Privacy Policy
Lumenpage
Last updated: 13 October 2026 Effective: 13 October 2026
The short version
Lumenpage is a diary, and it needs a free account. What you write is saved on your phone first, and is then synced to our server so it survives a lost phone and reaches your other devices.
We do not read your diary in order to run Lumenpage, and we do not send it to advertisers, analytics, crash reports, or other users. There is no advertising in Lumenpage, no tracking across other apps or websites, and nothing about you is sold. If the law requires a disclosure, that is covered below under "When the law requires it". We do not volunteer your writing.
The long version says the same thing with the detail an honest version needs, including one limitation most diary apps do not mention.
What Lumenpage stores, and where
On your device
Everything you write: entry text, moods, tags, the dates you wrote on, and your export and app-lock preferences. This lives in the app's private storage.
On our server
Lumenpage needs an account, so your entries sync to our server so they survive a lost phone and reach your other devices. What is stored there:
- your entries, moods, tags and the timestamps attached to them. A tag that no entry uses any more is deleted, so a tag name does not outlive the last entry that carried it;
- the photo attached to an entry, if it has one: the image file itself, kept in private file storage rather than in the database, and a row recording which entry it belongs to. Before a photo leaves your device, Lumenpage removes the location and camera details embedded in it;
- your email address, if you signed up with email;
- an account identifier, and a small account record: when the account was created, plus fields reserved for a subscription status and settings that Lumenpage does not use yet and leaves empty;
- for Sign in with Apple or Google, the identifier that provider gives us — never your password, which we never see.
Every row is protected by database row-level security keyed to your account, so one account cannot read another's writing. This is enforced in the database itself, not by the app.
Your photo files are held to the same rule. The storage holding them is private: there is no public address for a photo, and no link to one that keeps working. When your own device needs to fetch a photo it asks for a link made for that request, which stops working sixty seconds later.
Without a connection
You need a connection to create your account and to sign in. After that, Lumenpage works offline: writing, reading and searching never wait on the internet. Each entry is saved on your phone first and is synced the next time you are connected.
A limitation we would rather you heard from us
Your diary is protected on your device by the phone's own encryption — iOS Data Protection and Android file-based encryption — and, if you turn it on, by an app lock that asks for your Lumenpage passcode (or, if you turn it on, your face or fingerprint) before opening.
The app lock hides your diary. It does not encrypt it. And Lumenpage does not use end-to-end encryption: entries on our server are encrypted in transit and at rest by the hosting provider, but they are not encrypted in a way that would stop us reading them if we chose to. We do not read them to run Lumenpage, and nothing in the app shows them to us. But we are not going to claim a protection we have not built. No online service is perfectly secure. Transport encryption, private storage and row-level security are what Lumenpage has. They are not a promise that an entry can never be lost, or that a lawful request can never require a disclosure.
If that matters to you, Lumenpage may not be the right diary for you yet: your writing is stored on our server. You can export it and delete your account, which removes it from the server, at any time.
Diagnostics, and why they are off
Lumenpage can send anonymous usage and crash reports to help us find what is broken and what is unused. This is switched off unless you turn it on in Settings.
If you turn it on, what is sent is behaviour and never content:
| Sent | Never sent |
|---|---|
| that an entry was written, roughly how long it was ("1-50 words"), and whether it had any tags or a mood | anything you wrote |
| that an entry was edited, or deleted | the words you searched for |
| that a search happened, roughly how long the phrase was, and how many results it found | your tags, or what they are called |
| that the app was opened, the calendar was opened, or the app lock was turned on | which mood you chose |
| that an export was asked for and finished, and how many entries it held | which entry any of this was about |
| that a sync finished and how many entries moved, or failed and which of four reasons | the message of an error, which can quote your text |
| that two devices disagreed about an entry, and which version you kept | your account, which is never linked to any of this |
| that you deleted your account | |
| crash type, stack trace, and the operation that was running |
This is enforced in the code rather than promised in this document: an analytics value in Lumenpage can only be a yes/no, a number, or a label from a fixed list. There is no way to put a sentence you wrote into one. A test fails the build if anything ever slips.
Two companies process this if you turn it on: PostHog (usage) and Sentry (crashes). Session recording, screenshots and automatic screen capture are all disabled. Turning diagnostics off tells both to forget the anonymous identifier this device was counted under.
What we do not do
- We do not sell your data, and we do not share it for anyone's advertising.
- We do not show ads.
- We do not track you across other apps or websites.
- We do not build advertising profiles.
- We do not read your diary to run Lumenpage. There is no feature that shows your writing to us. There is also no company staff: one person operates the service, and the server copy is not end-to-end encrypted, as above.
