Privacy and your data

What happens to your Bubble export when you use LumiDevKit.

Parsing happens in your browser

When you upload a file to any LumiDevKit tool, the file is read and parsed by JavaScript running in your browser. It is not uploaded to a server for processing.

That is true for every tool in the kit.

The one exception: saved schemas

If you explicitly click Save on the Database Visualizer, your schema is stored in our database, scoped to your account.

What is stored: your user_types and option_sets, the name you gave it, and your node positions.

What is not: the original file. If you uploaded a full application export, the pages, workflows, styles and settings are never sent anywhere.

This is opt-in. If you never click Save, nothing about your schema reaches our servers. See saved schemas.

There is also a browser-local draft, kept in your own browser's local storage so a refresh does not lose your work. That never leaves your machine.

No AI touches your data

LumiDevKit does not send your export, your schema, or any part of your app to any AI or language model.

The AI features in the docs work the other way round: we give you a prompt to paste into your own ChatGPT or Claude session. Whatever you choose to paste there is between you and that provider. Nothing flows from LumiDevKit to an AI.

What the Chrome extension does

The LumiDevKit extension writes to your browser's clipboard storage and drives the Bubble editor's own paste. It does not send your schema anywhere, and it has no server component.

Your export contains secrets

This is the part worth acting on rather than just reading.

A raw Bubble export contains live credentials: settings.secure in its entirety, plus API Connector configuration, Stripe keys and plugin keys under settings.client_safe.

If you are sending an export to anyone — a colleague, a contractor, a forum, an AI chat — run it through the JSON Sanitizer first. It deletes all of settings.secure and the credential-only keys under settings.client_safe, and keeps the API Connector call structure with every value replaced by <redacted>.

Analytics

We use PostHog for product analytics, hosted in the EU. In GDPR jurisdictions, analytics are opted out by default and only enabled if you accept via the cookie banner.

Analytics record how the app is used — pages visited, features clicked. They do not record the contents of your uploads, because your uploads never reach the server in the first place.

Account data

Creating an account stores your email address and authentication details, handled by Supabase.

We also keep one activity row per account: when you were first and last active, a visit count, and a two-letter country code read from the request header. No IP address, no user agent. It is written at most once every five minutes, and it tells us whether an account is being used rather than signed up and abandoned.

That row is account bookkeeping rather than product analytics, so it is recorded for every signed-in account whether or not you accepted the cookie banner above.

If you arrive through a tagged link, for example ?ref=forum, we keep that code and the name of the site you came from on your account. It tells us which community sent you, nothing more. In the EU, the EEA and the UK it travels in the link to the signup page and nothing is stored in your browser. Elsewhere it sits in two first-party cookies for 30 days.

Deleting your account removes all of it.

Product update emails

The signup form has an optional box, unticked by default. If you tick it, we record when you did and pass your email address to Kit, our email provider, so we can tell you when a new tool ships.

Every such email has an unsubscribe link. You can also write to legal@nocodepro.dev and we take you off the list.

The legal version

The formal documents are at Terms of Service and Privacy Policy. If anything on this page appears to contradict them, the legal documents govern — and please tell us, because it means one of them needs fixing.