Privacy Policy
How LumenPod handles your data
LumenPod is a local media library: your files, their metadata, and your vault passwords stay on your device. This policy covers the narrow set of data that can leave it — across the website and both editions of the app — who receives it, and how to switch it off.
Last updated October 23, 2026
At a glance
- Your content never reaches us. We run no media storage, no sync, and no upload path, in either edition.
- An account only exists for the direct-download edition, to buy it or redeem a code. The Mac App Store edition has no sign-in and holds no profile with us.
- We never see your payment method. Card details go to Apple or to our checkout provider, never to us.
- In the app, diagnostics and analytics are off until you turn them on, and stop the moment you turn them off. On the website, anonymous cookieless analytics run unless you reject them or your browser sends Do Not Track or Global Privacy Control, and error monitoring runs only if you accept it.
Controller and contact
LumenPod is built and operated by Meini Yan, an individual developer trading as LumenPod, who is the data controller for the data described here. Write to support@lumenpod.app with any privacy question or request.
Which edition this covers
This policy covers lumenpod.app and both editions of the desktop application. Where a data flow exists in only one of them, it says so.
- Direct download — bought, or redeemed with a code, on this website. Involves an account, an activation code, a device identifier for that activation, and a periodic licence check against our server.
- Mac App Store — bought from Apple. No account, no activation code, no licensing request; the purchase is verified on your device by Apple.
If a store platform or payment provider shows additional privacy disclosures, those apply alongside this policy for the parts of the service they operate.
What never leaves your device
These are held only on your device — in the App Store edition, inside the application's sandbox container — and are transmitted to no one:
- media files, thumbnails, and generated previews;
- the library database — file names, folders, tags, ratings, timestamps, and every other catalog field;
- vault passwords, the keys derived from them, and the entries the app keeps in the system Keychain;
- settings and interface preferences.
The two editions catalog files differently. The App Store edition copies the file's bytes into its own container on import and does not read the original location again; access outside that container happens only through the system file picker, for the folder you select, at the moment you select it. The direct-download edition catalogs files where they already sit, including on external volumes, and reads them from there. Neither sends any of it anywhere.
Encryption and recovery
Encrypted items are protected with keys derived from a password you choose. We hold no copy of it, no escrow, no recovery key, and no backdoor.
If you lose your password and your recovery material, the data cannot be recovered — not by us, not by Apple, not by anyone. This is a design property, not a limit we can lift on request. It also means we cannot read, index, scan, moderate, or disclose your content, because we never receive it.
What we receive
| Data | Sent when | Purpose | Edition | Processor |
|---|---|---|---|---|
| Crash report: error type, stack trace, app version, OS and device model | Only while crash diagnostics are enabled | Diagnose and fix defects | Both | Sentry |
| Analytics event (app): feature name, app version, OS version — no persistent identifier | Only while product analytics are enabled | Aggregate counts of which features are used | Both | Aptabase |
| Analytics event (website): page path, event name, coarse flags such as signed in yes/no, browser language — no cookie, no persistent identifier | On page visits and key steps such as checkout, unless you reject analytics in the cookie banner | Aggregate counts of which pages and steps are used | Website | Aptabase |
| Feedback: your message, an email address if you give one, app version, OS information, timestamp, installation identifier | Only when you press send | Reply to you and fix the problem | Both | Us |
| Account email, and the Google profile email if you sign in with Google | When you create an account, sign in, redeem a code, or buy | Authenticate you and attach your licence to your account | Direct download | Us, Google Sign-In |
| Activation code, a device identifier for the Mac being activated, licence status and app version | At activation, and on the app's periodic licence check | Issue and re-verify your licence, enforce seat limits, prevent fraud | Direct download | Us |
| Order and billing metadata: amount, currency, status, order code, timestamps | When you complete a purchase | Complete the transaction, show your order history, meet tax and accounting obligations | Direct download | Us, Creem |
| Purchase receipt | At launch, verified on-device | Confirm the app was paid for | Mac App Store | Apple only |
We do not sell personal data, and we use service providers only where one is needed to deliver authentication, payments, analytics, monitoring, or support.
Purchases
Mac App Store edition. LumenPod is a paid app bought once from Apple; the purchase is verified on your Mac by StoreKit against your Apple Account. It makes no licensing request to our servers, sends no device identifier for activation, and leaves no purchase record with us; verifying a purchase happens between your device and Apple. Apple provides us with aggregated sales reports that do not identify individual customers.
Direct download. Checkout is handled by Creem, which receives your payment details directly — we never see your card. Creem notifies us of the outcome, and we keep the order metadata listed above so we can issue your licence, show your order history, process a refund, and meet tax and accounting obligations.
Optional diagnostics and analytics
In the application, both channels are off by default. They begin only after you enable them in Settings → Privacy and stop the moment you turn them off.
Crash reports pass through a scrubbing step that removes file paths and other sensitive values before sending. Analytics events carry no account, no persistent user identifier, and no library content; machine identifiers and paths are dropped before an event leaves the device.
