Sync, Recovery, and Deleting Your Account
Lume works entirely offline and does not need an account. Sync is something you turn on if you want your history on more than one device - a Mac and an iPhone, or two Macs - and because your data is encrypted before it leaves your device, there are a few things worth understanding before you do.
1. What sync actually does
When sync is on, Lume encrypts your data on your device and uploads the result. What we store is ciphertext. We cannot read it, and neither can Supabase or Vercel, who host it for us.
From Lume 1.5, your data goes up as many small encrypted pieces rather than one block, so a change sends only what changed and two devices editing different months never get in each other’s way. Each piece is filed under a code we cannot work back to its name. What we can see is how many pieces there are, roughly how big, and when they change - never what they are.
Your passphrase never leaves your device. It is used locally to derive the key that encrypts your data, and separately to derive the value that signs you in - along a different path, so one cannot be worked backwards into the other.
The direct consequence: we cannot reset your passphrase for you, and we cannot recover your data if you lose your way in. That is what makes the encryption meaningful, and it is why the recovery code below matters so much.
2. Turning it on
Go to Settings → Sync and press Turn on sync. Enter an email address and a passphrase, and press Continue.
If no account exists for that email, Lume asks whether to create one. Read that dialog carefully. We cannot tell a new email address from a mistyped passphrase, so confirming it with a typo gives you a second, empty encrypted copy rather than your existing data. Check the passphrase before you confirm - you can press the eye icon to reveal what you typed.
Pick a passphrase you will not forget. Length beats complexity: a few unrelated words are easier to remember and harder to crack than a short string of symbols.
3. Confirming your email
We send a confirmation link to the address you used. Open it, and you will land on a page confirming the account is active.
Check your spam folder if it does not arrive. Lume is a new sender, and new sending domains are filtered by default until they build a reputation - this is normal and not a sign anything is wrong. If it is still missing after a few minutes, the sign-in form has a Send it again link.
You must complete this step. Until you do, the account exists but is not usable, and you will not have been given a recovery code.
4. Save your recovery code
After you confirm your email and sign in, Lume shows you a recovery code - eight groups of four characters. This is the only time it is displayed.
Copy it somewhere safe and separate from your passphrase: a password manager, or printed and put somewhere physical. Storing it next to your passphrase defeats the point, since anything that exposes one exposes both.
Some specifics that are easy to get wrong:
- It does not expire. The code stays valid for the life of the account.
- Using it does not spend it. Recovering replaces your passphrase, not your code. The same code keeps working afterwards.
- It can be replaced. From Lume 2.0, Settings → Sync → Recovery code → Replace… issues a new code and retires the old one. Earlier versions have no way to issue a different one.
- Case and dashes do not matter when you type it back in.
Anyone who has the code can open your data, so treat it as a key to your encrypted copy rather than a one-time token. If you believe someone else has seen it, replace it: the new code is shown once, your data is not re-encrypted, and your passphrase and your other devices are unaffected. The old code stops opening your account straight away; automatic backups already on a device were sealed with it and keep opening with it until they roll over. On a version without Replace…, deleting the account and setting sync up again is the only way to retire a code.
5. Staying unlocked on this device
Tick Stay unlocked on this Mac - or on this iPhone - and Lume stores the unlock key in that device’s Keychain, so it opens without asking for your passphrase each launch. On a Mac, macOS will ask your permission the first time.
This is a convenience with a real trade-off: what is stored is equivalent in power to the passphrase itself. Leave it off on a shared machine.
On iPhone you can also turn on Settings → Privacy → Require Face ID (or Touch ID, or your passcode, depending on the phone). Lume then stays covered - in the app switcher too - until you unlock it, which pairs well with staying unlocked. It is set on each iPhone separately and is not synced.
Forget this device deletes that stored key. Lume will ask for your passphrase again on the next launch, and your account is otherwise untouched.
6. If you forget your passphrase
This is what the recovery code is for. On the sign-in form, next to Forgot your passphrase?, use Recover with your recovery code.
Enter your email, your recovery code, and a new passphrase, then press Recover account.
Your data is not re-encrypted and nothing is lost. Only the wrapped copy of the key changes, so your full history is exactly as you left it. Your old passphrase stops working; your recovery code keeps working.
7. Updating Lume
The first time Lume 1.5 syncs, it converts your encrypted copy to the new format and tells you so. From then on, older versions of Lume can no longer sync with your account - they say Update Lume on this device to keep syncing, and their own copy of your data stays as it was. Update Lume on each of your devices; once updated, they sync as before.
Lume 2.0 does the same once more, so that the categories you give statement lines sync safely: the first time it syncs, it upgrades your encrypted copy and tells you so, and from then on Lume 1.5 can no longer sync with your account. Update Lume on your other devices too.
8. If you lose both
If you have neither your passphrase nor your recovery code, your data cannot be opened. Not by you, and not by us - we hold ciphertext and no key, so there is no reset that restores your history.
This is the honest cost of encryption we cannot bypass, and it is worth planning around rather than discovering. Keep exporting backups from Settings → Data → Backup → Export, on either device - from Lume 1.5 the iPhone exports too, through the share sheet. Exported backups are saved where you choose, in the clear, so store them somewhere you trust - but they are the copy that does not depend on remembering anything.
9. If Lume says it can’t open your data
From Lume 1.5, your data is also encrypted on the device itself, with a key kept in that device’s Keychain. If that key is ever missing - after moving to a new Mac without your Keychain, say - Lume shows Lume can’t open your data rather than an empty app. It deletes nothing. You can:
- Try again, after unlocking the Keychain or allowing Lume to use it.
- Restore a backup - one of the three automatic backups Lume keeps on each device - with your sync passphrase or recovery code. This is offered for backups made while sync was on.
- Start fresh. The data Lume could not open is moved to a folder beside the new one. With sync on, signing in brings your history back; otherwise restore an exported backup.
The automatic backups are also under Settings → Data → Automatic backups, where you can restore one at any time.
10. Deleting your account
Go to Settings → Sync → Manage sync, press Delete account, and type your email address to confirm.
This deletes your account and the encrypted copy we hold, immediately and permanently. Because we cannot read that data, deletion is the only meaningful operation we can perform on it - there is no archive and no undo.
Your data on this device is not deleted. Lume keeps working offline with your full history intact. Only syncing stops. If you want to remove the local copy as well, use Settings → Delete all data afterwards - and export a backup first if there is any chance you will want it back.
Questions? Reach out at henriquejcpacheco@gmail.com.