Legal
Privacy Policy
Updated 22 August 2026 · This policy describes what the software actually does, checked against the code that does it. It has not been reviewed by a lawyer; where that matters, it is said in the text rather than implied by a banner.
1. Who we are
Lumen is a reading app for the Bible and the Christian tradition. This policy describes what data the product handles, why, and the rights you hold over it.
Lumen is operated by ARTHEA LLC. Questions about anything here go to valentin@arthea.io.
2. Religious data mostly never reaches us
Your tradition, branch, practice settings and prayer activity reveal religious belief. Under Article 9 of the GDPR this is special-category data, and Lumen is built so that most of it never leaves your phone at all.
The tradition you answer at onboarding, your prayer history, the chapters you have read and the star that marks the days you came are stored on your device and are not sent to us. There is no server-side record of what you pray or when.
If you turn on the iCloud backup of your reading, it goes to YOUR iCloud account, not to Lumen, and the reading half is encrypted on your device with a key held in your own end-to-end-encrypted iCloud Keychain. We cannot read it.
3. What we store, and why
Private content: your highlights, bookmarks and, when you post in Ensemble, what you write there. These are stored on our servers so they follow you between devices. They are never used to train any AI system.
Account data: if you sign in with Apple or Google, the identifier that provider gives us, and your subscription state. You can use Lumen fully without an account.
Product telemetry: de-identified usage events, validated against a fixed schema that has no free-text field, so a search you typed or a verse you opened cannot be represented in it. It is off until you turn it on.
4. Consent, granular and revocable
Consent is asked separately for personalization, analytics and notifications. Each can be refused, and each can be withdrawn later in Settings.
Withdrawing analytics consent drops the queue on your device and rotates the pseudonym your events carried, so future events cannot be joined to past ones. Events already sent are keyed by that pseudonym and cannot be linked back to you by us either.
There is no advertising in Lumen, no third-party ad SDK, and no cross-app tracking. Religious data is never used for advertising.
5. Your rights
Access and portability: Settings → Your account → Export my data gives you everything we hold for you, as a file, without a support ticket.
Erasure: Settings → Your account → Delete my account ends the account and clears every table that names it, in one pass. It cannot be undone.
Analytics events are the one thing erasure cannot reach, and the reason is the protection itself: they carry a rotating pseudonym we cannot link to an identity. Withdrawing consent rotates it.
Rectification and objection: your profile and preferences are editable in the app, and consent withdrawal takes effect on your device immediately.
To exercise any right the app cannot serve directly, write to valentin@arthea.io.
6. Where your data lives, today
The service runs on Google Cloud Run in the United States (us-central1), with its database hosted by Neon in the United States. Data you save is therefore processed and stored in the United States.
Lumen intends to move this to the European Union. That move waits on the service having a stable address of its own: the installed apps reach it at a region-bound address today, and a change of region would break them. This section will say so on the day it changes, and not before.
7. Retention
Highlights, bookmarks and posts are kept until you delete them or delete your account.
Analytics events are kept for at most 25 months: a job scheduled every night at 03:00 UTC deletes anything older. Until 2026-08-21 that job existed and nothing ran it, and this page said so rather than announce a schedule that was not running.
Database history at our hosting provider is retained for one day.
8. AI and the editorial layer
Lumen ships no assistant today. When one arrives, prompts and responses will be redacted in our observability systems, our provider agreements will exclude training on your traffic, and your private notes and religious profile will remain unreachable by those pipelines.
No scripture text is ever generated: it is ingested from public-domain or openly licensed editions, with a checksum verified every time it is read. The editorial layer, Understand, lessons and Stories, is written with AI assistance and can publish only when every claim opens a reference a machine verifies in every served edition; a per-chapter human review is not in place today, and nothing of yours is used to write it.