Privacy

The short version

Lumen has no accounts and collects no analytics, no crash reports and no telemetry. Your library, watch progress, addons and settings live on your device. If you turn sync on, they are encrypted on your device before they leave it, and our relay stores only data it cannot read. The one piece of personal data we can read is the email address you use to buy a Lumen Pass, which we keep encrypted and use only to send and recover your key.

Who is responsible

Lumen is published by Vik Mortier, Zaventem, Belgium (“we”). Contact: hello@lumen.movie.

What the app stores on your device

Your library, watch progress, installed addons, settings, downloaded files you asked for, cached images and metadata, and a diagnostic log kept on the device. You can back this data up and restore it from within the app, and you delete it by removing the app or using Settings → Storage.

What leaves your device, and to whom

Addons.

Lumen sends requests to the addons you install (and to the two bundled metadata and subtitle addons, Cinemeta and OpenSubtitles) when you browse, search, open a title or fetch subtitles. Those requests contain what is needed for the request: title identifiers, search text, and for subtitles a hash of the file. Each addon is a third-party service with its own privacy practices; you choose which ones to install.

Sync (optional).

When you turn sync on, your library, progress, addon list and player preferences are encrypted on your device with keys derived from your pairing code, which never leaves your devices. The relay receives and stores only opaque identifiers and the encrypted data, plus the network address of the connecting device for the duration of the request. We cannot read the data. We delete a household’s encrypted data on request. If you use your own relay, none of this reaches us.

Optional integrations you enable yourself.

TMDB (artwork and descriptions) and Trakt (scrobbling and watched history) are contacted only if you enter your own API key or log in, under their own terms and privacy policies.

Import from Stremio (optional).

If you sign in to Stremio to import your addons and library, Lumen sends the email address and password you type straight to Stremio (api.strem.io) over an encrypted connection, reads your addons and library once, and signs that session out. Lumen stores neither and never sends them to us.

Trailers.

Pressing “Trailer” fetches the trailer from the video platform that hosts it (YouTube), from your device.

Once a day the app fetches a small version file from dl.lumen.movie to tell you when a newer Lumen exists; the request carries nothing about you or your library, and you can turn it off in Settings → About. Beyond that, Lumen sends nothing to us. The Microsoft Store version leaves updates to the Store and skips this check.

Buying a Lumen Pass

Payment.

The payment is handled by Stripe under Stripe Managed Payments. Stripe receives your card or payment details and the email address you enter at checkout, under Stripe’s own privacy policy. Our relay receives a random purchase reference and that email address. It stores the address encrypted, uses it only to send your Pass key and to answer a recovery request, and never uses it for marketing. We do not see or store payment details.

What the relay holds for a purchase.

The purchase reference, the encrypted purchase email, and the payment status reported by Stripe (paid, refunded, disputed). Your Pass key itself is not stored, only a hash used to check activations. Transactional records are kept for as long as the Pass is valid and for the period tax and accounting rules require; sync data is separate and is deleted on request as described above. The relay’s database is backed up nightly; backups are encrypted on our server before they leave it, stored with Backblaze B2 in the EU (Amsterdam), and kept for 35 days.

Cookies.

lumen.movie sets no cookies. The checkout and recovery pages on sync.lumen.movie set one functional, first-party cookie for up to seven days, so that the browser you bought with can show you your own key. It carries no tracking and is not shared with anyone. Those pages load no third-party resources; the only external step is the redirect to Stripe.

Key emails.

Your Pass key and any recovery email are sent from pass@lumen.movie through a transactional email provider (Resend), which processes the recipient address and message for delivery only.

This website

lumen.movie sets no cookies, loads no third-party resources and uses no analytics. Our server keeps standard technical logs for security, which contain IP addresses and are deleted on a short rotation.

Legal basis and your rights (EU)

We process the minimal technical data above to provide the service you asked for (performance of a contract) and to keep it secure (legitimate interest). You have the rights of access, rectification, erasure, restriction, portability and objection under the GDPR, and the right to lodge a complaint with the Belgian Data Protection Authority. Because we hold no account, most requests are met by deleting data on your device or, for sync, by asking us to remove your household’s encrypted data. For a Pass purchase, write to hello@lumen.movie from the purchase email address and we will tell you what we hold or delete it, subject to records we must keep.

Children

Lumen is not directed at children under 16.

Changes

We will post changes to this page and update the date above.