隐私政策Privacy Policy
生效日期：2026 年 9 月 27 日
Lumo 是一款 macOS 菜单栏翻译工具，由个人开发者 Max（下称「开发者」）开发和发布。本政策说明 Lumo 处理哪些数据、这些数据去往哪里。
概要
- Lumo 没有开发者自己的服务器。开发者收不到你翻译的文字、你的 API Key、你的设置，也收不到任何使用统计。
- 你要翻译或改写的文字，只发送到你在设置里配置的大模型服务地址。
- API Key 只保存在本机的系统钥匙串里。
- Lumo 不含任何分析、统计、广告或追踪代码。
Lumo 发送哪些数据、发给谁
| 发生时机 | 发送的内容 | 接收方 |
|---|---|---|
| 你按下翻译快捷键、在面板里输入并按回车、或点菜单「翻译剪贴板」 | 要翻译的文字（前面加一行 Translate into <目标语言>:）、你设置的系统提示词、模型名称、你的 API Key（放在请求头里） |
你在设置中填写的接口地址，路径为 /v1/messages（Anthropic 格式）或 /v1/chat/completions（OpenAI 兼容格式） |
| 你开启「改写」后，在输入框里连按三下空格 | 光标所在的那一行文字，或你选中的文字；改写用的提示词；模型名称；你的 API Key | 同上 |
你在终端运行 Lumo --translate 或 Lumo --rewrite
|
你传入的文字，其余同上；可用环境变量 LUMO_LLM_* 临时指定地址、模型和 Key |
同上 |
| 每天一次自动检查更新，或点菜单「检查更新…」 | 一次普通的 HTTPS 请求，不含你的文字或设置 | GitHub（raw.githubusercontent.com 上的更新源文件） |
| 有新版本且你同意安装 | 一次普通的 HTTPS 下载请求 | GitHub（github.com 上的发布文件） |
| 你在设置里点 API Key 旁边的「获取」链接 | 在默认浏览器中打开对应服务商的网页 | 该服务商的网站 |
接口地址完全由你决定。内置预设包括 DeepSeek、OpenRouter、OpenAI、Anthropic、Moonshot 和本机 Ollama（http://localhost:11434）；也可以填写任意地址。选择本机 Ollama 时，文字只发到你自己的电脑，不经过网络。
语言识别和「朗读译文」都在本机由 macOS 系统框架完成，不发送任何数据。
第三方
- 你配置的大模型服务商。 它会收到上表所列的内容以及你的网络 IP 地址。它如何保存和使用这些数据，由它自己的隐私政策和你与它之间的协议决定，开发者无法控制，也看不到。
- GitHub。 更新检查和下载都走 GitHub。GitHub 会收到你的 IP 地址和一次普通网络请求所带的信息，适用 GitHub 的隐私声明。
- Sparkle。 Lumo 使用开源框架 Sparkle 做自动更新。Sparkle 在 Lumo 中未开启系统信息上报。更新包带 EdDSA 签名，签名对不上的更新会被拒绝安装。
除此之外，Lumo 不连接任何其他服务。
本机保存的数据
| 数据 | 位置 | 说明 |
|---|---|---|
| API Key | 系统钥匙串，名称 com.max1874.lumo，账户 llm-api-key
|
只存在这一处，不写进设置文件 |
| 设置 | ~/Library/Preferences/com.max1874.lumo.plist |
目标语言、快捷键、服务商、接口地址、模型名称、系统提示词、改写选项、面板选项，以及是否已显示过首次启动引导 |
| 更新相关记录与缓存 | 上述设置文件中的 Sparkle 条目；~/Library/Caches/com.max1874.lumo、~/Library/HTTPStorages/com.max1874.lumo、~/Library/WebKit/com.max1874.lumo
|
上次检查更新的时间、更新源文件的缓存、下载的更新包、版本说明的显示缓存 |
| 翻译结果缓存 | 只在内存中 | 最多 200 条，退出 Lumo 即清空，不写入磁盘 |
翻译请求使用不落盘的网络会话，不保存缓存或 Cookie。Lumo 不保存翻译历史，也不保存剪贴板历史。
Lumo 会在 macOS 系统日志中记录运行诊断信息（例如取到的文字字数、来源 App 名称、模型名称、耗时），不记录文字内容。这些日志只留在你的 Mac 上。
权限
辅助功能（Accessibility）。 Lumo 用它来：
- 读取其他 App 中选中的文字；
- 读不到时模拟一次 ⌘C 复制选中文字，之后把剪贴板恢复成原来的内容；
- 识别「连按两下修饰键」这类快捷键、浮窗外的点击，以及改写功能的「连按三下空格」；
- 改写时把结果写回原输入框（直接写入，或模拟 ⌘V 粘贴后恢复剪贴板）。
不授予这项权限也能使用 Lumo：按快捷键会打开空输入框，你可以手动输入，或使用菜单里的「翻译剪贴板」。普通的组合键快捷键不需要任何权限。
剪贴板。 除上面的模拟复制外，只有在你点「翻译剪贴板」时读取剪贴板，在你点「复制译文」时写入剪贴板。在部分终端里，你拖选或双击后终端自动复制到剪贴板的那段文字，会在 30 秒内被按快捷键时使用一次，此后作废。
开机自动启动。 只在你打开这个开关时，通过 macOS 的登录项机制注册。
Lumo 不申请麦克风、摄像头、位置、通讯录、屏幕录制或输入监控权限。
删除数据
- 在菜单栏点 Lumo 图标，选「退出 Lumo」。
- 把「应用程序」文件夹里的
Lumo.app移到废纸篓。 - 删除设置和缓存：
~/Library/Preferences/com.max1874.lumo.plist、~/Library/Caches/com.max1874.lumo、~/Library/HTTPStorages/com.max1874.lumo、~/Library/WebKit/com.max1874.lumo。 - 删除 API Key：打开「钥匙串访问」，搜索
