Most AI chatbots store and analyze everything you type. Proton Lumo takes a different approach. It runs on open-source language models hosted on Proton's own servers in Europe. Your prompts never leave Proton's infrastructure and no third-party AI company gets to see them.

Saved conversations get zero-access encryption. Proton cannot read them. Nobody can, except you. For conversations you do not want saved at all, Ghost mode erases everything when you close the chat window.

Beyond chat, Lumo handles document summaries, code, translations, and file uploads through Proton Drive. The Projects feature groups related chats and files into encrypted workspaces that stay in sync across your devices. Available on web, iOS, and Android.

The free plan has a weekly prompt cap. Lumo Plus ($12.99/month) removes it and unlocks premium features. Already on Proton Visionary or Lifetime? Lumo Plus comes included.

Worth knowing

Lumo runs on open-source models (Mistral, OLMO), which trail the latest proprietary models from OpenAI or Anthropic in raw capability. Responses can be noticeably slower than ChatGPT. Image and video input are not supported yet. The free tier prompt limit is strict enough that most regular users will hit it within a few days. Proton's client apps are open source, but the server-side AI processing code is not publicly auditable.