Privacy policy

Summary

• We do not sell your data or show ads.
• Your financial data is stored encrypted.
• Luma does not connect to your bank or ask for banking passwords.
• You can delete your account and data from the app at any time.

Data you give us

• Account: name, email, password (stored only as a hash), time zone, language and currency. If you sign in with Apple or Google, we receive the identifier and email those services share with us.
• Financial information you record: accounts and balances, transactions, categories, merchants, notes, income, recurring payments, spending limit, savings goals and exchange rates.
• Groups: the groups you belong to, what you record in them and, only if you consent, your monthly totals of fixed income and committed expenses to calculate contributions (never your transactions).
• Profile photo (optional): we re-encode it and strip its metadata, including location, before storing it.

Data generated when you use the app

• Push notifications: a Firebase installation identifier and your device platform, to send you notifications.
• Biometric sign-in: we store only a hash of a random code your device releases after Face ID or fingerprint. We never receive your face or fingerprint: your phone’s system processes them.
• Purchases: App Store or Google Play receipts needed to verify Luma Premium. We do not receive your card details.
• Security: activity logs (sign-ins, password changes) with your IP address converted to a hash.
• Usage statistics: Firebase Analytics records general app usage (for example, screens and version) without an advertising identifier and without ad personalisation. We do not send amounts, transactions, emails or your Luma identifier to Analytics.

Banking notification capture (Android, optional)

If you turn it on and grant “Notification access”, Luma reads only notifications from the banking apps you add, ignores verification codes and stores only the extracted fields (amount, merchant, date) as drafts you confirm. You can turn it off at any time.

How we use your data

• To provide the service and sync your information across devices.
• To calculate balances, reports, contributions and reminders.
• To send verification codes and the notifications you turned on.
• To verify Premium purchases.
• To protect your account and prevent abuse.
• To improve the app with general usage statistics.
• To handle your support requests.

Who can see your data

Only you can see your personal finances. In a group, its current members see what is recorded in the group and your profile photo; if you leave the group, they no longer see it.

We use providers that process data on our behalf, only to provide the service:

• Hosting provider (server and database).
• Apple: Sign in with Apple, App Store and Apple Push Notification service.
• Google: Google Sign-In, Google Play, Firebase Cloud Messaging and Firebase Analytics.
• Email provider to send verification codes.

We may disclose information if required by law.

Security

• Encryption in transit (HTTPS) and AES-256-GCM authenticated encryption of financial data and your photo at rest, with a dedicated key.
• Sessions stored in the iOS Keychain or Android secure storage.
• Strict isolation between accounts and sign-in attempt limits.

No system is infallible, but we work to protect your information.

Retention and deletion

We keep your data while your account is active. Deleting it erases your profile, photo, sessions and every record linked to you, including shared expenses you created or paid within a group. Group goals you owned pass to the group’s new owner.

We keep only an audit record with a pseudonymised reference (hash) of the deletion. Backups are erased in their rotation cycle.

Your rights

You can view and correct your data in the app, withdraw your consents (notifications, sharing totals, notification capture) and delete your account. You can also request a copy of your data or ask us anything by writing to hola@fernandovasquez.tech.

Children

Luma is not directed to children under 13 and we do not knowingly collect their data.

International transfers

Our providers may process data outside your country. We require them to do so with appropriate safeguards.

Changes to this policy

If we change this policy, we will publish the new version on this page with its date and, if the change is significant, notify you in the app.

Contact

For any privacy question, write to us at hola@fernandovasquez.tech.