Gemini vs Proton Lumo: Google Account or Encrypted Chats

Gemini is Google’s AI assistant. It works in a browser, in apps for phones and computers, and inside Gmail, Docs and Android, and with a personal Google Account it stores your chats with that account. Lumo is the AI assistant from Proton AG, the Swiss company behind Proton Mail. It runs its models on Proton’s own servers and stores saved chats so that Proton cannot read them.

This comparison covers the consumer versions with a personal account: who can read what you type, what each company uses it for, and what you get for the money.

	Gemini	Lumo
Rating	5.4	7.5
Trains on your chats	Yes, by default; off if you turn off Keep Activity	No, except feedback you choose to send
Who can read saved chats	Google; human reviewers read some	Only you (zero-access encryption)
How long chats are kept	18 months by default; reviewed chats up to 3 years	Guest chats erased at session end; saved chats are kept if you choose to keep them
Without an account	Text chats in a browser only	Guest mode; chat erased when the session ends
Jurisdiction	United States	Switzerland
Models	Flash-Lite, Hydrogen, Pro, Argon, Carbon	Lumo 2.0 Lite, Lumo 2.0 Max, Apertus 1.5
Paid plan	$4.99/mo AI Plus; $19.99/mo AI Pro	$12.99/mo, or $9.99/mo billed yearly
Platforms	Windows, macOS, Android, iOS	Android, iOS

Want to compare every field side by side? Open the full comparison table.

Where your chats go

When you sign in to Gemini, your chats are saved with your Google Account on Google’s servers. Google is both the company running the app and the company running the model, so your prompt, your IP address and your location go to the same company. Google documents encryption of data in transit but no consumer page says how stored chats are encrypted, and Google’s own staff and contracted reviewers read a subset of chats as part of normal operation. Outside the European Economic Area and Switzerland the provider is Google LLC in the United States; inside them it is Google Ireland Limited.

Lumo also runs its models on its own servers, so no outside model provider receives your prompt. The difference is in storage. If you keep a chat, it is saved under zero-access encryption: each conversation has its own key, those keys are locked by a master key, and the master key is locked by a key pair that only your password unlocks. Proton holds nothing it could use to read your saved chats, so a legal demand to Proton AG in Switzerland would return data it cannot open. Proton also says Lumo stores no metadata such as timestamps, IP addresses or chat context. No outside party has checked that claim.

The cost of this design is on your side: your password is the only way into your saved history, with the usual consequences for account recovery.

Training and human review

On Gemini, one setting decides most of this: Keep Activity, which is on by default for users 18 and over. While it is on, Google saves your chats and uses them to train its models, and some of them go to human reviewers, including staff at outside contractors. Google says it removes the link to your account before chats reach those contractors and keeps reviewed chats for up to three years, even if you delete your activity.

Turning Keep Activity off is the opt-out from training, and it costs features: your chat history disappears and most Connected Apps, including Gmail and Drive, stop working. Google still keeps each chat for 72 hours, and if you send feedback, the last 24 hours of chats go to review and are kept for up to three years. Temporary chats are the per-chat alternative: they are not used for training and are kept for 72 hours. Google also says your Gemini settings do not control its use of chats to create anonymised data. Gemini chats are not used for ads today; Google says it will tell users if that changes.

Lumo does not train on chats. The one exception is the feedback button: pressing it can share an anonymised copy of that prompt and answer for Apertus 1.5, the model built by the research teams at ETH Zurich and EPFL. You have to press it each time. Proton’s Lumo page says Lumo “never uses your data to train AI” and does not mention this exception, which is stated only on the support page.

Using either without an account

Gemini answers text questions in a browser without signing in, and Google says those chats are not linked to a Google Account. Without an account there is no history, file upload, image generation or Gems, and the Android app requires an account.

Lumo’s guest mode needs no account, and the conversation is erased when the session ends. An account adds saved history synced between devices, and Projects.

Features: Gemini has much more

Gemini offers five models, from Flash-Lite on the free plan to Gemini 4 Argon on AI Pro and Gemini 4 Carbon on Ultra, and choosing a model yourself requires a paid plan. Around them are answers grounded in Google Search, file upload with a context window of a million tokens on AI Pro, Deep Research, image and video generation, voice and camera through Gemini Live, Canvas, Gems and memory of past chats. Connected Apps let Gemini read your Gmail, Drive and Photos, which is useful and also means more of your data passes through chats that are stored and may be reviewed.

Lumo offers three models: Lumo 2.0 Lite and Lumo 2.0 Max from Proton, and Apertus 1.5, built by ETH Zurich, EPFL and CSCS. All three are on the free plan, with lower limits on Max, and each has Fast and Thinking modes. Web search can be turned off, and when it is on, only a simplified query goes to the partner search services, not your whole prompt. Image generation is on both plans.

Files are Lumo’s strongest feature. A project holds up to 200 files, uploaded or linked from Proton Drive, and documents up to 4,000 pages are read in chunks rather than whole, so answers to specific questions work better than questions about the entire document.

Proton’s Lumo page lists no voice mode, video generation or access to email and calendars. Gemini has apps for Windows, macOS, Android and iOS (the Mac app needs Apple Silicon and macOS 15); Lumo has apps for Android and iOS and a web version, with no desktop app.

Openness and checks

Gemini’s apps, servers and models are closed source. In 2025 the security firm Tenable reported a prompt-injection flaw in Gemini’s browsing tool that could send a user’s saved information and location to an attacker; Google fixed it in June 2025, with no attacks reported.

Lumo’s web, iOS and Android apps are open source, so anyone can check what the apps send. Proton’s own Lumo 2.0 models are not: their weights and training data are unpublished, and the European Open Source AI Index called Lumo the least open “open” AI assistant it had indexed. There is no independent audit of Lumo, so the encryption design, the no-metadata claim and the no-training policy all rest on Proton’s own description.

Price

Gemini’s free plan includes image generation, Deep Research and Gemini Live under limits that reset every five hours up to a weekly cap. Google AI Plus costs $4.99 a month and comes with 400 GB of Google storage; Google AI Pro costs $19.99 a month for Gemini 4 Argon, higher limits and 5 TB of storage. There are no refunds for partial months.

Lumo’s free plan includes every model but does not publish its limits on messages, history, image generation or Max use, and allows one project. Lumo AI Plus costs $12.99 a month, or $9.99 a month when paid yearly ($119.88), with a 30-day money-back guarantee. Paid plans start at $4.99 a month for Gemini and at $9.99 a month billed yearly for Lumo. Paying Google more does not change how Gemini handles chats: every personal plan has the same training default, review and retention.

What this comparison leaves out

Gemini for work and school accounts and Gemini Enterprise run under different terms; Google says Enterprise prompts and outputs are not used to train its models. Lumo for Business is also out of scope. Answer quality is not compared: neither assistant is scored on how well it reasons or writes.

If you are moving more than the assistant away from Google, Can Proton Replace the Google Ecosystem? goes through the other services one by one.

Which one to pick

Gemini fits if you need the widest set of tools, desktop apps and access to your Gmail, Drive and Photos, and if nothing you type is sensitive. Turn off Keep Activity or use temporary chats for anything you would not want stored with your Google Account or read by a reviewer, and expect to lose history and most Connected Apps when you do.

Lumo fits if what you type matters more than what the assistant can do with it: a guest mode that keeps nothing, saved chats Proton cannot read, no training without your click, and a Swiss provider. In exchange you get three models, no desktop app, unpublished free limits, no audit and in-house models that are not open.