Privacy policy
Updated
This policy covers the Lumo app for Android and iPhone and the website lumocash.com. Lumo is made by Syntax Lab Technology, the developer name on Google Play.
The short version
- You type in your money. Lumo stores it on its servers so the app can work out what you can spend today.
- We do not sell your data, show ads, or track you across other apps and sites.
- Receipt scanning is optional. When you use it, the photo goes to an outside AI service. Everything else in the app is plain arithmetic.
- Catch payments is optional and Android only. It reads payment alerts from the apps you pick. The message text stays on your phone and is deleted after 7 days.
- The app sends usage events and crash reports so we can find bugs and see which features get used. They never hold amounts, notes or names, and one switch turns them off.
- You can export everything and delete everything, from the app or by email.
- Lumo is not end-to-end encrypted. We can technically read what you store, and we only do so for support or security.
Who we are
Syntax Lab Technology is the data controller for Lumo. Contact us at 99marafay@gmail.com. That address handles privacy requests, support and security reports.
What we collect and why
| Data | Why | Legal basis |
|---|---|---|
| Google account email and user ID | Sign in, contact you about your account | Contract |
| Name and profile photo from Google | Show your profile in the app. Stays with Google and on your phone, not in our database | Contract |
| Entries: amount, date, description, category, payment method, notes, receipt line items | The core of the app | Contract |
| Income, payment history, savings, budget cycles, plan settings | Work out your number for today, Insights and Savings | Contract |
| Loans: the name of the person, an optional contact detail, notes, repayments | The Loans feature | Contract |
| Setup answers and preferences: currency, budget, categories, payment methods, reminder times, time zone | Set up the app and send reminders at the right time | Contract |
| Push notification token and platform | Send notifications | Consent (your phone's notification permission) |
| Notification history | The list of notifications inside the app | Contract |
| Device ID, device model name, a hash of your session token, approval status and times | One phone at a time, approving new phones, security alerts | Legitimate interest (keeping your account safe) |
| Recovery codes, stored only as SHA-256 hashes | Let you move to a new phone without the old one | Legitimate interest |
| Device reset requests: your email and a hash of the one-time code | Reset access by email when you lost your phone and your codes | Legitimate interest |
| Your plan, and any plan or higher limit we gave you with its end date | Apply your plan's limits | Contract |
| Usage counters per feature per month, for example receipt scans used this month, and the last time a limit stopped you | Plan limits, and helping you when you contact support | Contract |
| Prediction totals: your spending per month and by category, worked out from your entries once a day, or when you tap refresh | Insights and the next-month prediction | Contract |
| Activity times: when the app last checked in, when your reminders are next due and were last sent, when your cycle last reset | Send reminders on time, count active users | Legitimate interest |
| Account status: active, deactivated or suspended, the reason, and when it changed | Enforce the Terms and keep Lumo safe | Legitimate interest |
| Admin action log: which admin changed what on your account, when, and the reason | A record of every admin change | Legitimate interest |
| Trial record: account ID, a hash of your email (anyone who already knows the email could match it), trial end date | Stop the same person starting free trials again | Legitimate interest |
| Receipt photo, only when you tap scan | Fill in an expense for you | Contract, on your request |
| Caught payments, only with Catch payments on: amount, currency, money in or out, the place or person named, a reference number, the time, which app it came from | Offer the payment as an entry, or add it for you | Consent (the Catch agreement and Android's notification access) |
| Places you added from Catch: the place, and the name, category and payment method you gave it | Fill in the next payment at that place | Consent |
| Catch settings: on or off, Ask or Add on its own, the apps you picked, and when you agreed to which version of the Catch terms | Run Catch the way you chose, and show you agreed | Consent |
| Feedback you send from the app: message, email, app version, platform | Answer you and fix problems | Legitimate interest |
| Usage events and crash reports, unless you turn them off | Find bugs and see which features get used | Legitimate interest |
| Messages from the website contact form, iPhone waitlist sign-ups | Answer you, tell you when Lumo is on iPhone | Legitimate interest, consent for the waitlist |
On Android the device ID includes the phone's Android ID. On iPhone it is a random ID that Lumo creates.
