Privacy policy

In short

When you buy without registration, we receive neither an email address nor a name. The invoice number and the purchase code prove the purchase - and only you have them.
Profiles, what’s in them and your master password stay on your Macs. Turn on sync and only ciphertext goes to the server: the key never leaves your Macs.
With an account, the server knows your email, a hash of your password, your plan and paid period, your invoices and your devices - and how many profiles each Mac has. That number is all it knows about your profiles.
The server doesn’t keep IP addresses, though Cloudflare, which requests to the server pass through, sees them. The server has no computer names.
A forgotten master password can’t be recovered. Not by us, not by anyone.
The site has no analytics and no cookies. It has one third-party script: Cloudflare Turnstile’s robot check at sign-up. The app sends us no analytics and no crash reports.

Data controller

The data controller is Lumen Browser. Lumen Browser sells and supports Lumen - a Mac app, the site lumenbrowser.io, an account server and a sync server - and is responsible for the processing described here. Questions about data: [email protected].

Buying without signing up

When you buy without registration, we receive neither an email address nor a name. The server keeps hashes of the key and of the purchase code: they let us check that a code is right, not learn the code. For 30 days after the payment the key is kept encrypted with the purchase code, so that you can get it again: we keep it but cannot read it - we do not have the purchase code. After 30 days that copy is deleted.

Invoices, the details of your Macs and sync data - as described below. An unpaid purchase is forgotten 8 days after its invoice expires. We send no reminders that a period is ending - we have nowhere to send them; the app will remind you. You may link an email address to such a purchase later, if you wish - we then keep it as we keep an account's address. A purchase without signing up is deleted at your request through support - with the invoice number and the purchase code; like an account, after 7 days.

What the Lumen server keeps

Your email address and a hash of your password (we neither keep nor know the password itself).
Your plan, its limits and the date your paid period ends.
Invoices: the amount in dollars, the coin and its amount, the address issued for the payment, the transaction on the network, dates.
If you have a team, the addresses of the people you invited.
A record of changes to your rights: what changed, when and why (payment, extension, refund, end of period).

About your Macs

For each Mac: an identifier derived from the Mac’s hardware identifier (the hardware identifier itself never reaches us), the label you gave it, if any, the app’s version, when the Mac was added and when it was last in touch - and how many profiles are on that Mac.

The number of profiles is the only thing the server knows about your profiles. It is needed so that your plan’s profile limit is shared by all your Macs and by your whole team. The server never receives profile names, their contents, cookies, saved passwords, history or proxy addresses.

Sync

If you turn it on, the server keeps your data encrypted only - the key never leaves your Macs, and only you can read it. The server sees that your account has a vault, how many objects it holds, their sizes and when they changed.

Object names on the server are HMACs of their real names: they don’t even reveal that an object is “a profile’s history”. We cannot decrypt profile data - not of our own will, not on anyone’s demand.

What the server does not keep

IP addresses (used only in memory, to limit request rates), computer names, profile data.

The server never receives your master password. We can’t reset it: without it profile data can’t be decrypted - not by you, not by us.

Cloudflare

Requests to the server pass through Cloudflare: it shields the server from overload, and sees your IP address, the time of each request and its contents - your password when you sign in included, and the key and the purchase code of a purchase without registration. It cannot read your sync data: that is encrypted on your Mac. Cloudflare keeps request logs under its own policy: cloudflare.com/privacypolicy.

The sign-up page runs Cloudflare Turnstile’s robot check. Its script loads from Cloudflare’s server, and Cloudflare sees your IP address and the details of your browser the check needs. Our server gets from Cloudflare only the answer, whether the check passed. No other page of the site has it.

How long

Your account is deleted 7 days after you ask (until then you can cancel), and your sync data with it. Payment records - an invoice, the payments on it and the entries about it in the record of changes to your rights - are kept for three full calendar years after the year of the invoice’s last event (its payment or refund), then deleted. Other entries in the record of changes to your rights are kept for three full calendar years after the year of the entry. This holds for every account; for a deleted one, without your email address. Database backups are kept for up to 30 days.

You ask for deletion in your account; the account is blocked at once. A deleted email disappears from the backups with the oldest copies. Messages with support are kept for 12 months after the request is closed.

The app on your Mac

The app sends us no analytics, no crash reports and nothing about which sites you open.
To learn a proxy’s country, time zone and external IP, the app asks the geolocation services ipinfo.io, get.geojs.io and ipwho.is - through the proxy itself, when a profile with a proxy starts or you check a proxy. They see the proxy’s address, not yours.
The search at the start of a warm-up goes through DuckDuckGo, as from the address bar - also through the profile’s proxy.
Sites you open in profiles get what they would get from Safari. That is between you and those sites; their privacy policies apply to them.

The site

The site has no analytics, no ad pixels and no cookies. Fonts and images come from our server. It has one third-party script: the robot check on the sign-up page (see Cloudflare).
After you sign in, the site keeps the session key in the tab’s memory and forgets it when you sign out. A session lasts 30 days and ends after 7 days without use.
The payment page is ours: you don’t leave the site, and the server gets the address for the transfer from the payment service.
When you buy without signing up, the site keeps the invoice number and the purchase code in your browser’s storage, so that a closed tab doesn’t lose them; nothing goes from there to us. On the key page the key lives only in the tab’s memory and is forgotten when you sign out or close the tab. The number and the code are erased with the site’s data in your browser.

Who we share data with

The payment service NOWPayments receives from us only the amount in dollars, the coin, the invoice number and the plan’s name - not your email address, nothing else about you. It issues the address for the transfer.
Cloudflare - requests to the server pass through it; what it sees is under Cloudflare.
Email. Letters - codes, invoices, reminders - are sent by Resend: it receives your address and the letter’s text. Open and click tracking are off.
Hosting - the servers run in Germany, in Frankfurt.

We don’t sell data and don’t pass it to ad networks. On a lawful demand we can hand over only what we have - the lists above. Profile data is encrypted, and we can’t decrypt it.

Your rights

Find out what data we have about you and get a copy - write to [email protected].
Delete your account - in your account; sync data - there too, separately.
Correct your data - write to [email protected].
Complain to your country’s data protection authority.

Changes

We email you about material changes 30 days before they take effect. Earlier versions of the policy stay on this page.