Privacy

The short version

• There is no account. You never sign up, sign in, or give us a name or an email to use Lumis.
• Your financial records stay on your phone. We cannot see them, because the app does not send them anywhere. The only way any of them can reach us is a screenshot you choose to attach to a feedback report with hiding switched off.
• We do not sell or share your data. There is no advertising in Lumis and no advertising SDK in it.
• Two things can be sent: crash reports, with every number stripped out, and feedback reports, only when you write one and tap Send. Once a day the app also downloads exchange rates; that request carries nothing about you or your records. All three are described below.
• This website collects basic, anonymous traffic statistics. That is separate from the app, and also described below.

What the app stores, and where

Everything you enter — transactions, wallets, categories, budgets, notes and dates — is written to a database inside the app on your device.

That database is encrypted at rest using SQLCipher. You can also put a biometric or device lock in front of the app, so it cannot be opened without your fingerprint, face or PIN.

Android’s automatic cloud backup is switched OFF for Lumis. Your database is never copied to Google Drive. This is deliberate: the encryption key lives in your phone’s hardware keystore and does not travel, so a copy of the database on another device could not be opened anyway.

Lumis also writes automatic backups to a folder belonging to the app on your own device, keeping the most recent few. Those files stay on the phone. Nothing uploads them.

When you use Export, Lumis writes a file that you choose the destination for. From that moment the file is yours and it is outside the app’s control — if you put it in a cloud drive or send it to someone, it goes where you send it.

Crash reports

If Lumis crashes, it sends a crash report so the fault can be found and fixed. This uses Firebase Crashlytics, a Google service. Apart from feedback reports and the daily exchange rates, both described below, it is the only network connection the app makes.

Because this is a money app, crash reports are stripped before they are sent:

• Every digit in an error message is replaced with a # character. An error mentioning "1,234.56" arrives as "#,###.##". This is deliberately blunt — a cleverer filter that tried to tell an amount from a list position would sometimes get it wrong, and one leaked balance is worse than a less readable report.
• The type of the error and the stack trace are kept. A stack trace records which line of code failed, not what your data was.
• Flutter’s error "context" field, which can quote what was on screen, is dropped entirely.
• Lumis attaches no breadcrumbs, no custom keys, and no identifier for you. We never call Crashlytics’ user-identifier API.

Alongside the report, Crashlytics itself records the usual technical details of a crash: when it happened, your device model, your Android version, the app version, and an installation identifier generated by Firebase. Google processes this on our behalf; its handling is covered by Google’s own privacy policy.

No transaction, wallet name, category, note or balance is included in a crash report.

Feedback you choose to send

You can send us a report from inside the app: shake your phone while Lumis is open, or go to Settings and choose Send feedback. Nothing is sent unless you write a message and tap Send. Shaking to report can be switched off in Settings.

A report contains:

• The message you write, and whether it is a bug or an idea.
• An email address, only if you type one, so that we can reply.
• A screenshot of the screen you were on, when the report starts from a shake and you leave the screenshot attached. Before anything is sent, every number in it (amounts, dates, counts) and every wallet name, category name, note and your profile name are hidden. You see the picture before sending, and you can switch the hiding off or remove the screenshot. With hiding switched off, the screenshot shows your screen as it was, which can include balances and names. If the app cannot hide those details reliably, it offers no screenshot at all.
• Technical details that help find a fault: the app version, your Android version, your phone model, your language, your screen and text size, which part of the app you were in, and whether demo mode or Hide my numbers was on.

Nothing else is taken from the app: not your transactions, not your database, and not your backups.

The report travels over an encrypted connection to our own small server, which runs on Cloudflare. The server passes it on as an email to our support inbox, sent through Resend, an email service. The server keeps no copy of the report and does not record your internet address. Cloudflare and Resend handle reports only to deliver them to us.

If there is no connection, the report waits in the app’s private storage on your phone and goes out later. A report that still has not been sent after 30 days is deleted from the phone.

We keep reports in our support inbox for as long as they help us fix a problem or answer you. To have a report you sent deleted, email support@lumis.money and tell us roughly when you sent it, or write from the address you gave in the report.

Exchange rates

Once a day, while Lumis is open, it downloads exchange rates from our own small server, which runs on Cloudflare. The request names the months whose rates are needed and nothing else: no records, amounts, currencies or identifier for you.

Like any connection, it shows your internet address to Cloudflare. Our server does not record it.

The rates come from a public-domain world feed. Lumis uses them on your phone to show your totals in your default currency.

Permissions, and why each one exists

• Internet and network state — used only to download exchange rates, and to send crash reports, and feedback reports when you send one. Lumis makes no other network requests.
• Motion sensor — used only to notice a shake that opens the feedback form, while Lumis is open on your screen and the shake setting is on. Android asks no permission for it, and your movement is never stored or sent.
• Biometric and fingerprint — the optional app lock. Your fingerprint or face is checked by Android and never reaches Lumis.
• Notifications, background service, wake lock, and run-at-startup — these run the scheduled local backup so it can complete even when the app is closed. They do not send anything anywhere.

Lumis does not ask for your location, contacts, camera, microphone, SMS or call log, and cannot read them.

This website

https://lumis.money uses Google Analytics to count visits and to see which pages people read, and to count clicks on the app-store buttons so we know how many people are waiting for the app. Google Analytics sets cookies in your browser and records a shortened version of your IP address, your approximate region, and details about your browser and device.

That is all it is used for. There is no advertising on this site, no remarketing, and no data is sold or passed to anyone else.

If you would rather not be counted, blocking analytics in your browser, using an ad or tracker blocker, or Google’s own opt-out add-on will all stop it. Nothing on this site stops working if you do.

The website and the app are separate. Visiting this page tells us nothing about what is in your app, and using the app tells us nothing about this page.

Who this policy is from

Lumis is published by Lumis.money, the developer name shown on our Google Play listing, operating from Azerbaijan.

This policy covers the Lumis app and this website. Questions about it, or about your data, go to support@lumis.money.

Children

Lumis is intended for adults managing their own money. It is not directed at children, and we do not knowingly collect anything from them.

Your data, your control

Because your records are only on your phone, you do not have to ask us for them, and there is nothing of them for us to delete on your behalf.

• To take your data out, use Export in the app.
• To have a feedback report you sent deleted, email us, as described in Feedback you choose to send.
• To delete everything, uninstall Lumis, or clear its data from Android’s app settings. Both remove the database and any backups the app has written to its own folder. This cannot be undone.

Crash reports cannot be traced back to an individual person by us, so we are not able to find and remove one on request.

Changes to this policy

If Lumis ever gains something that changes this — an account, syncing between devices, sharing with someone else, or a backup that leaves your phone — this page will be updated in the same release, and the date at the top will change. We will not quietly widen what is collected while leaving this text as it is.

Contact

Questions about this policy, or about your data: support@lumis.money