LumaLedger

Privacy Policy

Last updated: September 2026 · LumaLedger is in private beta. We review this policy at least every six months.

LumaLedger connects to your bank accounts so you can see your money in one place. That means we handle financial data, and this page says plainly what we collect, who else touches it, how long we keep it, and how to make us delete it. We do not sell your data, and we do not share it for advertising.

What we collect

  • Your account. Email address, and the name and profile picture you choose to add.
  • Financial data from your bank, through Plaid. Account names and types, balances, transaction history, investment holdings, loan and credit details, and — if you turn it on — official statements. We never see or store your bank username or password; those go directly to Plaid.
  • What you add yourself. Properties (including the address), vehicles, credit scores you log, documents you upload to the vault, and any categorization or notes you record.
  • How you use the app. Pages viewed, actions taken, error reports, and session recordings — see Analytics and session recording below.
  • Billing. If you subscribe, your email and subscription status. Card details go to Stripe and never reach our systems.

How we use it

Only to provide LumaLedger to you: showing your balances and net worth, categorizing transactions, reconciling your ledger, producing reports, answering your questions in the assistant, and — if you subscribe — billing you. We also use aggregate usage data to fix bugs and decide what to build. We do not sell your data, rent it, or share it with advertisers.

Bank connections and Plaid

We use Plaid to connect to your financial institutions. You authorize each connection yourself in Plaid's own consent flow, which is governed by Plaid's End User Privacy Policy. Plaid gives us an access token, never your credentials; we store that token encrypted with a key held outside the database.

You can disconnect an institution at any time in Settings → Connections. Doing so tells Plaid to revoke the token and deletes our stored copy, so no further data is retrieved.

Who else processes your data

We use the service providers below. Each receives only what it needs to do its job, and none of them may use your data for their own purposes.

  • Plaid — bank connectivity. Receives your bank authorization and returns your account data.
  • Supabase (on AWS, US) — database, sign-in, and file storage. Holds everything listed above.
  • Render — runs our API. Your data passes through it.
  • Vercel — serves the web app.
  • Anthropic — powers automatic transaction categorization and the in-app assistant. Receives transaction descriptions, amounts, and the questions you ask the assistant. Your data is not used to train their models. When the assistant looks something up on the web for you — what homes in an area are selling for, today’s mortgage rates — the search terms it writes also reach Anthropic’s search provider. Your ledger is never sent there, and the assistant is instructed to search the market rather than the person: no names, balances, account numbers or full street addresses in a query.
  • PostHog — product analytics and session recording. Receives usage events and recordings of your screen with all digits masked (see below), plus your answers to any in-app survey we ask you — the score and whatever you write in the comment box.
  • Sentry — error monitoring. Receives technical error reports, which can include the page you were on and your account id.
  • Stripe — subscription billing. Receives your email and payment details directly; we never see your card number.
  • Meta (WhatsApp) — only if you link a phone number to send receipts to, or chat with, the assistant over WhatsApp. Carries those messages and files between you and us; we receive your phone number and WhatsApp profile name with them. We do not use Facebook Login or read anything from your Facebook account.
  • Resend — sends our emails. Receives your email address, and the text of any feedback you send us from inside the app (which reaches our support inbox as an email you can reply to).
  • Zillow (via RapidAPI) and OpenStreetMap Nominatim — only if you add a property. Receive that property's address to estimate its value and place it on a map.
  • Tiingo, Yahoo Finance, and Stooq — market prices for the investment charts. Our servers request daily prices for the ticker symbols held across LumaLedger portfolios; these providers never learn who holds a security, and your browser never talks to them.
  • CarImages API — only if you add a vehicle. Receives the make, model, and year you enter so the app can show a photo and 3D model of that car, which your browser then loads from their servers.
  • CARTO — map tiles. Your browser requests tiles for the area shown when a property map is displayed.
  • Google Analytics — visitor measurement on our public marketing pages only. It does not run on your signed-in account pages.

Analytics and session recording

We record sessions in the app to find broken and confusing screens. Recordings are automatically masked before they leave your browser: every digit is replaced with a bullet, so balances, transaction amounts, account numbers, and dates are unreadable in a recording. Passwords, one-time codes, and email and phone fields are masked too. Labels, merchant names, and navigation remain visible, which is what makes a recording useful for fixing the product.

Recording only happens if you accept analytics cookies. Decline them, or withdraw later from Settings → Cookie preferences, and no recording is made at all.

How long we keep it

  • Bank access tokens — deleted as soon as you disconnect the institution, and revoked at Plaid at the same time.
  • Your account and financial data — kept while your account is open. When you ask us to delete it, we remove it within 30 days.
  • Encrypted backups — deleted on a rolling cycle, within 30 days of the data being deleted from the live database.
  • Usage analytics and recordings — deleted on our analytics provider's retention cycle; we keep no separate copies.
  • Billing records — kept as long as tax and accounting law requires, which may be longer than your account lasts.

Your rights and choices

Wherever you live, you can ask us to: give you a copy of your data, correct it, delete it, or stop processing it. Email security@lumaledger.app and we will respond within 30 days. We will not charge you or make the product worse for asking.

You can also act directly in the app at any time: disconnect a bank in Settings → Connections, delete individual records, turn off features you do not want, or delete your account entirely from Settings — which revokes bank access at the source, deletes your data, and removes your login, with no email required. Step by step, including what is kept and for how long: Deleting your data. If you are in the EEA or UK, our basis for processing is performing the contract you entered into with us, and your consent for bank connections, which you can withdraw by disconnecting. If you are in California, we do not sell or share personal information as those terms are defined by the CCPA, and we will not discriminate against you for exercising your rights.

Where your data lives

Our database, API, and backups run in the United States (AWS us-east-1). If you use LumaLedger from outside the US, your data is transferred to and stored in the US.

Security

Data is encrypted in transit (TLS 1.2 or better) and at rest (AES-256), and bank access tokens get an additional layer of encryption with a key held outside the database. Connecting a bank requires two-factor authentication on your account. Our full information security policy is available on request.

Cookies and your choice

Necessary cookies keep you signed in and remember the preferences you set yourself — your language, theme, sidebar, and which ledger you are viewing — plus a record of the cookie choice you make below. If you tick “don’t ask again on this device” when entering a two-factor code, your browser also stores the token that lets it skip the code for 30 days; you can revoke it from Settings → Security. None of this is ever used to track you across other websites, and the product cannot work without it.

Analytics cookies are set by PostHog and, on our public marketing pages, Google Analytics. We ask before setting them: nothing analytics-related loads until you accept, and if you refuse, those scripts are never fetched. You can change your mind at any time from Settings → Cookie preferences, and withdrawing also deletes what was already stored. If your browser sends a Global Privacy Control signal, we treat that as a refusal without asking.

Refusing costs you nothing: every feature of LumaLedger works exactly the same either way. We do not use advertising cookies, and we do not sell or share your personal information.

Children

LumaLedger is not intended for anyone under 18, and we do not knowingly collect data from children. If you believe a child has given us data, email us and we will delete it.

Changes to this policy

If we change how we handle your data, we will update this page and change the date at the top. For changes that materially affect you, we will tell you by email before they take effect.

Contact

Questions, requests, or complaints: security@lumaledger.app.