Lumos Privacy Notice
Notice version 2026-09-29
Optional conversational Spark — October 13, 2026
Conversational Spark requires separate, explicit permission. With that permission and Spark enabled, Lumos may send the question you submit and your selected month and currency to Google Gemini to interpret a supported personal-finance request. Questions can contain personal information. This interpretation does not send raw transactions, account identifiers, statement PDFs, household records or conversation history. Lumos authorises the resulting read and calculates the answer. Existing summary rewriting remains covered by its separate permission. You can withdraw conversational permission in Settings; future interpretation requests stop, but requests already dispatched cannot be recalled. Chat stays in browser memory for the current session rather than being saved as account history. Interactions use store: false; provider processing and retention rules still apply. Permission evidence follows the existing privacy-evidence retention and account-deletion controls.
Who operates Lumos
Lumos is operated by Brandon Hans Ebrecht in Ontario, Canada. Contact support@lumosbudget.com about privacy, access, correction, withdrawing permission or deletion. Lumos is intended for adults age 18 and older. We record your eligibility confirmation; we do not verify age using identification or date of birth.
Information and purposes
We use your email, sign-in identifiers, profile, preferences, Terms acceptance and authentication/security records to operate and protect your account. Budgeting records can include account details, balances, transactions, merchant descriptions, categories, budgets, bills, notes and statements. We use them for the budgeting, import, connection and reporting features you choose. We do not sell bank data.
Optional bank connections
You can use manual budgeting without linking a bank. With your separate permission, Plaid provides selected account details and balances, up to 730 days of transaction history where available, and supported liability and investment information. Connected information can refresh without you starting each update until you withdraw permission or disconnect. Bank authentication uses the provider or institution flow. Lumos stores connection access tokens; these are not your bank password. Existing connections require current permission before further Lumos collection.
Lumos Spark and your choice
Lumos Spark is optional AI assistance powered by Google Gemini. After explicit permission, it sends merchant descriptions and category information for cleanup and categorization, including after imports and bank updates, and financial insight text, including amounts and comparisons, for summary rewriting. Spark starts enabled for new accounts, but this preference does not create permission to send information. A combined confirmation records merchant and summary permissions separately; existing permissions are not expanded automatically. Each statement PDF requires its own permission. Turning Spark off stops new AI requests across all these features. These controls cannot recall information already sent. Standard categorization and summaries work without Spark. Spark permission is separate from Terms acceptance and bank permission.
Statement extraction
Before each PDF extraction, we ask permission to send the complete selected PDF to Google Gemini. A PDF may include names, addresses, account identifiers and financial activity. Cancelling before sending transmits no PDF to Google. Review extracted and AI-generated information before relying on it; it can be inaccurate.
Google processing and retention
Lumos has migrated its Gemini configuration to a paid project. Google paid-service terms exclude submitted prompts and responses from product improvement. Optional request storage is disabled, and summary requests also opt out of stored interaction history. Google separately documents 55-day abuse-monitoring retention and possible authorized review of flagged content. This is not zero retention, and the paid protections do not apply retroactively to earlier processing under different terms.
Providers, locations and risks
Lumos uses Supabase for database/authentication; Vercel and Cloudflare for hosting/delivery; Plaid for bank connections; Google for AI and encrypted routine backups; Zoho for support; and Healthchecks.io for backup status/timing alerts. Backup monitoring receives no database contents or recovery keys. Keys are held separately in protected custody using 1Password and an offline recovery device. Google or Microsoft also processes information when you choose its sign-in service. Information may be processed outside your country, including in the United States, and may be accessible under those laws. Financial information is sensitive: safeguards reduce but cannot eliminate risks of unauthorized access or disclosure.
Your choices and withdrawal
Privacy and data permissions in Settings shows the separate choices and their recorded versions/dates. Withdrawal stops future Lumos dispatch for that purpose; it cannot recall a request already sent. Bank withdrawal blocks collection before attempting provider disconnection. If that step fails, the app reports a pending disconnection and provides a retry; contact support if it persists. Withdrawal/disconnection does not erase imported records or delete a bank account. Stored records, manual budgeting and account deletion remain available without renewing optional permissions.
Retention and deletion
We keep information for service operation, protection, requests and applicable obligations. Use supported controls or contact support to request deletion. Account deletion attempts provider revocation first; unsuccessful steps need follow-up. Some sign-in methods may require adding a password for self-service deletion. Active-record deletion does not immediately erase all backups or provider copies. Routine encrypted backups use 7 daily, 4 weekly and 3 monthly selections; protected historical recovery copies remain separately held. Complete lifecycle deletion and restore-time reconciliation remain under implementation. Contact support for the scope/status of your request. We do not promise immediate erasure across all systems.
Permission records and browser storage
We keep minimal permission evidence, including purpose, version, time and the chosen scope, without PDF contents or bank credentials. Upload permission is limited to one short-lived attempt. Minimal superseded/withdrawn evidence is targeted for 12-month retention; the complete enforcement and recovery arrangements are still being finalized. Browser storage maintains sessions and preferences; clearing it may sign you out or reset preferences. Provider pages follow their own practices.
Lumos Together beta — October 9, 2026
Together is optional. Household members can see shared budgets, bills, contributions, and the purchase portions and labels you choose to share. Your private bank records and source links are not shared. Members may download the shared history; Lumos cannot recall copies they already viewed or saved. Leaving or removal ends household access. If you delete your Lumos account, your private bank links are removed and your shared display name becomes Former member, while shared history remains for the household. Shared notes and labels may still identify you; this is not irreversible anonymization. After household closure, current members have 90 days to export the read-only history. The active-system records are then removed through scheduled cleanup unless a retention hold applies. Backup copies expire separately under the backup rules above. This beta does not move money, match contribution deposits to bank transactions, or change personal income reports.
Requests, safeguards and updates
Contact support for access, correction, deletion, withdrawal or concerns. We may verify identity to protect information. Withdrawing information needed for a feature can limit that feature. Your applicable rights remain available. We use access controls and safeguards but do not guarantee absolute security or claim all historical copies/devices are encrypted. Material changes will be communicated and renewed permission sought for materially changed processing purposes.
Plaid privacy policyGoogle Gemini termsGoogle safety retention