you did on the plant, the hints you saw and the alarms. | Only you. |
| users/…/academyClassLinks | The classes you have joined: class id, class name and when you joined. | Only you. |
| users/…/orgLinks | The teams you belong to: team id, team name and when you joined. | Only you. |
| feedback | Bug reports and suggestions (see the table above). | Nobody through the app, including the sender. |
| academyClasses | A class: its name, the trainer's name and account id, co-trainers, its invite code, its checklist, when it was made and whether it is archived. | The class's trainers and members. |
| academyClasses/…/members | Each learner in a class: the name they gave, their email address if they chose to share it, when they joined and the code they used. | The class's trainers, and each learner their own. |
| academyClasses/…/assignments | Labs a trainer has set: which lab, a note, the due date, attempts allowed, who set it and when. | The class's trainers and members. |
| academyClasses/…/submissions | Results a learner sends for an assignment: score, pass or fail, when, how it was checked. | The learner who sent it, and the class's trainers. |
| academyClasses/…/answers | The answers behind a submitted result, for a simulator exercise the whole run. | The learner who sent it, and the class's trainers. |
| academyClasses/…/signoffs | A trainer's sign-off: the task, the outcome, any comment, the trainer's name and the date. | The learner it is about, and the class's trainers. |
| academyClasses/…/labs | Labs a trainer builds for the class: title, content, version, who made or changed it and when. | The class's trainers and members. |
| academyClasses/…/labDrawings | The drawing a class lab uses. | The class's trainers and members. |
| academyJoinCodes | An invite code and what it opens: the class id and name, the trainer's name and whether the class is archived. | Anyone signed in who has the exact code. Codes cannot be listed. |
| orgs | A team: its name, who made it and when, the email domains allowed to join, the role they join with, how long a check-out may sit idle, and its owners. | Its members, and people whose verified email domain the team accepts. |
| orgs/…/members | Each member: account id, name, email address, role, how and when they joined, and for a guest, the project and expiry date. | The team's owners, and each member their own. |
| orgs/…/blocked | People removed from a team who may not rejoin by email domain: account id, who removed them and when. | The team's owners. |
| orgs/…/invites | Invitations: the email address invited, the role, who invited them, the team name, when it was made and when it expires. We send no email; the owner sends the link. | The team's owners, and the person invited. |
| orgs/…/shares | Share links: which project, which role, who made it, when, when it expires and whether it was withdrawn. | The team's owners, and whoever holds the link. |
| orgs/…/projects | A team's projects: name, who made it, when, and whether archived. | Members with access to the project. |
| orgs/…/projects/…/drawings | Team drawings: the drawing, its name, size, sheet count, when and by whom it was last saved, and its check-out: who holds it and since when. | Members with access to the project. |
| orgs/…/projects/…/drawings/…/presence | Who has a team drawing open right now, one entry for each open browser tab: account id, name, a random id for the tab, whether they are editing or viewing, idle or active, which sheet, when the tab last checked in, and when the entry expires. Never an email address or anything of the drawing, and never kept as a history. A tab removes its entry when it closes, when it can; an entry left behind is deleted automatically, usually within a day. | Members with access to the project. |
| orgs/…/projects/…/drawings/…/reviewNotes | Review notes: where on the sheet, the text, the author's name, when, and who resolved it. | Members with access to the project. |
| orgs/…/projects/…/drawings/…/approvals | Signed approvals of a revision: the revision code, a fingerprint (SHA-256) of the exact drawing approved, the approval statement, the digital signature, which key signed it, the approver's name and the time. | Members with access to the project. Nobody can change or delete one in the app. |
| orgs/…/projects/…/drawings/…/approvedSnapshots | The exact copy of the drawing an approval signed. | Members with access to the project. Nobody can change or delete one in the app. |
| orgs/…/signingKeys | The public half of an approver's signing key, with their name and account id. The private half never leaves their browser. | The team's members. Nobody can change or delete one in the app. |
| orgs/…/audit | The team's audit trail: what was done (for example a drawing saved, a lock broken, a member removed), by whom (account id and name), when, in which project and drawing, and a short description. | Owners, engineers and reviewers of the team. Nobody can change or delete an entry in the app. |
| orgTombstones | A marker that a team was deleted, who deleted it and when, so its id is never used again. | Nobody through the app. |
As with any online service, the person who runs it can reach the database through Google's console. Praharsh Nagpure does so only to keep the service working, to act on a request from you, or when the law requires it.
