Lumenia's privacy policy, with a full section on this extension, is at https://getlumenia.com/privacy#extension

In short:

• The extension sends nothing until you press "Agree and continue" on its first screen.
• What it sends, and only when you act: to back up or restore an account, your email address and the 6-digit code we email you (our server hands your address to an email delivery service only to send that one message); to send, take back or top up, the transaction you signed (your public key, the amount and the link's ID); to check whether your account is approved for real money, your public key; and a few event counters, each an event name and two short one-way hashes, never a web address or a link's secret (in Firefox only while you keep its optional technical and interaction data permission on). These go to Lumenia's servers: lumenia-sponsor.avakit.workers.dev for practice money and lumenia-sponsor-mainnet.avakit.workers.dev for real money.
• Your balance and whether a link was claimed are read from public Stellar servers (horizon.stellar.org, horizon-testnet.stellar.org, soroban-testnet.stellar.org and mainnet.sorobanrpc.com). They are not ours, and they see your IP address and the account or link you ask about.
• Our servers see the IP address of every request and use it for rate limiting.
• Your key stays in the extension's storage, encrypted with your password (Argon2id and AES-GCM). Your password is never sent anywhere. A backup is your key locked with that password; we can't open it.
• It never collects your browsing history, the pages you visit or what is on them. The "Paste a Lumenia link here" menu item only types the finished link into the text box you right-clicked; that website can then read the whole link, key included, as if you had pasted it yourself. No ads, no third-party analytics kit, nothing sold.
• Version 0.1.2 and earlier put the amount and your sender name in the link's address. Version 0.1.3 makes the same links as the website: no amount anywhere in the link, and a name only if you type one, after the #.
• To erase the key record, your links and your settings from the browser, choose "Forget this account" in the extension's settings, or uninstall the extension.