Privacy Policy

Who we are

Lumen is a reading app for the Bible and the Christian tradition. This policy describes what data the product handles, why, and the rights you hold over it.

Lumen is operated by ARTHEA LLC. Questions about anything here go to valentin@arthea.io.

Religious data mostly never reaches us

Your tradition, branch, practice settings and prayer activity reveal religious belief. Under Article 9 of the GDPR this is special-category data, and Lumen is built so that most of it never leaves your phone at all.

The tradition you answer at onboarding, your prayer history, the chapters you have read and the flame that marks the days you came are stored on your device and are not sent to us. There is no server-side record of what you pray or when.

If you turn on the iCloud backup of your reading, it goes to YOUR iCloud account, not to Lumen, and the reading half is encrypted on your device with a key held in your own end-to-end-encrypted iCloud Keychain. We cannot read it.

What we store, and why

Private content: your highlights, bookmarks and, when you post in Ensemble, what you write there. These are stored on our servers so they follow you between devices. They are never used to train any AI system.

Account data: if you sign in with Apple or Google, the identifier that provider gives us, and your subscription state. You can use Lumen fully without an account.

Product telemetry: de-identified usage events, validated against a fixed schema that has no free-text field, so a search you typed or a verse you opened cannot be represented in it. It is off until you turn it on.

Consent, granular and revocable

Consent is asked separately for personalization, analytics and notifications. Each can be refused, and each can be withdrawn later in Settings.

Withdrawing analytics consent drops the queue on your device and rotates the pseudonym your events carried, so future events cannot be joined to past ones. Events already sent are keyed by that pseudonym and cannot be linked back to you by us either.

There is no advertising in Lumen, no third-party ad SDK, and no cross-app tracking. Religious data is never used for advertising.

Your rights

Access and portability: Settings → Your account → Export my data gives you everything we hold for you, as a file, without a support ticket.

Erasure: Settings → Your account → Delete my account ends the account and clears every table that names it, in one pass. It cannot be undone.

Analytics events are the one thing erasure cannot reach, and the reason is the protection itself: they carry a rotating pseudonym we cannot link to an identity. Withdrawing consent rotates it.

Rectification and objection: your profile and preferences are editable in the app, and consent withdrawal takes effect on your device immediately.

To exercise any right the app cannot serve directly, write to valentin@arthea.io.

Where your data lives, today

The service runs on Google Cloud Run in the United States (us-central1), with its database hosted by Neon in the United States. Data you save is therefore processed and stored in the United States.

Lumen intends to move this to the European Union, and that move waits on a stable domain name so that a change of region does not break the apps already installed. This section will say so on the day it changes, and not before.

Retention

Highlights, bookmarks and posts are kept until you delete them or delete your account.

Analytics events are kept for at most 25 months: a job scheduled every night at 03:00 UTC deletes anything older. Until 2026-08-21 that job existed and nothing ran it, and this page said so rather than announce a schedule that was not running.

Database history at our hosting provider is retained for one day.

AI features

Lumen ships no assistant today. When one arrives, prompts and responses will be redacted in our observability systems, our provider agreements will exclude training on your traffic, and your private notes and religious profile will remain unreachable by those pipelines.

Nothing in Lumen is generated by AI and published without editorial review, and no scripture text is ever generated: it is ingested from public-domain or openly licensed editions, with a checksum verified every time it is read.