What stays in your browser
These are kept in your browser's own storage on your device (IndexedDB and localStorage). They are not sent to us. Anyone who uses the same browser profile can reach them, and clearing this site's data in your browser removes them.
| What | Does it leave the browser? |
|---|---|
| The drawing you are working on, its autosave and history, and copies of revisions you issue. | Only if you save a drawing to your account or a team, or export it as a file. |
| Your settings and preferences: theme, panel layout, recent and favourite symbols, simulator sound and display choices, guides you have seen. | No. |
| Your AI provider key, the model you picked and your consent to send to that provider. | The key goes only to the provider it belongs to, with each request you make. |
| Your assistant conversations, including any drawing you attached to one. | Only to the AI provider, as part of the conversation. |
| The private half of your approval signing key. | Never. Only signatures made with it are stored, with the approval. |
| Team saves made while the team could not be reached, and which team drawings this browser has checked out. | The saves go to the team when it can be reached. |
| Academy labs you started but have not finished, and results waiting to be sent. | Results go to your account or your class when they can. |
| Your sign-in session, kept by Google's sign-in code so you stay signed in. | It is used to talk to Google's sign-in service and our database. |
What we never do
No analytics. No advertising. No tracking or advertising cookies. No session recording. We never sell your data, never share it for advertising, never use your drawings or any other content you make to train AI, and never read your drawings for any purpose of our own.
The app sends us no usage data, logs or crash reports. A feedback report is sent only when you send one, and the only thing it adds about your drawing by itself is counts: how many sheets, symbols and lines.
The AI assistant
The assistant is off until you paste in your own key from one of three AI providers: Anthropic, OpenRouter or Groq. You get the key from the provider and pay them, if they charge, under their terms. Lumistrel works fully without it.
- Your key is kept in your browser. It is sent only to the provider it belongs to, with your requests. It never reaches us.
- Before the first request to a provider, the app asks for your consent and says what will be sent. It asks again if you change provider.
- Requests go straight from your browser to the provider (api.anthropic.com, openrouter.ai or api.groq.com). They never pass through us, and we cannot see them.
- OpenRouter passes your request on to the company that runs the model you picked, under OpenRouter's terms.
What is sent: your question; a summary of what is in view: tags, symbol types, how things are connected, the engineering values of the objects in scope, fluid service names and control loops; the project name, which sheet is open, the number of sheets and the drawing's grid and tag-format settings; the answers to lookups the assistant makes in your drawing; and, if you attach a drawing (a photo, scan or PDF) for it to copy, the pages of that drawing as images.
What is never sent: the drawing file itself; the author's name; your own symbol artwork; HMI screen layouts; your budget and the cost of each item (a total leaves only if you ask the assistant for one); the reasons reviewers gave for accepting findings; and any CAD drawing traced underneath a sheet.
What the provider does with what you send is set by its own terms and privacy policy: Anthropic (opens in a new tab), OpenRouter (opens in a new tab), Groq (opens in a new tab). Read them before you add a key. Your conversations are saved in your browser only, never with your drawings in your account.
Who handles your data for us
Personal data in the service is processed on our behalf by Google, through these Firebase services:
| Service | What it does | What it handles |
|---|---|---|
| Firebase Authentication | Sign-in, password resets and email verification | Your account details |
| Cloud Firestore | Our database | Everything listed under "Every place in our database" |
| Firebase Hosting | Delivers the website and app | Your IP address and browser details, to deliver pages |
Emails you send us are held by Hostinger, which hosts our mailbox. If you choose to sign in with Google, that is Google's own service under Google's terms. The AI providers are not our service providers: if you add a key, you deal with them directly. Apart from the people you choose to share with, such as your teammates and trainers, nobody else receives your personal data from us, unless the law requires it (for example a valid order from a court or a government authority in India).
Where your data is stored
Our database is in Google's United States multi-region (named nam5). Firebase Authentication and Firebase Hosting run on Google's global infrastructure. So if you are in India, the EU, the UK or elsewhere, data in your account is transferred to and stored in the United States.
Indian law allows this transfer: under the Digital Personal Data Protection Act 2023 the government may restrict transfers to particular countries, and no such restriction applies to the United States. For people in the EU and UK, Google's data processing terms for Firebase include the standard contractual clauses for transfers like this one.
Cookies and browser storage
Lumistrel sets no cookies of its own, and no analytics or advertising code runs on the site, so there is nothing to consent to and no cookie banner. The app uses your browser's storage (IndexedDB and localStorage) for the things listed under "What stays in your browser". These are needed for the features to work; you can clear them at any time in your browser's settings for this site.
If you sign in with Google, the sign-in window is Google's, and Google may use its own cookies there under its own policy.
Why we are allowed to use it
- To provide what you asked for. Your account, saved drawings, Academy records and teams exist because you chose to make them. In India this rests on your consent and on data you gave us for that purpose (sections 6 and 7(a) of the DPDP Act); under the GDPR, on our contract with you.
- To keep the service secure and working, and to fix problems you report: under the GDPR, our legitimate interest in a working, secure service.
