Security

Lumo is not end-to-end encrypted. Your data is stored on our servers in a form our systems can read, because the server works out your number for today, your cycles and your Insights. Here is what we do to protect it, and what we do not.

In transit and at rest

Everything between the app, the website and our servers travels over TLS. Our database provider, Convex, stores data in the United States on Amazon Web Services and encrypts it at rest.

Signing in

You sign in with Google. Lumo never sees or stores a password.

One phone at a time

Your account works on one phone at a time. When a new phone signs in, it waits until you let it in. You can:

• Approve it from your current phone. Lumo sends a notification with Approve and Decline buttons.
• Enter one of your recovery codes on the new phone.
• Reset by email. We send a 6-digit code to your account's email address. It expires after 15 minutes and allows 5 tries. After you enter it, the new phone gets access 24 hours later. Your old phone gets a notification and can cancel the reset during that time.

Settings, then Devices, shows which phone has access and lets you sign others out.

Recovery codes

Lumo makes 8 recovery codes when you ask for them and shows them once. We store a SHA-256 hash of each code, not the code itself. Each code works once. Wrong guesses are limited to 5 every 15 minutes. Making a new set cancels the old one, and you need your approved phone to do it.

On your phone

• App lock uses your phone's fingerprint, face or passcode. Lumo only learns whether the check passed. You choose when it locks: immediately, or after 1, 15, 30 or 60 minutes away.
• Your session token is kept in the phone's secure storage (Keychain on iPhone, Keystore on Android).
• Android backups are turned off for Lumo, so your data does not end up in a cloud backup of the phone.
• Crash reports have amounts, notes and server call details removed before they leave your phone.

Who can see your data

The developer of Lumo can see account data through an admin tool. We use it for support you ask for, for security work such as approving or resetting a phone, and to fix problems. We do not browse accounts for any other reason.

Only allowlisted accounts can use the admin tool: either by account ID, or by an email address that is verified with the sign-in provider. An unverified email on the list is refused. Every change an admin makes to an account, a plan or a limit is logged with who made it and when. The services that process data for us are listed in the Privacy policy.

What we do not do

• No end-to-end encryption. Someone with access to our servers could read your entries.
• No link to your bank, so there are no bank logins to steal.
• No independent security audit yet, and no paid bug bounty.
• No second sign-in factor of our own. Your Google account's own 2-step verification protects your sign-in, so turn it on.

If something goes wrong

If a breach puts your data at risk, we will tell the regulators that require notice, within 72 hours where the law sets that limit, and we will tell affected users without delay.

Report a problem

If you find a security issue, email 99marafay@gmail.com with "Security" in the subject. Tell us what you found and how to reproduce it. Please give us a chance to fix it before you share it publicly. We reply within 2 working days.