Lumen is a personal finance app. It handles the most sensitive information most people have. This describes exactly what it does with it.
| Information | Where it goes | Why |
|---|---|---|
| Transactions, balances, budgets, goals, bills | Your device Your cloud account | To run the app, and to restore your data if you reinstall |
| Receipt photos and voice input | Your device only | Read on the device. Audio is never uploaded. Receipt photos leave the device only inside an encrypted backup, if you turn backup on (see below) |
| An encrypted backup of your data — only if you set up backup | Your own Google Drive | So you can restore after reinstalling or changing phones. Encrypted on your phone with a passphrase only you know; neither Lumen nor Google can read it |
| Bank messages (Android, only if you turn it on) | Your device only | Read on the device to find transactions, including while the app is closed; the message itself is not kept, never uploaded, never shared, never used for advertising. Only the transaction made from it is saved |
| Which screens you open, which features you use | Google Analytics | To see which parts of the app are worth improving |
| Crash reports | Google Crashlytics | To find and fix crashes |
| Advertising identifier | Google AdMob | To show ads in the free version |
| Your main currency code (for example, LKR) — only if you have an account in another currency | ExchangeRate-API | To fetch the day’s exchange rates. No amount, account or identifier is sent |
| Your name, email, PIN, notes, merchant names | Never sent to analytics or advertisers | — |
Lumen is an independent mobile application. Questions about this policy, or requests about your data, go to dsachith3431@gmail.com.
Lumen is offline-first. Everything works with no connection, because your financial records are stored on the phone itself in a local database.
These are handled on the device:
If you sign in, Lumen backs your data up to Google Firebase (Cloud Firestore) so you can restore it on a new device. This is what is synchronised:
Shared expenses. An expense you split is kept on your device. If you invite someone to it by email, the expense, the names of the people in it and the email address you invite are stored in the cloud so that you and that person can both see it, and nobody else.
Exchange rates. If you keep an account in a currency other than your main one, Lumen fetches the day’s rates from ExchangeRate-API. The request carries your main currency code (for example, LKR) and nothing else — no amount, account or identifier.
This is stored under your own user ID and is readable only by your signed-in account. It is not sold, rented, or shared with advertisers, data brokers, or anyone else.
If you use Lumen without signing in, nothing is uploaded and no cloud copy exists.
Separately from the above, you can choose to keep your own backup from Settings → Data & backup. It is off until you set it up.
drive.file permission, which does not allow it to read, list or change any other file in your Drive.Lumen uses Google Analytics for Firebase to understand which features people use — how often the affordability check is opened, whether onboarding is finished, which screens are visited.
This is enforced in the app's code rather than left to convention: every analytics parameter passes through a filter that strips any field named for money or identity — amount, balance, income, salary, merchant, note, email, name, pin, account, phone, address and others — before anything is transmitted.
Where the size of something genuinely matters to a product question, it is reported as a coarse band rather than a figure, so the question can be answered without the number leaving your phone.
You can turn analytics off in Settings. Doing so also stops crash reporting.
Lumen uses Google Crashlytics. When the app crashes, it sends the error, the stack trace, and basic device information such as model and operating system version. Crash reports never contain your financial data. This follows the same consent setting as analytics.
The free version of Lumen shows advertisements supplied by Google AdMob. To do this, Google may use your device's advertising identifier and information such as your approximate location, device type and general interests. Google's own handling of that data is described in the Google Privacy & Terms.
Three commitments about how ads work here:
If you are in the EEA, the UK, or a US state with applicable privacy legislation, Lumen asks for your consent before requesting any ad, using Google's consent framework. You can revisit that decision at any time under Settings → Ad privacy choices. You can also reset or delete your advertising identifier in your device's own settings.
Each is requested at the moment you use the feature, never at launch, and each is optional — declining one disables that feature and nothing else.
Your data is kept for as long as you use Lumen. You are in control of removing it:
Full deletion steps, including what to do if you no longer have access to the app: Delete your account and data.
Lumen is not directed at children and is not intended for anyone under 13. The app declares itself a general-audience app to Google's advertising systems and requests only general-audience ad content. If you believe a child has provided personal information, contact the address above and it will be deleted.
Data in transit is encrypted using HTTPS. Cloud data is protected by Firebase authentication rules that permit access only to your own signed-in account. The app can additionally be locked with a PIN or biometrics. No system is perfectly secure, and this is a statement of the measures taken rather than a guarantee against every possible failure.
Lumen can read the text messages (SMS) your bank sends you and turn them into transactions, so you do not have to type every expense in by hand. This is off until you turn it on, and everything below is true whether or not you ever do. Lumen reads SMS only: it does not read the notifications of other apps, your email, or your chats.
Messages are looked at on your phone, by code running inside the app. When you switch the feature on, Lumen reads the messages in your inbox from the last 60 days, so there is something to see straight away; after that it reads each new bank message as it arrives, and looks over recent messages again whenever you open the app. A message is only examined for the handful of things a transaction needs: the amount, whether money came in or went out, the merchant, your bank's name, the last four digits of the account or card, the date, and the bank's reference number.
Messages that are not about a transaction are ignored. One-time passcodes are refused outright — the app is written to stop as soon as it recognises one, and it never reads or stores the code.
Only an ordinary transaction is made from a message — the amount, whether money came in or went out, the merchant, the bank, the last four digits of the account or card, the date, and the one-line description your bank wrote when it wrote one. It is the same kind of record you would have typed yourself. Once you have switched the feature on, Lumen adds it for you, marked as coming from a message, with the account and category it fits best; if it cannot tell which of your accounts it belongs to, it is filed under an account called “Unassigned” rather than guessed. A payment you already entered by hand is not added a second time. If you would rather approve every transaction first, you can turn that on in the same place, and nothing is added until you say so. The transaction is stored on your device, and in your own cloud account if you have signed in, exactly like every other transaction. You can edit or delete any of it, and deleting your data removes it (section 8).
Lumen can receive a bank message while the app is closed. So that a transaction is already there when you open Lumen, Android tells the app a text message has arrived and the app starts briefly in the background — but only while automatic tracking is on, the SMS permission is still granted, and you are signed in. It reads what has newly arrived, saves the transaction on your phone, refreshes your home-screen widgets, and stops. It does not run continuously, does not check for messages on a timer, and does not send anything anywhere: the background run does not start Firebase, ads or analytics, and the transaction it saves reaches your cloud account (if you have signed in) the next time you open the app. If your phone’s battery settings prevent the background run, or the message arrives before you have unlocked the phone after a restart, nothing is lost: the message is read from your inbox the next time you open the app.
A transaction made from a message, and a waiting review card, can show an “Original message” section. Lumen has no saved copy to show, so it looks the message up again in your phone’s inbox at the moment you open the screen, and shows it for as long as that screen is open. “Reload” looks again. If the message has since been deleted from your phone it says so, and it does not rebuild the message from what was parsed. This works only while automatic tracking is on and the SMS permission is granted, and it happens only on your phone: nothing about the lookup is sent anywhere.
If this policy changes materially, the effective date above will change and the updated version will be published at this address before the change takes effect.