com.max1874.lumo并删除；或在终端执行security delete-generic-password -s com.max1874.lumo -a llm-api-key。 - 在「系统设置 → 隐私与安全性 → 辅助功能」中移除 Lumo；如开启过开机启动，在「系统设置 → 通用 → 登录项」中移除。
发送给大模型服务商的数据，需要按该服务商的方式申请删除。开发者没有收到这些数据，因此无法代为删除。
政策变更
本政策如有变更，会更新本页并修改上方的生效日期。
联系方式
个人开发者：Max 邮箱：qinuobiao3@gmail.com
Effective date: September 27, 2026
Lumo is a macOS menu-bar translation tool developed and published by Max, an individual developer ("the developer"). This policy describes what data Lumo handles and where that data goes.
Summary
- Lumo has no server run by the developer. The developer does not receive the text you translate, your API key, your settings, or any usage statistics.
- Text you translate or rewrite is sent only to the LLM service address you configure in Settings.
- Your API key is stored only in your Mac's Keychain.
- Lumo contains no analytics, statistics, advertising or tracking code.
What Lumo sends, and to whom
| When | What is sent | Recipient |
|---|---|---|
| You press the translate hotkey, type into the panel and press Return, or choose "翻译剪贴板" (Translate Clipboard) from the menu | The text to translate (preceded by a line Translate into <target language>:), your system prompt, the model name, and your API key (in a request header) |
The API address you entered in Settings, at the path /v1/messages (Anthropic format) or /v1/chat/completions (OpenAI-compatible format) |
| With Rewrite enabled, you tap Space three times in a text field | The line the caret is on, or the text you selected; the rewrite prompt; the model name; your API key | Same as above |
You run Lumo --translate or Lumo --rewrite in a terminal |
The text you pass in, otherwise as above; the LUMO_LLM_* environment variables can set the address, model and key for that run |
Same as above |
| Once a day automatically, or when you choose "检查更新…" (Check for Updates) | A plain HTTPS request that contains none of your text or settings | GitHub (the update feed on raw.githubusercontent.com) |
| A new version is available and you agree to install it | A plain HTTPS download request | GitHub (release files on github.com) |
| You click the "获取" (Get) link next to the API key field | Opens the provider's web page in your default browser | That provider's website |
The API address is entirely your choice. Built-in presets cover DeepSeek, OpenRouter, OpenAI, Anthropic, Moonshot and a local Ollama (http://localhost:11434), and you can enter any other address. With a local Ollama, your text goes only to your own computer and does not cross the network.
