Privacy
What Lux knows about you
Written to be read rather than to be defended. If anything here is unclear, that is a fault worth reporting.
Last updated 9 September 2026.
Who is responsible
Lux is run by Alphonso Johan R Braga, one person, not a company. Questions and requests go to hello@johanthegoat.xyz and are answered by a person.
What is stored, and why
If you run a business on Lux
- Your email address, so you can sign in and be sent a password reset.
- Your name, if you gave one. It is optional, and it appears when you reply to a customer.
- A scrambled form of your password. The password itself is never stored and cannot be worked back out of what is, which is why a reset sets a new one rather than telling you the old one.
- Your business name, its web address, and the content you publish.
- A count of failed sign-in attempts, kept against a one-way scramble of the address rather than the address itself, so repeated guessing can be slowed down.
If you are visiting a business page
Nothing. There is no analytics script, no advertising tag, and no cookie until you sign in. The only cookie Lux sets is the one that keeps you signed in. It arrives when you sign in and goes when you sign out.
Who else sees it
Three suppliers, each doing one job:
- Vercel runs the site and keeps short-lived request logs.
- Neon stores the database, in the United States.
- Resend delivers account email, and therefore sees the address a message is sent to.
Nothing is sold and nothing is shared for advertising. There is no advertising.
How long it is kept
- Your account and your content, until you ask for them to be deleted.
- Sign-in sessions, 30 days, or until you sign out.
- Password reset links, one hour and one use.
- Failed sign-in records, one day, then removed automatically.
Getting your data, or having it deleted
Email hello@johanthegoat.xyz and say which you want. An export arrives as a file you can open. A deletion removes your account, your business and everything published under it, and cannot be undone.
Lux is early enough that both are done by hand rather than by a button. When the button exists it will be on your account screen and this page will say so.
If something goes wrong
If data is exposed in a way that could affect you, you will be told what happened, what it means for you, and what has been done about it. Not a notice that manages to say nothing.