Privacy Policy

The website, in short

The website has no accounts, no forms, no shopping cart and no comments. It sets no cookies and stores nothing in your browser. It loads nothing from third-party servers — the fonts are served from this domain, not from a font network.

Two things involve your data on the website: the hosting provider keeps ordinary server logs, and privacy-preserving analytics count visits without identifying you. If you email, the email lands in a mailbox. On the website, that is the whole of it.

The Lumen app, in short

Lumen is a self-reflection app. You answer questions about yourself, and it uses AI to generate a personal map and gentle insights you can return to over time. Doing that means the app collects and stores what you write — which is often personal — along with an account identifier and the usual technical data an app needs to run.

The sections further down set this out in full: what is collected, who processes it, how the AI works, how long it is kept, and how to delete it. If you are reading this to satisfy yourself before installing, read those.

Cookies and browser storage (website)

The website sets no cookies, and there is no cookie banner because there is nothing to consent to. Nothing is written to local storage or session storage either.

That is a deliberate design choice, and it is checked rather than claimed: an automated test loads the site in a clean browser and inspects what it leaves behind.

Server logs (website)

The website is hosted on Vercel. Like any web server, Vercel records requests: your IP address, the page requested, the time, the referring page, and your browser's user-agent string. These logs exist to keep the service running and to investigate abuse and faults.

They are held by the hosting provider under its own retention schedule and are not used to build a profile of you.

Analytics (website)

The website uses Vercel Web Analytics and Vercel Speed Insights. Both are cookieless. They report aggregate figures — how many people viewed a page, how quickly it loaded and responded — rather than the behaviour of an identifiable individual, and they do not follow you to other sites.

If you email us

The contact link on the website opens your own email program with a message template. Nothing is submitted through the website, and it never sees what you write. Your message goes directly to mariiakirpichnikova@gmail.com.

That mailbox is a Gmail account, so Google processes the message as part of delivering and storing it. Please bear that in mind before sending anything genuinely confidential — if you would rather sign a mutual NDA first, ask, and we will.

We keep business correspondence for as long as it takes to deal with your enquiry, and for up to three years afterwards so we can pick up an old thread. Ask and we will delete it sooner.

Lumen — what it is, and what it is not

Lumen is a tool for self-reflection. It is not therapy, not diagnosis, not medical advice, and not a replacement for professional care. The insights it generates are hypotheses, not conclusions about you.

It matters here because the questions invite honest, personal answers — about your goals, relationships, self-esteem, and how you are doing with sleep, energy, stress, anxiety and your emotions, as well as your finances and financial confidence. That content is sensitive, and the rest of this policy treats it that way.

Lumen is not a crisis service. If you are in crisis, please contact a professional, someone you trust, or your local emergency services. The app surfaces support resources in its settings, but it cannot and does not monitor you for your safety.

What the Lumen app collects

When you use Lumen, the app collects:

• Your reflections — the answers you write, daily check-in notes, and the maps and insights generated from them. This is the heart of it, and it can include what you tell the app about your health, sleep, stress, emotions and finances.
• An account identifier. You can use the whole app signed in anonymously, in which case the identifier is a random one with no name attached. Your name and email are collected only if you choose to connect Apple or Google.
• Voice input, if you use it. Audio is sent for transcription and then discarded — it is not saved in the app, in storage, or in analytics, and the temporary file is deleted straight after.
• Device and diagnostic data — a device or installation identifier, a push token if you enable notifications, and crash reports — so the app can run, reach you, and be fixed when it breaks.
• Subscription and purchase state, if you subscribe, so the app knows what you have access to.
• Basic product-interaction analytics — which screens and features are used — kept minimal and not used to track you across other apps or sites.

How your answers are processed by AI

To generate your map, Lumen sends your answers to large-language-model providers acting on our behalf: Anthropic for the analysis, and OpenAI for voice transcription and for parts of the image generation. They process your text to produce the result and return it; they act as our processors, not as independent controllers of your data.

Under Anthropic's standard commercial API terms, inputs and outputs are retained by them for a limited period — currently up to 30 days — for operational and safety purposes, and are not used to train their models. OpenAI processes the transcription request transiently. We do not send your reflections to either provider for any purpose other than producing your result.