We do not collect your location, contacts, bank logins, card numbers or advertising ID. Lumo does not connect to your bank. The app asks for camera access (for receipt scans) and notification permission, both optional. It reads other apps' notifications only if you turn on Catch payments, below.
Catch payments
Catch payments is optional, Android only, and off until you agree to its terms in the app and give Lumo notification access in Android settings. Lumo uses notification access for Catch payments and nothing else.
What it reads
With Catch on, the app reads notifications from the payment apps you pick in Settings > Catch payments: SadaPay, NayaPay, JazzCash, Easypaisa, Google Wallet, Meezan and, only if you turn it on, SMS from bank senders. It ignores every other app, texts from senders that are not banks or wallets, and one-time codes. No AI reads your notifications, and none of it is used for ads.
What stays on your phone
The text of an alert stays on your phone. Lumo keeps it so you can see what a payment came from, and deletes it after 7 days, including alerts it never managed to send. The phone also keeps when it last heard from each app, so Settings can show that Catch is working. Signing out or turning Catch off deletes all of this.
What reaches our server
For each alert that reads as a payment, the app sends the payment only: the amount, currency, money in or out, the place or person named, a reference number, the time, which app it came from and an ID the phone uses to send it once. The text of the alert is never sent.
What happens next is your choice. With Ask, Lumo shows the payment in Needs and as a notification, and you add it, change it or say it was not spending. With Add on its own, a purchase at a place you added before is added as an entry straight away, and you can undo it from the notification. Money coming in, and a payment that looks like one of your bills, always ask first. When you add a payment, Lumo remembers the place with the name, category and payment method you gave it, to fill in the next one.
Turning it off
Turn Catch off in Settings > Catch payments. Reading stops on the phone at once, and the payments still waiting for an answer are deleted from our server. You can also remove Lumo's notification access in Android settings at any time. Entries you already added stay, like any entry.
When you add a loan, you give us the name, and maybe a contact detail, of someone else. We store it only so you can track the loan. Please only add what you need.
Receipt scanning and AI
Scanning is optional and you can always type an entry by hand.
When you tap scan, the app sends the photo to our server, which sends it through OpenRouter to an AI model that reads the merchant, date, total and line items. You review the result before anything is saved. Lumo does not store the photo. It is held in memory for the scan and then dropped. The lines you save become part of the entry.
OpenRouter passes the photo to the company that runs the model. We try a free model first. Its host may keep the photo for a time and use it to improve its models. When the free model is busy a paid model reads the receipt, and for paid models we only use hosts that OpenRouter lists as not collecting what they receive. The models can change; this rule does not. Do not scan anything you would not want a third party to see.
Each scan is counted in PostHog, our analytics service, with your account ID, the AI model used, how long it took, what it cost us and, if it failed, why. A scan that fails because of a fault on our side is also reported to Sentry with your account ID and the reason. The photo, the text read from it and your email address are not sent to either.
Your number for today, Insights and the next-month prediction are worked out with plain arithmetic on your own entries. No AI is involved.
Analytics and crash reports
The app sends usage events to PostHog and crash reports to Sentry. One switch turns both off.
Usage events
The app sends an event when you use a feature. That covers signing in and out, approving a new phone, using a recovery code, each setup step, adding, editing or deleting an entry, scanning a receipt, bills, currencies, savings, lending, income, searching and filtering Activity, Insights, export and import, changing a setting, opening a reminder, reaching a plan limit, and deleting your account. It also sends which screens you open, when you open the app, and when the app turns off its lock because your phone has no screen lock.
An event is made of fixed words, yes or no answers and small counts. Adding an entry sends whether it had a note and whether it was in another currency. Finishing setup sends your currency, how many income streams, bills and savings currencies you added, whether you set a savings plan, and whether you allowed notifications. Amounts, notes, search text and the names of merchants, bills, people and categories are never included. Screens are sent by kind, such as the entry screen, never which entry.
Catch payments also sends events: turning it on or off, which mode and whether that started from onboarding, Needs or Settings, seeing and answering the suggestion to try it, opening the Catch screen, each setup step reached, changing the mode or the apps it reads, opening a fix in Android settings, undoing an added payment, for each alert it reads which app it came from and whether it read as a payment, adding or dismissing a caught payment, and reaching the monthly limit. Each time the app starts, it reports whether notification access and the battery setting are on, how many times Android stopped it from starting, and how many bank alerts Android hid from it. These events carry no amounts, places, people or message text either.