- To meet legal duties, such as answering a lawful order or keeping records the law requires.
You can withdraw your consent at any time, as easily as you gave it: delete the data (see below) or write to us. Withdrawing does not undo what was lawfully done before. Without an account, you can still use the editor in your browser.
How long we keep it, and deleting it
- Delete my account data (under "Your account data" in Teams, from the account menu in the editor) removes your own cloud drawings, takes you out of every team and clears what this browser keeps for you. It is refused, with the reason, while you are the only owner of a team.
- Delete my Academy data (on the Academy privacy page or Your progress) removes your progress, attempts, class memberships and the results you sent. Signed out, it clears what the Academy keeps in this browser.
- Closing your account itself (your email address and sign-in) has no button yet. Write to us from the address you sign in with, and we close it within 15 days.
- Drawings you made in a team stay with the team when you leave. When a team is deleted, its drawings, projects, members, invites and links go with it.
- A team's audit trail, approvals, approved copies and signing keys cannot be changed or deleted by anyone in the app, the team's owners included. That is what makes them trustworthy evidence. They stay after the team is deleted, until its owner asks us in writing to remove them.
- Class records a trainer holds about you, such as sign-offs, stay with the class after you leave. Write to us to have one removed.
- Feedback reports are deleted once dealt with, and within two years at most.
Deleted data is removed from our database straight away; Google then clears it from its own systems on its own schedule. Copies someone already downloaded, such as a class spreadsheet a trainer saved or a file a teammate exported, are theirs and beyond our reach.
Your rights
Wherever you live, you can ask us to:
- tell you what personal data we hold about you, what we do with it, and who else has it;
- give you a copy of it (much of it you can take yourself: export any drawing as a .pnid file, and download your Academy training record);
- correct, complete or update it;
- delete it, unless we must keep it by law;
- stop using it, or use it only in limited ways, while a question about it is settled;
- withdraw your consent;
- name someone to act for you if you die or cannot act yourself (the DPDP Act calls this nominating).
How to ask: write to contact@lumistrel.com from the email address you sign in with, so we know the account is yours. If you write from another address, we will ask you to confirm from that one. We reply within 15 days.
If you are not satisfied, write to our grievance officer (below) first. In India you may then complain to the Data Protection Board of India. In the EU or UK you may complain to your data protection authority at any time.
Grievance officer
Praharsh Nagpure, grievance officer, Mumbai, Maharashtra, India. Email: contact@lumistrel.com. He also answers any question about how your personal data is used.
We acknowledge a complaint within 24 hours and resolve it within 15 days of receiving it, and we give you a reference number to quote. A request to remove content that is unlawful under rule 3(1)(b) of India's IT (Intermediary Guidelines) Rules is acted on within 72 hours.
Children
You must be 18 or older to create a Lumistrel account. India's Digital Personal Data Protection Act treats everyone under 18 as a child and requires a parent's verifiable consent before a child's personal data is processed. We do not offer that yet, so we do not knowingly hold personal data of anyone under 18.
If you believe someone under 18 has made an account, write to us and we will delete it. A college or training centre that wants to enrol learners under 18 in Lumistrel Academy must talk to us first; we will not enrol them until a parent's consent can be obtained and verified as the law requires.
How we protect it
- Every connection to the site, to Google's sign-in and to our database uses HTTPS.
- Our database's security rules decide who may read or write each record, and they are checked on Google's servers. Each record is reachable only by the people listed in "Every place in our database".
- The site sends a Content-Security-Policy that lets your browser connect only to the site itself, Google's sign-in and database services, and the three AI providers (which it contacts only if you add a key). Other sites cannot show it inside their own pages, and it tells other sites nothing about where you came from.
- Passwords are handled by Firebase Authentication. We never see or store them.
- Google encrypts the database's data on disk.
- Team approvals are signed with a key made in the approver's own browser, which cannot be copied out of it. A drawing changed after approval no longer matches its signature.
No system is perfectly secure. If a breach affects your personal data, we will tell you without delay: what happened, what it may mean for you, what we are doing and what you can do. We will also report it to the Data Protection Board of India as the law requires.
Self-hosted installs
A company may run Lumistrel on its own servers under a written agreement. That install keeps its data on the company's own infrastructure, or in the company's own Firebase project, and sends nothing to us: its licence key is checked offline, and there is no update check and no usage reporting. The company running it is responsible for that data, and this policy does not cover it.
Changes to this policy
The date at the top shows when this page last changed. If we change what we collect or how we use it, we will say so here first, and email account holders at least 30 days before the change takes effect. We will not start using data you already gave us for a new purpose without asking you.
Contact
Questions about privacy, requests about your data and complaints: contact@lumistrel.com. See also Contact and the terms of service.