Because reflections can carry heavy content, the analysis may flag material that suggests you are in distress, so the app can show you support resources. This is a safety feature, not surveillance, and — to say it again — Lumen is not a crisis service.

The app's service providers

Lumen relies on these processors, each handling only what its job needs:

• Google Firebase — authentication, database (Firestore), cloud functions, file storage, push messaging, remote configuration, and crash reporting (Crashlytics).
• Google Sign-In — if you choose to sign in with Google.
• PostHog (EU Cloud) — product analytics, hosted in the EU, with session replay and location lookup switched off.
• Adapty and Apple StoreKit — subscription and purchase state.
• Anthropic — analysis of your answers to generate your map.
• OpenAI — transient voice transcription and image generation.

Analytics and tracking in the app

Lumen does not track you. It shows no App Tracking Transparency prompt because it does not combine your data with third-party data for advertising, does not share data with data brokers, and runs no ad networks.

Its product analytics (PostHog) are EU-hosted, with session replay off and location lookup off, and the subscription SDK is configured not to collect your advertising identifier or IP address for tracking. Analytics tell us whether the app works, not who you are.

Subscriptions

Some of Lumen is free and some requires a subscription. Payment is handled by Apple through the App Store, with Adapty managing entitlements on our side. We can see what you are entitled to and your purchase history; we never see your card number.

Why we are allowed to do this

Under the GDPR every use of personal data needs a legal basis. For the website they are our legitimate interests in running a working, non-abused, understandable site, and — for email — taking steps at your request. For the Lumen app:

• Providing the app: performing our contract with you — creating your account, generating and storing your maps, running the service (Article 6(1)(b)).
• Sensitive answers: to the extent what you choose to share reveals data about your health or emotional state, we rely on your explicit consent, given when you accept the in-app disclaimer and choose to answer (Article 9(2)(a)). You can withdraw it by deleting the content or your account.
• Diagnostics, security and minimal analytics: our legitimate interest in keeping the app working, safe and improving, kept proportionate (Article 6(1)(f)).

Sharing your reflections is your choice. You do not have to answer any question, and you can stop and delete what you have written at any time.

International transfers

Some processors are outside the EEA — Google, Anthropic and OpenAI are US-based; PostHog is hosted in the EU. Transfers outside the EEA rely on the safeguards in each provider's data processing agreement, which include the European Commission's standard contractual clauses and, where the provider is certified, the EU–US Data Privacy Framework.

Keeping and deleting your app data

Your reflections and maps are kept while your account is active, so you can come back to them. You can delete an individual map in the app, and you can delete your account and its data from the app's settings, or by emailing us.

Deleting removes your content from our database and storage. Copies sent to the AI providers for processing are transient and expire under their retention, described above. If you cannot reach the setting, write to mariiakirpichnikova@gmail.com and we will do it for you.

Your rights

Under the GDPR you can ask us to give you a copy of your personal data, correct it, delete it, restrict what we do with it, or hand it over in a portable format. You can object to processing we base on legitimate interest, and where we rely on consent you can withdraw it at any time without affecting what came before.

To use any of these, write to mariiakirpichnikova@gmail.com, or use the controls in the app. We will reply within one month. We will not charge you, and we will not ask you to explain yourself.

If you have only visited the website and never emailed or used Lumen, there is nothing tied to you for us to retrieve — the website holds nothing about you.

Complaints

If you think we have handled your data badly, please tell us first — it is usually faster. You also have the right to complain to the Agencia Española de Protección de Datos (AEPD), or to the supervisory authority in the EU country where you live or work.

What we do not do

• No advertising networks, no retargeting pixels, no cross-app or cross-site tracking.
• No selling or renting of personal data. Ever, to anyone.
• No sharing of your reflections with anyone beyond the processors named above, and then only to run the service.
• No automated decision-making that produces legal or similarly significant effects about you.
• No marketing email — we do not run a mailing list.

Children and age

The website sells business services and is not directed at children; we do not knowingly collect data about anyone under 14, the age of digital consent in Spain.

Lumen is intended for adults. Given what it asks about, it is not meant for anyone under 18, and it is not directed at children. If you believe a child has used it and given us their data, write to us and we will delete it.

Changes

If this policy changes materially, the date at the top of the page changes with it, and — for the app — a current version is always the one published at this address, which the app links to.