Each event carries your account ID, app version, operating system, device model, language and time zone. Your request reaches PostHog from your IP address, as every internet request does, but the app tells PostHog not to work out your location from it and PostHog does not keep it. Your analytics profile also holds your plan, your home currency, your theme, and whether you use more than one currency, have bills, or have reminders on.
Crash reports
When the app crashes or hits an error, it sends a report to Sentry, which stores it in Germany. A report holds the error and its stack trace, your phone's model, the operating system and app version, and your account ID. It also holds what the app did just before the error: the names of screens and actions, the web addresses it called, and your phone's state, such as free memory and battery level. So that we can see how many launches end in a crash, the app also tells Sentry each time it is opened, with the app version and an ID for this install, not your account.
Before a report leaves your phone, the app removes the details of server calls, which is where amounts and notes could appear. A crash inside Android or iOS itself is reported as the system wrote it. It attaches no console logs, screenshots or screen recordings. Sentry is set to keep neither your IP address nor the location it could work out from it. Sentry does not get your email address or your name.
Turning them off
Open Settings, then About, and turn off Share usage and crash data. The app stops recording events and crash reports at once; anything already waiting to be sent goes out within a few seconds. While the switch is off, the app does not contact PostHog or Sentry when it opens. The switch starts on. Your choice is stored on the phone, so set it again if you reinstall Lumo or move to a new phone.
The switch covers what the app sends. Our server still counts each receipt scan in PostHog, and still reports a scan that fails because of a fault on our side to Sentry, as described under Receipt scanning and AI. To remove what was already sent, email us and we will delete your analytics profile and crash reports.
Notifications
If you allow notifications, Lumo can send your number for the morning, over-budget alerts, spending and income reminders, and sign-in requests from a new phone. Some of these show amounts, for example "Rs 1,200 left for today". They travel through Expo's push service and then Google Firebase Cloud Messaging or Apple Push Notification service, and they can appear on your lock screen. You can turn each kind off in Settings, or turn notifications off for Lumo in your phone's settings.
Catch payments shows its own notifications with the amount and the place, buttons such as Add and Not spending, and, after it adds a payment, what is left for today. The phone makes these itself; they do not go through a push service. They can appear on your lock screen, and the buttons only act once Lumo's app lock, if you use it, is passed.
Who processes your data
We use these services to run Lumo. Each one processes data for us and only for the purpose listed.
| Service | What it does | Data | Where |
|---|---|---|---|
| Convex | Database and server | Everything stored in your account | United States |
| Google Firebase Authentication | Google sign-in | Email, name, photo, user ID | United States |
| OpenRouter and the model hosts behind it | Reads receipt photos | The photo, only when you scan | United States and others |
| PostHog | Analytics | Events, account ID | United States |
| Sentry | Crash and error reports | Error and stack trace, device and app details, account ID | Germany (EU) |
| Expo, Google Firebase Cloud Messaging, Apple Push Notification service | Deliver push notifications | Push token, notification text | United States |
| Resend | Sends and receives email | Your email address, message contents | United States |
| Vercel | Hosts the website, counts visits | Visit data, see below | United States |
| hCaptcha | Stops bots on website forms | Browser and device signals, IP address | United States |
Sharing data with these services is not a sale. We do not sell or rent personal data, and we do not share it for advertising. We may disclose data if the law requires it, or to protect someone's safety or the security of Lumo.
Transfers outside your country
Lumo's servers and most of our providers are in the United States. If you live elsewhere, your data is transferred there. Sentry stores crash reports in Germany. For providers certified under the EU-US Data Privacy Framework (and its UK extension) we rely on that certification. For the rest we rely on the provider's standard contractual clauses and, for the UK, the UK addendum.
