Privacy Policy
Last updated: 20 August 2026
To complete before store submission: the publisher's postal address, and an actually working contact email address. This block must be removed from the published page.
In short
Lumeno is a daily introspection app. What you write in it belongs to you. We have built no advertising tracker, no analytics tool, and we never sell your data to anyone.
- You can use Lumeno without ever giving your name or email address: accounts are anonymous by default.
- No advertising, no trackers, no behavioural analytics in the app.
- Your reflections are hosted in the European Union.
- To compose your periodic readings, the text of your reflections is sent to an artificial intelligence provider, without any account identifier. This is detailed below and is the most important part of this document.
- You can delete your account and all your data from within the app, in seconds.
1. Who is responsible for your data
The Lumeno app is published by Matthieu Mary, acting as an individual, residing at [POSTAL ADDRESS TO BE COMPLETED]. As the data controller under the General Data Protection Regulation (GDPR), he determines why and how your data is processed.
For any question or request regarding your data: contact@lumeno.app.
2. What data is processed, and why
We only collect what the app needs to work. None of this data is used for advertising purposes.
| Data | Why | Legal basis |
|---|---|---|
| Account identifier (automatically generated UUID) | Linking your writing to your account without needing your identity | Performance of a contract |
| Your written reflections | The core of the service: keeping them and letting you read them back, year after year | Performance of a contract |
| The feelings attached to each reflection | Enriching your re-reading and composing the periodic readings | Performance of a contract |
| Email address and password (optional) | Only if you choose to secure your account so you can recover it after reinstalling | Performance of a contract |
| First name (optional) | Greeting you by name in the app | Performance of a contract |
| Language and time zone | Showing content in your language and releasing the daily question at the right moment | Performance of a contract |
| Subscription status | Granting access to premium features if you subscribe | Performance of a contract |
| Daily reminder time | Scheduling the reminder notification, if you enable it | Consent |
The anonymous account
On installation, Lumeno creates an anonymous account identified by a random number alone. We do not know who you are. You may then choose to attach an email address, solely so you can recover your writing if you change devices. Doing so remains optional.
The data you write freely
Lumeno is a private journal. You may therefore write things in it that the GDPR considers sensitive: beliefs, health, personal life. We never ask you for such information and do not process it in any specific way, but we want you to know that everything you write is stored and sent to the artificial intelligence provider described in section 4.
3. What we do not do
This list matters as much as the previous one. Lumeno contains none of the following:
- No advertising, no advertising identifier.
- No analytics or behavioural measurement tool (no Google Analytics, Firebase, Facebook SDK or equivalent).
- No selling, renting or trading of your data.
- No access to your location, contacts, microphone, camera or photos.
- No profiling and no automated decision producing legal effects concerning you.
- No push notification sent from our servers: reminders are scheduled locally on your phone.
4. Artificial intelligence and your reflections
This is the most sensitive processing in the app. We would rather explain it precisely than bury it in a general statement.
Lumeno composes periodic readings (weekly, monthly, yearly) that interpret what you wrote during the period. To produce them, the text of your reflections, the feelings attached to them, the questions asked and the theme of the month are sent to OpenAI, a provider based in the United States, through its programming interface.
The key points:
- No identifier accompanies this text. Neither your account identifier, nor your email address, nor your first name is sent. OpenAI receives content, never the identity of the person who wrote it.
- This is still a transfer of personal data, since free text can contain details that identify you if you write them.
- This processing happens when a reading is generated, not every time you write.
- Under OpenAI's data usage policy applicable to its programming interface, content sent through that channel is not used to train its models. That policy belongs to OpenAI and may change independently of us: openai.com/policies/api-data-usage-policies.
- Artificial intelligence is used only to compose these readings. It writes neither the questions nor the quotes, which are written or validated by hand, and it never addresses you directly.
5. Who your data is shared with
We rely on technical providers (processors under the GDPR) who handle data on our behalf, following our instructions, and who cannot use it for their own purposes.
| Provider | Role | Data involved |
|---|---|---|
| Supabase | Database hosting and account management | All of your account data |
| OpenAI | Generating the periodic readings | Reflection text, feelings, questions, theme of the month, with no identifier |
| RevenueCat | Subscription management | Account identifier and subscription status |
| Apple, Google | Payment processing through their respective stores | Transaction data, which we never receive |
| Expo | Building and updating the app | No content data |
| Vercel | Hosting Lumeno's web pages (legal notices, password reset) | No content data |
Your data may also be disclosed where the law requires it, for example under a judicial order.
6. Where your data is hosted
Your database is hosted in the European Union. That is where your reflections are stored.
The only transfer outside the European Union is the one described in section 4, to OpenAI, based in the United States. It is governed by the European Commission's standard contractual clauses, the mechanism set out in Article 46 of the GDPR.
7. How long your data is kept
Your reflections are kept for as long as your account exists. That is the very principle of Lumeno: being able to read in ten years what you wrote today. We do not erase them after some arbitrary period.
When you delete your account, all of your data is erased immediately and permanently from the live database, including your reflections, your feelings, your readings and your email address if you provided one. This deletion cannot be undone and there is no backup copy we could restore for you.
Automatic technical backups of the database are kept by our host for a limited time before being overwritten. They are used only in the event of a major incident, never to restore a deleted account.
8. Security
- All communication between the app and our servers is encrypted (HTTPS).
- Data is encrypted at rest by our host.
- Every table is protected by row level security rules, which technically guarantee that an account can only reach its own data.
- Your password, if you set one, is never stored in clear text.
- Your session is kept on your phone in the operating system's secure storage.
No system is infallible. In the event of a data breach likely to result in a high risk to your rights, you will be informed in accordance with Article 34 of the GDPR.
9. Your rights
Under the GDPR, you have the following rights:
- Access: obtain a copy of the data we hold about you.
- Rectification: correct inaccurate data. Your first name, your language and your reflections can be edited directly in the app.
- Erasure: delete your account and all your data. This can be done immediately from within the app, in your profile settings, without writing to us. If you no longer have access to the app, the same deletion is available from this page, for accounts with an email address.
- Portability: receive your data in a machine readable format.
- Restriction and objection: ask us to suspend a processing operation or object to it.
- Withdrawal of consent: turn off daily reminders in the settings at any time, without giving a reason.
To exercise these rights, write to contact@lumeno.app. We reply within one month.
If you believe your rights are not being respected, you may lodge a complaint with the French data protection authority (CNIL), 3 place de Fontenoy, 75334 Paris Cedex 07, www.cnil.fr, or with the supervisory authority of your country of residence.
10. Changes to this policy
This policy may change as the app evolves. The date of the latest update appears at the top of this page. If there is a substantial change to the data processed or to its recipients, we will tell you in the app.
11. Contact
A question, a request, a doubt: contact@lumeno.app.