Language detection and "read translation aloud" run on your Mac through macOS system frameworks and send no data.
Third parties
- The LLM provider you configure. It receives the content listed above and your network IP address. How it stores and uses that data is governed by its own privacy policy and your agreement with it; the developer has no control over it and no access to it.
- GitHub. Update checks and downloads go through GitHub, which receives your IP address and the information carried by an ordinary web request. GitHub's privacy statement applies.
- Sparkle. Lumo uses the open-source Sparkle framework for automatic updates. System profile reporting is not enabled in Lumo. Updates carry an EdDSA signature, and an update whose signature does not match is refused.
Lumo connects to no other service.
Data stored on your Mac
| Data | Location | Notes |
|---|---|---|
| API key | Keychain, item com.max1874.lumo, account llm-api-key
|
Stored only here, never in the settings file |
| Settings | ~/Library/Preferences/com.max1874.lumo.plist |
Target languages, hotkey, provider, API address, model name, system prompt, rewrite options, panel options, and whether the first-launch guide has been shown |
| Update records and caches | Sparkle entries in the settings file above; ~/Library/Caches/com.max1874.lumo, ~/Library/HTTPStorages/com.max1874.lumo, ~/Library/WebKit/com.max1874.lumo
|
Time of the last update check, a cached copy of the update feed, downloaded updates, and display caches for release notes |
| Translation cache | Memory only | Up to 200 entries, cleared when Lumo quits, never written to disk |
Translation requests use a network session that writes nothing to disk: no cache, no cookies. Lumo keeps no translation history and no clipboard history.
Lumo writes diagnostic entries to the macOS system log (for example the number of characters captured, the name of the source app, the model name and timings). These entries do not contain the text itself, and they stay on your Mac.
Permissions
Accessibility. Lumo uses it to:
- read the selected text in other apps;
- when that fails, send a ⌘C to copy the selection, then restore your clipboard to what it was;
- notice double-tapped modifier keys, clicks outside the panel, and the triple Space tap used by Rewrite;
- write a rewrite back into the original text field (directly, or by pasting with ⌘V and then restoring your clipboard).
Lumo works without this permission: the hotkey opens an empty input box where you can type, and the menu offers "翻译剪贴板" (Translate Clipboard). Ordinary key-combination hotkeys need no permission.
Clipboard. Apart from the synthetic copy above, Lumo reads the clipboard only when you choose "翻译剪贴板" (Translate Clipboard) and writes to it only when you click "复制译文" (Copy Translation). In some terminals that copy automatically when you drag-select or double-click, that copied text can be used once by the hotkey within 30 seconds and is discarded after that.
Launch at login. Registered through the macOS login-item mechanism only when you turn that switch on.
Lumo does not request access to the microphone, camera, location, contacts, screen recording or input monitoring.
Deleting your data
- Click the Lumo icon in the menu bar and choose "退出 Lumo" (Quit Lumo).
- Move
Lumo.appfrom the Applications folder to the Trash. - Delete settings and caches:
~/Library/Preferences/com.max1874.lumo.plist,~/Library/Caches/com.max1874.lumo,~/Library/HTTPStorages/com.max1874.lumo,~/Library/WebKit/com.max1874.lumo. - Delete the API key: open Keychain Access, search for
com.max1874.lumoand delete the item, or runsecurity delete-generic-password -s com.max1874.lumo -a llm-api-keyin Terminal. - Remove Lumo under System Settings → Privacy & Security → Accessibility, and, if you turned on launch at login, under System Settings → General → Login Items.
For data already sent to your LLM provider, request deletion from that provider. The developer never received that data and cannot delete it for you.
Changes to this policy
If this policy changes, this page will be updated and the effective date above revised.
Contact
Individual developer: Max Email: qinuobiao3@gmail.com