How long we keep it
| Data | Kept |
|---|---|
| Account, entries, income, savings, loans, settings | Until you delete them or your account |
| A deleted entry | 10 minutes, so you can undo, then removed |
| Notification history, device and security records | Until you delete your account |
| Recovery code hashes | Until you make new codes or delete your account |
| Device reset codes | 15 minutes |
| Receipt photos | Not kept by Lumo. Google keeps them for a limited time under its terms |
| Catch payments: the alert text | On your phone only, 7 days |
| Catch payments: caught payments | Answered ones 90 days, ones still waiting or skipped 60 days. An added payment becomes an entry, kept like any entry |
| Catch payments: places you added | Until you delete your data or account |
| Trial record (account ID, email hash, trial end) | After account deletion, to stop repeat free trials |
| Usage counters, plan and limit changes, account status, activity times | Until you delete your account |
| Prediction totals | Until you delete your data or account |
| Admin action log | Kept after you delete your account, as the record of what admins did. It holds your account ID and the reason, not your entries |
| Analytics | PostHog keeps them for 1 year, then deletes them |
| Crash reports | Sentry keeps them for up to 90 days, then deletes them |
| Support email, contact form messages | Until resolved, then up to 12 months, or until you delete your account if sent from its email |
| iPhone waitlist email | Until Lumo launches on iPhone, you ask us to remove it, or you delete your account if it used the same email |
| Website visit hash | 24 hours |
When you delete your account, everything in Lumo goes straight away. Copies in provider logs are gone within 30 days. See Delete your account for the full list.
Your choices
In the app you can:
- Export your data as CSV, JSON or PDF (Settings, then Export or import).
- Edit or delete any entry, loan, income stream or savings record.
- Delete all your data and keep your account, or delete your account (Settings, then Delete data or account).
- Turn each kind of notification off.
- Turn Catch payments off, choose which apps it reads, or switch between Ask and Add on its own (Settings, then Catch payments).
- Turn usage events and crash reports off (Settings, then About).
- Sign other phones out (Settings, then Devices).
For anything else, such as a copy of your data, a correction, deleting your analytics profile and crash reports, or deleting your account without the app, email 99marafay@gmail.com from the Google address you sign in with.
Your rights
Everyone
Wherever you live, you can ask us what we hold about you, get a copy, fix it, delete it, or object to how we use it. We answer within 30 days.
European Economic Area and United Kingdom
Under the GDPR and the UK GDPR you have the right to access, rectify, erase, restrict, port and object to processing, and to withdraw consent at any time without affecting what happened before. Where we rely on legitimate interest, you can object and we will stop unless we have a strong reason that outweighs yours, such as account security. We reply within one month. You can complain to your local data protection authority, or in the UK to the Information Commissioner's Office.
Malaysia
Under the Personal Data Protection Act 2010 you can ask to access and correct your personal data, withdraw consent, and ask us to stop processing that is likely to cause you damage or distress. We answer access and correction requests within 21 days. Giving us your data is voluntary, but without your email and the money you enter the app cannot work.
California and other US states
We do not sell or share personal information as those laws define it, and we do not use sensitive personal information to infer things about you. The categories we collect are listed above. You can ask to know, delete or correct your information, and we will not treat you differently for asking.
Pakistan
Pakistan has no data protection act in force yet. We apply the rights above to you as well.
Age
Lumo is for people 18 and older. If we learn that someone under 18 has an account, we delete it.
Support and admin access
Lumo's admins can see your account's plan, usage and limits, its phones and recent security events, and the admin log for it. We use this to help when you contact us. Admins can change your plan or limits, reset phone access, and suspend or deactivate an account. Each change goes in the admin action log above.
Security
Data travels over TLS and is encrypted at rest by our database provider. Lumo is not end-to-end encrypted. Only one phone can use your account at a time. Read Security for the details, including who at Lumo can see your data.
The website
lumocash.com sets no cookies for tracking. Vercel Web Analytics counts visits without cookies, using a hash of your request that changes every day and is dropped after 24 hours. If you pick light or dark mode, your browser remembers the choice locally. It is not sent to us.
The contact form and the iPhone waitlist load hCaptcha when the form comes into view. hCaptcha may store data in your browser and collect signals about your device to tell people from bots. What you type in the form goes to Convex and, for replies, through Resend.
Changes to this policy
If we make a change that matters, we will tell you in the app or by email at least 30 days before it takes effect. The date at the top shows the current version. Earlier versions are kept in the website's public history.
Contact
Syntax Lab Technology, 99marafay@gmail.com.