Privacy Policy

Introduction

Lumenless ("we," "our," or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, and safeguard information when you use the Lumenless mobile application, web application, and related services (collectively, the "Service").

Lumenless is a privacy-focused payment platform built on Solana. Our core design principle is data minimization — we collect only the information strictly necessary to provide the Service.

Information We Collect

Wallet Information

When you connect your Solana wallet to Lumenless, we receive your public wallet address. This is necessary to facilitate transactions, mint your Lumen ID (Soul Bound Token), and interact with the Solana blockchain. We do not have access to your private keys or seed phrases at any time.

Locally Stored Data

The following data is stored securely on your device using platform-native secure storage (Keychain on iOS, Keystore on Android) and is never transmitted to our servers:

• PayLink private keys (Ed25519 keypairs for payment link wallets)
• PayLink metadata (labels, creation timestamps)
• Onboarding and Lumen ID minting status

Analytics Data

We use Firebase Analytics (Google) to collect anonymous usage data on the mobile application. This includes:

• Screen views (which screens you visit within the app)
• Feature usage events (e.g., wallet connection, payment link creation, withdrawals)
• App performance metrics

On the web application, we use Google Analytics (gtag.js) to collect standard web analytics data including page views, session duration, and general traffic information.

Analytics data does not include your wallet address, transaction details, or any personally identifiable information.

Crash Reports

We use Firebase Crashlytics (Google) to collect crash reports on the mobile application. When the app crashes, technical information is collected including stack traces, device type, operating system version, and app state at the time of the crash. This data helps us identify and fix bugs to improve reliability.

Push Notification Tokens

If you opt in to push notifications, we store an Expo push notification token to deliver notifications to your device. You can disable push notifications at any time through your device settings.

Waitlist Information

If you sign up for the waitlist on our website, we collect and store your email address to notify you about product updates and availability.

Information We Do Not Collect

Lumenless is designed with privacy at its core. We do not collect:

• Private keys, seed phrases, or wallet passwords
• Personal identity information (name, address, phone number, government ID)
• Location data
• Contacts, photos, camera, or microphone access
• Browsing history outside of the Lumenless application
• Transaction contents or payment amounts (these are on-chain and public by nature of the Solana blockchain)

How We Use Your Information

We use the information we collect for the following purposes:

• Service Operation — Processing wallet connections, facilitating Lumen ID minting, and enabling payment link functionality.
• PrivacyCash — Computing balances and processing withdrawals through our backend. Wallet addresses and signed authentication messages are sent to our servers for verification.
• Analytics — Understanding how the Service is used to improve functionality and user experience.
• Crash Reporting — Identifying and resolving technical issues to maintain service reliability.
• Notifications — Sending relevant updates about your payment links and transactions (if opted in).
• Communication — Sending waitlist updates and product announcements (if you signed up).

Data Security

We implement the following security measures to protect your data:

• Encrypted Storage — Sensitive data (private keys, keypairs) is stored in your device's secure enclave using platform-native encryption (iOS Keychain, Android Keystore).
• HTTPS Only — All network communication uses HTTPS encryption. Cleartext traffic is disabled on all platforms.
• Client-Side Key Generation — Cryptographic keys are generated on your device using Ed25519 and never leave your device.
• Message Signing Authentication — PrivacyCash authentication uses cryptographic message signing rather than passwords or tokens.
• No Server-Side Key Storage — We never store, transmit, or have access to your private keys.

Third-Party Services

Lumenless uses the following third-party services that may process data:

• Google Firebase — Analytics and crash reporting. Subject to Google's Privacy Policy.
• Google Analytics — Web traffic analytics. Subject to Google's Privacy Policy.
• Helius — Solana RPC provider for blockchain interactions. Processes public blockchain queries (wallet balances, token accounts, transaction status).
• Solana Blockchain — All on-chain transactions are publicly visible on the Solana network. This is inherent to blockchain technology and not controlled by Lumenless.
• Expo — Push notification delivery service. Subject to Expo's Privacy Policy.

Blockchain Transparency

Lumenless operates on the Solana blockchain. By nature, blockchain transactions are publicly visible and immutable. While Lumenless provides privacy-enhancing features through PrivacyCash, standard on-chain transactions (such as Lumen ID minting and public token claims) are recorded on the public ledger. Lumenless does not control the visibility of on-chain data.

Data Retention

• Device Data — Stored locally until you delete the app or clear app data.
• Analytics Data — Retained by Google Firebase and Google Analytics according to their standard retention policies (typically 14 months).
• Crash Reports — Retained by Firebase Crashlytics for 90 days.
• Blockchain Data — On-chain transactions are permanent and immutable.
• Waitlist Data — Retained until you request removal or the waitlist is closed.

Your Rights

You have the following rights regarding your data:

• Access — You can view all locally stored data through the app.
• Deletion — You can delete all local data by uninstalling the app. For waitlist removal, contact us directly.
• Opt-Out — You can disable push notifications through your device settings and decline analytics collection where applicable.
• Data Portability — You can export your PayLink private keys through the backup feature in the app.

Children's Privacy

Lumenless is not intended for use by anyone under the age of 18. We do not knowingly collect information from children. If you believe a child has provided us with personal information, please contact us so we can take appropriate action.

App Permissions

The Lumenless mobile application requests only the minimum permissions necessary:

• Internet Access — Required for blockchain interactions, API calls, and analytics.
• Network State — Required to check connectivity before making network requests.
• Push Notifications — Optional, requested with your consent after onboarding.

We do not request access to your camera, microphone, contacts, location, photos, or any other sensitive device capabilities.

Changes to This Policy

We may update this Privacy Policy from time to time. Changes will be posted on this page with an updated "Last updated" date. We encourage you to review this policy periodically. Continued use of the Service after changes constitutes acceptance of the updated policy.

Contact Us

If you have questions about this Privacy Policy or our data practices, please contact us through our official channels on X (Twitter) or Discord.