Lume — Privacy Policy
Lume (“the app”) is a digital planner made by Envoolab. It is built local-first: your data belongs on your device, and the app is fully usable without creating an account.
What we collect
Nothing, by default. Everything you put into Lume — agendas, habits, journal entries, to-dos, photos, mood ratings — is stored in a database on your device. If you never create an account, none of it is ever transmitted anywhere.
If you create an account (optional, used for multi-device sync and encrypted backup), we process:
- Your email address — your account identifier and the way we confirm you own the account. We use it to send confirmation codes and account notices. Never for marketing without separate consent, never sold, never shared.
- A cryptographic key created on your device and a device name/platform label, so you can see and revoke the devices connected to your account. Lume has no passwords; this key is how your device proves it is yours.
Sync and backup are end-to-end encrypted
When sync is on, your content travels and is stored as end-to-end encrypted data. Encryption keys are created and kept on your devices and are never sent to us. Our servers cannot read your agendas, journal, photos, or anything else you write in Lume — they store sealed data they cannot open, and this is a design guarantee, not a policy choice.
Health data stays on your device
If you connect Lume to Health Connect (Android) or Apple Health (iOS), the app reads the metrics you approve — steps, active energy, exercise, sleep, distance — on your device only, to show them alongside your planner. Health data is never transmitted off your device, never stored on our servers, never sold or shared, and never used for advertising. Disconnecting in Settings (or revoking access in Health Connect) stops all reading immediately. Lume never writes to your health store.
Photos
Photos you add to agenda pages are stored on your device. With sync enabled, they are uploaded only as end-to-end encrypted files we cannot open. Camera and gallery permissions are used solely to let you add photos; Lume does not scan your library.
Subscriptions and purchases
Lume Pro is an optional subscription sold through Google Play (Android) or the App Store (iOS). The store is the merchant of record: it takes the payment, holds your payment details and manages renewals and cancellations. We never see your card or bank details. The current price is shown in the store, in your local currency, before you subscribe; a subscription renews automatically at the end of each period unless you cancel it in your store account at least 24 hours before the period ends.
To know whether a subscription is active on your account, the app includes the RevenueCat SDK, and RevenueCat, Inc. (San Francisco, USA) processes purchase data on our behalf. What it receives:
- the purchase and receipt data the store issues — product, price, currency, transaction dates and a store-scoped transaction identifier;
- a random account identifier assigned by our server when you have an account, or a random anonymous identifier the SDK creates when you don’t — never your email address;
- basic device information — platform, operating system version, app version, the identifier your device assigns to our app (on iOS the “vendor” identifier), and your IP address as part of any internet request.
It does not receive your planner content, your health data or your photos. The app never enables the collection of advertising identifiers. RevenueCat uses this data only to validate purchases and keep your subscription status in step across your devices; it does not sell it, use it for advertising or profile you. It processes the data under a data processing agreement with standard contractual clauses for transfers outside the EU; its own policy is at revenuecat.com/privacy.
Purchase records are kept for as long as your account (or the anonymous identifier) exists, and for as long as tax law requires the store to keep its own. Write to privacy@envoolab.com and we erase the record RevenueCat holds under your account identifier within 30 days; deleting your account in the app does not do this by itself, because the purchase belongs to your store account, not to Lume.
What we don’t do
- No advertising, and no advertising SDKs.
- No analytics or tracking SDKs; we do not profile you. The purchases SDK above is not an analytics SDK and collects no advertising identifier.
- No selling or renting of data — there is nothing readable to sell.
- No data sharing with third parties, except two processors acting on our behalf: the cloud infrastructure that stores the encrypted data (Microsoft Azure), which cannot read it, and RevenueCat, which processes subscription purchases (see Subscriptions and purchases).
Data retention and deletion
Your local data lives on your device and is yours to delete by clearing the app’s data or uninstalling. Account data (email, device list, encrypted blobs) is kept while your account exists.
To delete your account and everything stored for it, open Settings → Delete account in the app. It takes effect immediately: the account, every enrolled device, your encrypted backup, any encrypted photos, push tokens and voucher grants are removed permanently, with no recovery window. If you no longer have the app, use our account deletion request page or email privacy@envoolab.com; we delete within 30 days.
Deleting your account in the app also erases the planner on that device. Your agendas, habits, journal, photos, reminders and settings are removed with it, and Lume starts over as if newly installed. A deletion requested by email does not reach your devices: clear the app’s data or uninstall it to remove what is on them.
Children
Lume is not directed at children under 13 and we do not knowingly collect data from them.
Your rights (GDPR)
Envoolab is based in Romania and complies with the GDPR. You may request access, correction, export, or erasure of your account data at privacy@envoolab.com. Legal bases: performance of a contract (providing sync you asked for) and legitimate interest (account security). You may lodge a complaint with your supervisory authority (in Romania: ANSPDCP).
Changes
We will post any changes to this policy at this URL, with the effective date above updated. Material changes will be announced in the app.