Website data
lumenpod.app serves product information, these legal documents, a feedback form, and — for the direct-download edition — sign-in, checkout, code redemption, and order history.
Operating those pages involves session cookies, return URLs, purchase state, feedback submissions, and a device identifier cookie set when you sign in, which binds your session and refresh token to your browser for security and fraud prevention. The feedback form is protected by Cloudflare Turnstile, which processes limited technical data for bot protection under Cloudflare's own terms. Website analytics are cookieless and anonymous: they store nothing in your browser, carry no persistent identifier, and run unless you reject them in the cookie banner. Before a page path is sent, query parameters that could identify you — email addresses, order codes, device and licence identifiers, sign-in codes — are removed. Error monitoring runs only if you accept it.
Cookies and local storage
LumenPod uses first-party cookies and browser storage for session continuity, checkout handoff, order history hints, feedback state, and consent preferences. Error monitoring runs only after you accept it; cookieless analytics run unless you reject them.
| Name / store | Purpose | Category |
|---|---|---|
| lumenpod_access_token | Keeps you signed in for the session | Strictly necessary |
| accessToken | Authenticates your requests while signed in; expires after 30 minutes | Strictly necessary |
| refreshToken | Keeps you signed in between visits; expires after 7 days | Strictly necessary |
| deviceId | Ties your sign-in to this browser, for security and fraud prevention; kept for 2 years | Strictly necessary |
| lp_oauth | Holds a Google sign-in while it is in progress; expires after 10 minutes | Strictly necessary |
| lumenpod_cookie_consent_v1 | Stores your consent choice | Strictly necessary |
| Aptabase | Cookieless, anonymous product analytics; stores nothing in your browser | Optional (on unless you reject) |
| Sentry | Error and crash monitoring | Optional (consent) |
| Cloudflare Turnstile | Bot protection on forms | Strictly necessary |
If cookies are disabled in your browser, sign-in and billing features may not work correctly. Nothing on this list is needed to run the App Store edition of the application, which does not use the website to operate.
What we do not collect
We do not collect contacts, location, your photo library beyond what you deliberately import, browsing history, advertising identifiers, or biometric data. We do not sell personal data, share it for advertising, or use it to track you across other companies' apps and websites.
Legal bases for processing
Where the GDPR or a comparable law applies, we rely on the following legal bases:
- Contract — to provide sign-in, code redemption, licensing, checkout, order history, and the support you request.
- Consent — for analytics and error monitoring in the app, and for error monitoring on the website. You can withdraw consent at any time without affecting prior processing.
- Legitimate interests — to keep the service secure, prevent fraud and abuse, keep the feedback endpoint usable, operate strictly necessary functions, and measure aggregate website usage with cookieless analytics, which you can object to by rejecting it in the cookie banner.
- Legal obligation — to meet tax, accounting, and other legal requirements tied to purchases.
Third-party services
We may rely on Google Sign-In for authentication, Creem for checkout, Aptabase for analytics, Sentry for error monitoring, and Cloudflare Turnstile for bot protection. Each processes only the limited technical or transaction data needed to deliver its part of the service.
Purchases made through the Mac App Store are handled by Apple under Apple's own privacy terms, and involve none of the providers above.
International data transfers
Some of our service providers (for example Google, Sentry, Aptabase, Creem, and Cloudflare) may process data on servers outside your country, including outside the EU/EEA. Where required, such transfers rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses or an adequacy decision.
Retention and security
Account and order records tied to a purchase are kept for the period required by applicable tax and accounting law. Feedback is kept while needed to resolve your request and for a reasonable period afterwards. Crash and analytics data are held for a limited period by the relevant provider and then deleted or aggregated. We apply commercially reasonable safeguards to what we hold, though no transmission or storage system can be guaranteed fully secure; what stays on your device is protected by the operating system, the app sandbox where it applies, and — for encrypted items — your own password.
Your rights
Depending on where you live, you may request access to, correction of, deletion of, or a copy of your personal data; restrict or object to processing; withdraw consent without affecting prior processing; and complain to your data protection authority. In the App Store edition there is no account, so what we hold is normally limited to feedback you sent and diagnostics you opted into.
Write to support@lumenpod.app and we will respond within the period applicable law allows. Deleting the App Store edition removes its library and container from your device permanently; that is not something we can undo for you.
Children's privacy
LumenPod is not directed to children under 16, and we do not knowingly collect personal data from them. If you believe a child has provided us personal data, contact us and we will delete it.
Do Not Track and Global Privacy Control
If your browser sends a Do Not Track or Global Privacy Control signal, we treat it as a rejection of website analytics until you accept them in the cookie banner. Error monitoring needs your explicit acceptance either way, so neither signal changes it.
Changes to this policy
We may update this policy as the product evolves. Material changes are reflected in the "Last updated" date above, and where a change affects optional diagnostics or analytics we will ask you to review your choice again.