1. Enrollment creates a local reference
Enrollment captures face information for comparison with later camera frames. The app stores an encrypted recognition reference on the Mac. Camera frames, that reference and your saved Mac login password are not inputs to the account or billing service.
The local vault has a separate authorization step using macOS user authentication. Signing in to a Lunlo account is not the same as authorizing access to the local password vault.
2. The app checks access before scanning
Each scan begins with an online membership check. The backend is designed to authenticate the current account session and derive access from subscription state. An eligible trial or paid period must still be valid; a page redirect or a previously successful payment is not enough on its own.
If the service is unavailable, the session has ended or access has expired, the app stops. The implementation has no offline entitlement fallback. The preview's disabled service configuration currently prevents this step from completing.
3. Recognition requires a consistent result
The camera pipeline compares the visible face with an enrolled identity and evaluates software liveness signals. The development policy requires three consecutive matching frames. A face disappearing, an identity change or multiple detected faces resets the scan evidence.
These rules help define when the app may attempt the next step. They are not measurements of false acceptance, spoof resistance or real-world reliability. See what liveness checks can establish.
4. Password entry has its own conditions
After the preceding checks, Accessibility is used to type the locally stored Mac password. The implementation checks its short-lived, single-use permission, the authorized local session and the lock state before sending keys. It allows one password-submission attempt per lock session.
An interrupted or unsuccessful attempt must leave normal password entry available. The success animation depends on observing an unlocked Mac; a face match alone is not treated as a completed unlock.
5. Real-device validation remains a release gate
Local policy tests and selected Stripe test-mode flows have passed, but actual account-to-unlock behavior has not. Camera enrollment, permission handling, real password submission and lock-screen operation still need verification on supported hardware.
Lunlo does not replace macOS authentication or support FileVault/pre-boot login. Before preparing a future configured build, review compatibility, the setup guide and current release status.
For the details behind each boundary, see local face data and password storage, online and offline access, and lock screen versus startup login.