- We do not use your writing to train AI models. Lumenpage has no AI features.
Getting your writing out, and getting rid of it
Export. Settings → Export your diary produces an archive containing your writing: every entry on this device with its mood, tags and dates, including the ones that have not synced, plus the photo file for any entry that has one. It is yours to keep, and it works offline.
It is built from this device's copy of your diary, which is what lets it work offline. If you have just signed in on a new phone, give it a moment to finish catching up before you export, or the file will hold only what has arrived so far. That applies to photos too: they now travel between your devices the way your writing does, so one taken on your phone reaches your tablet once it has caught up, and exports from either. A photo that has not arrived yet, or that this device can no longer find on its own disk, does not hold up the rest — the entry still exports, noting that a photo belongs with it, without a file this device does not have.
Two things are deliberately not in it. Entries you have deleted, because you asked for those to be gone. And, if two of your devices disagreed about the words in an entry, the copy still waiting for you under Review versions — the file carries the entry as it reads now, not the version you have not chosen between yet. Settle those first if you want them included.
Deleting one entry. It disappears from your diary immediately. If you have an account, the entry stays on the server, marked as deleted, so that the deletion reaches your other devices — including its text, mood and tags. It is removed for good 30 days after the deletion reaches the server, by a job that runs once a day, so it can take up to a day longer. Until then it is not shown anywhere in the app, and it is not in your export.
Deleting your account. Settings → Delete your account. This removes your account, your entries, your tags, your photos, and the copy on this device. It cannot be undone, and signing up again does not bring it back. Export first if you want a copy.
We do not keep backups of the database. The hosting plan we use today makes no routine backups, so when your account is deleted its rows are gone, and there is no older copy waiting to age out. If that ever changes, we will say so here before it does.
There is one caveat we would rather say than leave you to assume, and it is your photos. They are kept in file storage rather than in the database, which means the app deletes them itself, one by one, at the moment you ask — and that step can fail where the rest cannot, if your connection drops halfway through, for instance. We delete your account anyway, because somebody who has asked to leave should not be kept waiting on a flaky network. When a file is left behind we record that it happened, so it can be found and removed, rather than telling you it went when it did not. That record is a count and an account identifier and nothing else: not what you wrote, not a file name, not the photo. A file left this way is unreachable the moment your account goes — every rule protecting it is written against an account that no longer exists, so nothing and nobody can open it — but unreachable is not the same as deleted, and we would rather you heard the difference from us.
Who else touches your data
- Supabase — hosts the database, accounts and file storage. Region: Singapore.
- Resend — sends account emails, such as a password-reset link. It sees your email address and the message we send you, not what you write in the app. Region: Tokyo.
- Apple / Google — only if you use their sign-in. They confirm who you are and tell us an identifier; they are not told what you write.
- PostHog and Sentry — only if you switch diagnostics on, and only the behavioural data described above. Region: United States.
- Cloudflare and Google — only if you email us. Cloudflare receives mail sent to support@lumenpage.app and passes it to our Gmail inbox, which Google hosts. They see your email address and what you write to us.
That is the complete list of processors for running the app. There is no advertising network.
If Lumenpage is later transferred to a company or another operator, this policy continues to apply to your information unless we tell you otherwise before the transfer.
When the law requires it
We may disclose information if we reasonably believe the law, a court, or a regulator requires it, or to protect someone from serious harm. We limit that to what the request demands. We do not offer your diary to anyone as a product.
Children
Lumenpage is not directed at anyone under 18, and we do not knowingly keep an account for them. The app does not ask for a date of birth. If you believe someone under 18 has created an account, write to us and we will delete it.
Your rights
Depending on where you live, you may have the right to access, correct, export or delete your information, and to object to some processing. Export and deletion are built into the app and need no request. For anything else, write to us.
If you ask us by email to delete your account, we keep only the dates of your request, of your confirmation and of the deletion, and we delete our emails with you 30 days after the deletion.
We keep your entries for as long as your account exists, and delete them when you delete it, apart from the photo caveat described above. Diagnostics data, if you enabled it, is retained by PostHog for one year and by Sentry for 30 days, the periods set by the plans we use.
Changes
If this policy changes in a way that affects what is collected or who receives it, we will say so in the app before the change takes effect rather than only updating this page.
Contact
support@lumenpage.app — for questions, and for requests to access, correct or delete your data. That address reaches the person who operates Lumenpage. Do not send diary text.
Data controller: Raymond Ting, an individual, Singapore. There is no separate company behind this policy.