LumaNox is a zero-cloud, fully offline photo safe. Your photos never leave your device — and neither does our respect for your privacy.
LumaNox ("we", "our", "the app") is a privacy-first, on-device photo safe. This Privacy Policy explains what information we collect (spoiler: almost nothing), what we do not collect, and the choices you have. By using LumaNox, you agree to the practices described below.
LumaNox is designed around a single principle: your photos never leave your device. We do not operate any servers that receive, store, or process your media. We do not have a cloud. We cannot see your vault — not even if we wanted to.
For purposes of the EU GDPR, UK GDPR, and analogous laws, the LumaNox Team is the Data Controller for the very limited processing described below. For California residents under the CCPA/CPRA, LumaNox is the Business. Where we use third-party processors (see §6), they act on our documented instructions.
| Category | Examples | Where it lives |
|---|---|---|
| Photos & videos | Media you import or capture in-app | Encrypted (AES-256) in the app's private storage on your device |
| Albums & metadata | Album names, covers, photo counts, timestamps, encrypted file references | Local app database and app container, device-only |
| Lock credentials | 6-digit PIN | Stored only as a SHA-256 hash on your device; the vault data key is generated on device and protected by platform secure storage |
| Biometric templates | Face / fingerprint unlock | Never accessed or stored by us — handled entirely by your device's operating system |
| AI inference inputs/outputs | On-device face, barcode, text, duplicate, blur, and classification analysis | Processed locally with on-device system or bundled models and local indexes; never uploaded |
| Backup archives | Encrypted backup files you create or schedule | Saved to a location you choose through the system file/document picker. We never see the file |
We do not transmit any of the above over the network.
Only low-sensitivity diagnostics and subscription status: if you choose to purchase Premium, the relevant app store and RevenueCat (see §6) process a minimal set of subscription-related identifiers. We receive only aggregate entitlement status ("premium: active / inactive") — never your payment details, name, email, or address. The app may also use Firebase Analytics / Crashlytics to receive crash breadcrumbs and low-sensitivity events such as app start, lock result, import result, camera capture result, backup result, AI scan result, and subscription action result for stability and critical-flow analysis.
LumaNox requests only the permissions needed to deliver the feature you tapped:
| Permission | Purpose | Triggered by |
|---|---|---|
| Camera | Shoot photos/videos directly into your encrypted vault; optionally capture an intruder-alert photo after failed PIN attempts if you enable that feature | Opening the in-app camera or enabling intruder alerts |
| Microphone | Record audio when you intentionally capture video in the in-app camera | Starting video capture |
| System photo/media library access | Import selected photos/videos into the vault | Tapping an import action for your system library |
| System photo/media library add access | Export photos/videos or redacted copies back to a LumaNox album in your system library | Tapping Export or Save to gallery/photos |
| Biometric unlock | Unlock the vault with face or fingerprint authentication | You enable biometrics in Settings or during setup |
| System file/document picker (per-use) | Save/read encrypted backup archives to a location you choose | Tapping Backup, Restore, or choosing an auto-backup folder |
We do not request: location, contacts, calendars, reminders, Bluetooth, health data, advertising tracking permission, SMS, call logs, or unrestricted access to all files on your device.
If you purchase a subscription or lifetime upgrade, the app store that provides your copy of LumaNox processes the payment under its own privacy policy and payment terms. This may include Apple's privacy policy (https://www.apple.com/legal/privacy/) or Google's privacy policy (https://policies.google.com/privacy). We never receive your credit card, bank account, account password, or billing address.
We use RevenueCat, Inc. ("RevenueCat") to reconcile subscription status and support "Restore purchases" across reinstalls. RevenueCat acts as our data processor under a signed Data Processing Addendum.
In release builds, we may use Firebase Analytics and Firebase Crashlytics to understand app stability and critical feature reliability. Events are intentionally limited to sanitized operational signals, such as whether an import, backup, lock, AI scan, camera capture, purchase, or restore action succeeded or failed.
Other than app store billing, RevenueCat, and Firebase, no third-party SDKs, trackers, or ad networks are embedded in v1.
Because your vault lives on your device, you control retention:
LumaNox is not directed to children under 18 and we do not knowingly collect information from anyone under 18. If you believe a minor has used the app, contact us and we will act accordingly.
The only data that may cross borders in the course of using LumaNox is subscription metadata and low-sensitivity diagnostics handled by app store providers, RevenueCat, and Firebase. These providers rely on Standard Contractual Clauses and comparable safeguards for transfers out of the EEA/UK/Switzerland. We ourselves do not transfer your vault content internationally because we do not collect or receive it.
You have the right to access, rectify, erase, restrict, port, and object to processing of your personal data, and to lodge a complaint with a supervisory authority. Since the data we hold is limited to anonymous purchase metadata and low-sensitivity diagnostics, most requests will be forwarded to our processors or the relevant app store provider.
You may request to know, delete, or correct the limited personal information we process, and to opt-out of the sale or sharing of personal information. We do not sell or share personal information. We will not discriminate against you for exercising these rights.
Email [email protected]. We will respond within 30 days (GDPR) or 45 days (CCPA), and may extend by another period as permitted by law.
We may update this Policy to reflect product, legal, or operational changes. The "Last updated" date at the top always reflects the current revision. Material changes will be announced in-app before they take effect. Continued use after the effective date of an update constitutes acceptance.