Lumen · Version 2026-07-01 · Last updated 2026-07-19
This Privacy Policy explains how Burak Karabekir (“we”, “us”, “Lumen”) collects,
uses, shares, and protects your personal data when you use the Lumen mobile application (the “App”).
Lumen is a private journaling app for recording moments, moods, and reflections.
1. Who we are (Data Controller)
The data controller responsible for your personal data is:
Data protection contact / DPO (if any): Not appointed
2. What data we collect
Account data — your email address, display name, and (if you sign in with Google or Apple) the account identifier from that provider and, for Google, your profile photo URL. If you use Sign in with Apple with “Hide My Email,” Apple gives us a private relay address instead of your real email.
Journal content — the entries you create: text, titles, moods, tags, and any photos, voice recordings, or videos you attach, plus location data only if you choose to add it to an entry.
AI reflection data — the entry content you submit for AI reflection (see Section 4).
Subscription data — your Lumen Plus entitlement status, product identifiers, and purchase/renewal state. Payment card details are handled by Apple or Google, not by us.
Consent records — a log of the version of these documents you accepted and when, kept as proof of consent.
Technical data — app version, device type and operating system, and crash and error diagnostics collected via Sentry (see Section 6) and the app stores. We do not use advertising trackers and do not profile you for marketing.
3. How we use your data
To provide the App — store, sync, and display your journal across your devices.
To generate AI reflections when you request them (Section 4).
To manage your account, authentication, and Lumen Plus subscription.
To provide customer support and respond to your requests.
To keep the App secure, prevent abuse, and comply with legal obligations.
4. AI features & how your entries are processed
When you request an AI reflection, the relevant entry content is sent through our secure backend
(Supabase Edge Functions) to Google’s Gemini
AI service, which generates the reflection and returns it to you. Google processes this content as our service
provider to perform the request, and this processing may take place on Google infrastructure outside the EU
and Türkiye (see Section 7 on international transfers). We do not use your journal content to train our own models.
See Google’s terms at ai.google.dev/gemini-api/terms.
AI reflections are for personal insight only and are not medical, psychological, or professional advice.
5. Legal bases for processing (GDPR / KVKK)
Performance of a contract — to deliver the App and your subscription.
Your consent — for AI processing of your entries, optional location, and these documents. You may withdraw consent at any time.
Legitimate interests — to secure the App and prevent misuse.
Legal obligation — where we must retain or disclose data by law.
Because your journal entries may reveal sensitive information (such as details about your health or mood), we process that content only with your explicit consent, which you can withdraw at any time.
6. Who we share data with (processors & third parties)
Supabase — database, file storage, and authentication hosting.
Google (Gemini) — AI reflection generation.
Google Sign-In — optional authentication.
Sign in with Apple — optional authentication.
RevenueCat — subscription management and entitlement tracking.
Sentry — crash and error monitoring, with data processed in the European Union. We strip personal identifiers before sending and never transmit your journal content.
Apple App Store / Google Play — payment processing and billing.
We do not sell your personal data.
7. International data transfers
Your data is hosted in the EU (Ireland) and processed by service
providers that may be located outside Türkiye and the EEA (including the United States). Where required, such
transfers are protected by appropriate safeguards such as Standard Contractual Clauses and, for KVKK, your
explicit consent or another lawful transfer mechanism.
8. Data retention
We keep your data for as long as your account is active. When you delete your account, we delete or anonymize
your personal data within 30 days, except where we must retain it to comply with
legal obligations. Consent records may be retained as long as needed to evidence consent.
9. Your rights
Depending on your location, you may have the right to:
access, correct, or delete your personal data;
restrict or object to processing;
data portability;
withdraw consent at any time;
learn whether your data is processed and request information about it (KVKK Art. 11);
lodge a complaint with your supervisory authority (in Türkiye: the KVKK Board; in the EU: your local Data Protection Authority).
To exercise any right, or to request deletion of your account and all associated data, contact us at
support@lumenjournalapp.com. We will action deletion requests
within 30 days.
10. Security
We use industry-standard measures including encryption in transit, authenticated access, and row-level security
so that you can only access your own data. No method of transmission or storage is 100% secure.
11. Children
Lumen is not directed to children under 16, and we do not knowingly collect their data. If you believe a child
has provided us data, contact us and we will delete it.
12. KVKK notice (Türkiye)
Under Law No. 6698 on the Protection of Personal Data (KVKK), the data controller is Burak Karabekir.
Your personal data is processed for the purposes described above, based on the legal grounds in Section 5, and
may be transferred to the recipients in Sections 6–7. You may exercise your rights under Art. 11 by contacting us
at support@lumenjournalapp.com.
13. Changes to this policy
We may update this policy. When we make material changes, we will update the version above and, where required,
ask you to review and accept the new version in the App before continuing.