Privacy Policy
Overview
Lume works offline. Everything you enter stays on your Mac unless you deliberately turn on sync, and if you do, it is encrypted on your device with a key only you hold before it is uploaded. We store that encrypted data. We cannot read it.
This page describes exactly what leaves your Mac, in which circumstances, and what we can and cannot see. Where something is a limitation rather than a guarantee, it says so.
What we collect
With sync turned off - the default - the Lume app collects nothing. Specifically:
- No account or registration is required to use the app.
- No analytics or usage tracking is implemented in the app.
- No crash reporting is sent to any server.
- No advertising identifiers are used.
- No third-party SDKs that collect data are included.
This website
The app and this website are separate, and the list above describes the app. This website does use analytics: Vercel Analytics and Speed Insights, which record page views, referrer, approximate region, device type and page performance, plus a count of clicks on the App Store link. It is cookieless and we do not use it to identify or profile individual visitors.
It is mentioned here because the app's "no tracking" promise is a real one, and it would be worth less if the site quietly did the opposite.
Local storage
All financial data you enter - income, expenses, account balances, holdings, and settings - is stored in your Mac's local storage, inside the app sandbox. The app also writes periodic local backups to your Mac. None of this leaves your device unless you turn on sync.
Sync, and why we cannot read it
Sync is optional and off until you turn it on. When you do, you create an account with an email address and choose a passphrase.
Your passphrase is never sent to us. It stays on your Mac, where the app uses it to derive an encryption key (Argon2id). That key encrypts your data (AES-256-GCM) before anything is uploaded. What arrives on our server is an opaque block of ciphertext.
A separate value is derived from the same passphrase and used as your account password, so that you can sign in. It is derived along a different path and cannot be worked backwards into your encryption key. We store only a hash of it, as any service does.
What we can see is therefore limited to: your email address, that authentication value, the encrypted block itself, its size, and the times it was written. What we cannot see is anything inside it - no balances, no accounts, no holdings, no notes.
When you turn on sync you are shown a recovery code, once. It is the second way into your data: if you forget your passphrase, the code proves to us that the account is yours so we can let you set a new one, and separately unwraps your data on your device. We never see the code itself - only a value derived from it that proves possession and opens nothing.
To be clear about what that code is: it does not expire, and using it does not spend it. Recovering with it replaces your passphrase, not the code - the same code keeps working afterwards, and the app has no way to issue you a different one. Treat it as a permanent key to your vault rather than a one-time token. If you think someone else has seen it, deleting the account and setting sync up again is the only way to retire it.
Losing both is final. Without your passphrase and without your recovery code, nobody can open your vault, including us. That is the direct consequence of not being able to read it, and there is no reset that restores your history. Keep the recovery code somewhere separate from your passphrase, and keep exporting backups.
If you ask macOS to keep you signed in on a Mac, the derived key is stored in that Mac's Keychain, so the app can unlock without asking again. Turning that off deletes it.
Market prices
If you track stocks or crypto, the app fetches end-of-month prices through our own endpoint rather than contacting a market-data provider directly. A request carries a ticker symbol (for example "VWCE.DE") and the month being priced.
To be precise about the limitation: like any web request, these reach our server with your IP address attached, so this path is not anonymous in the way the encrypted vault is. We do not link those requests to your account, and prices are cached and shared across all users rather than stored per person - a ticker is usually fetched once for everybody. But we would rather state the caveat than imply a guarantee we are not making. Price fetching is optional; the app works without it.
Where data is processed
Encrypted vaults are stored in the European Union (London). We use Supabase for database and authentication, and Vercel for hosting and the price endpoint. Neither can read your financial data, for the same reason we cannot: it is encrypted before it reaches them.
Data export and deletion
You can export everything as CSV or JSON at any time; exports are written to your Mac and are not transmitted by the app.
Signing out of sync removes the stored key from that Mac. You can delete your account and the encrypted data held for it from inside the app, under Settings, and it is removed immediately - because we cannot read that data, deletion is the only operation we can meaningfully perform on it. Deleting your account does not touch the copy on your Mac: Lume keeps working offline with your history intact, and only syncing stops.
Children's privacy
Lume is not directed at children under 13, and collects nothing from anyone who does not turn on sync.
Changes to this policy
If this policy changes, the updated version will be posted at this URL, with the date above amended.
Contact
Questions? Reach out at henriquejcpacheco@gmail.com.