Proton put a privacy sticker on the chatbot memory drawer

Proton announced Lumo 2.0 on June 30, 2026 as the biggest update to its privacy-focused AI assistant since launch, adding image generation and analysis, stronger web search, memory, Custom Lumos, and business positioning in one release. 1 TechCrunch's launch write-up described the same update as adding image recognition, image generation, Projects memory, faster responses, a thinking mode, and paid Plus and Professional tiers. 2

That is the funny part. Lumo used to be easy to understand as "ChatGPT, but with Proton's privacy religion." Lumo 2.0 is no longer that clean. It is now a full assistant product with a memory drawer, a model switcher, an image studio, project spaces, web search, and a price ladder. The pitch is still privacy. The product is now context plumbing.

Lumo 2.0 has two model types, Lumo 2.0 Lite and Lumo 2.0 Max, plus two reasoning modes, Fast and Thinking. 3 Proton says both models are available to all users, while Plus and Business users get much higher daily usage limits for Max. 3 If a user hits the daily Max limit, Proton says Lumo automatically switches to Lite. 3

The new model story is not only a label swap. Proton says Lumo 2.0 Lite scores 127% higher than Lumo 1.4 on the Artificial Analysis Intelligence Index, and Lumo 2.0 Max scores 240% higher. 1 Proton also says everyday queries are up to 76% faster than Lumo 1.4. 1 That is a meaningful claim for a product whose first job is not to win a philosophy argument about privacy, but to answer before the user opens another tab.

The image feature is also more than a thumbnail gimmick. Proton's support page says Lumo can upload an image for analysis, generate images from a description, edit an existing image, turn a rough sketch into a finished visual, and work with text, images, and uploaded files in the same conversation. 4 Proton says this feature is available to all Lumo users on web and mobile. 4

So yes, this is a real product update. It is not a landing page pretending a system prompt is a company. It gives users models, modes, images, files, memory, Projects, and paid headroom. The roast is not that Lumo 2.0 does nothing. The roast is that every useful part makes the privacy claim more specific, more conditional, and less bumper-sticker friendly.

Proton's Memory support page says Lumo can learn from conversations and retain preferences such as tone, writing style, recurring topics, or other details the user wants remembered. 5 Saved memories can be generated from chats or added manually. 5 Memory is available on free and paid plans, but Proton says users need a Proton Account to use it. 5

That turns Lumo from a private answer box into a private pattern collector. Proton gives the user controls: memories can be edited, deleted, cleared, disabled, and auto-updates can be turned off. 5 Proton also says memories are zero-access encrypted. 5 Those controls matter. They also prove the actual shape of the product: the assistant becomes useful by keeping little summaries of you.

Projects push the same idea into work mode. Proton says Projects are dedicated encrypted workspaces that keep chats, files, and instructions together across sessions. 1 That is useful if you are drafting, researching, or revisiting a long-running task. It is also the point where "private AI" stops meaning "nothing persists" and starts meaning "persistence is wrapped in Proton's architecture."

The distinction is not pedantic. A memory feature that never remembers is useless. A project space that never stores project state is a folder icon. Lumo 2.0 gets better by keeping context, then asking the user to trust the storage and deletion model.

Proton deserves credit for saying the awkward part in public. Its Lumo security model explains that traditional end-to-end encryption is hard for AI because the language model must read the user's message to answer it. 6 Proton says homomorphic encryption is a possible research direction, but describes it as extremely slow and cites experiments where responses took more than a day. 6

That is the sentence every private chatbot should be forced to print on the box. The model cannot give advice about your message while being mathematically blind to your message. It has to see the prompt somewhere, sometime, in some protected processing environment. Proton's advantage is not that the model never reads. Proton's advantage is that it narrows where reading happens and what gets retained afterward.

Proton calls its request path User-to-Lumo encryption, not regular end-to-end encryption, because the other "end" is the LLM server rather than another human user. 6 In Proton's description, the user's device encrypts the message with an AES key, encrypts that AES key with Lumo's public PGP key, sends the payload over TLS, and the LLM server decrypts the AES key to process the message. 6 Proton says the cleartext message never leaves the server and the request is not logged or retained by the LLM server after the response. 6

For stored conversation history, Proton says it uses at-rest zero-access encryption so no Proton system can read a Lumo conversation history. 6 That is the sensible boundary. In transit and during inference, the product is designed to reduce exposure. At rest, the product leans on Proton's familiar zero-access model. Anyone selling this as "the model never sees your data" would be overcooking it. Proton's own security page is more careful than that.

The terms add another edge. Proton says user input and output are Content, that the user is responsible for that Content, and that Lumo is designed to protect confidentiality after the Content has been processed. 7 Proton also says it will not use user content to maintain, develop, or improve its services. 7 That is a cleaner promise than the average assistant. It is still a promise about a service that must process your input before it can encrypt the aftermath.

The free plan is real, but it is deliberately narrow. Proton's pricing page says the Free plan costs $0.00 and includes limited Max model usage, limited messages and chat history, limited image generations, and one Project. 8 The same page shows Lumo AI Plus at $9.99 per month when billed yearly, billed at $119.88 every 12 months, with more Max model usage, more messages and chat history, more image generations, unlimited Projects, and unlimited Custom Lumos. 8

The word "unlimited" then walks into the terms wearing a small fake mustache. Proton's Lumo terms say unlimited usage on plans including Lumo Plus means no fixed numerical cap for ordinary, good-faith individual use, but remains subject to fair and reasonable use. 7 Proton says usage can be considered excessive if it substantially exceeds typical usage, is not consistent with normal human use of an LLM chatbot, appears automated or scripted, involves resale or account sharing, or otherwise breaches the terms. 7 Proton may throttle, temporarily limit, restrict features, suspend, or restrict an account if it determines usage is excessive. 7

This is not scandalous. Every serious AI product needs an abuse boundary because inference costs money and GPUs do not run on good intentions. It is just worth reading "unlimited chats" as a retail phrase, not a physics statement.

Lumo 2.0 is the most interesting kind of AI product to roast: one where the useful part and the awkward part are the same part. The upgrade makes Lumo more competitive by adding image work, stronger models, memory, Projects, and paid headroom. Those are exactly the features that force Proton's privacy story to become precise. The fair verdict is not "privacy theater." Proton has published more of the plumbing than most chatbot vendors would dare. The fair verdict is sharper: Lumo 2.0 is a better private chatbot because it admits privacy is an engineered boundary, not a spell. Buy it if you want a less extractive assistant and you trust Proton's boundary-setting. Do not buy it if you hear "zero-access" and think the model can answer questions from a sealed envelope.