Privacy Policy

1.Who this policy is from

1.1This policy applies to the Alumbus™ mobile application (“Alumbus”, “the App”) and explains how information is handled when you use it.

1.2The App is published by Alumbus Labs™ (“we”, “us”, “the publisher”).

1.3Alumbus stores what you enter only on your own device and transmits none of it to us. We therefore hold no personal data about you as a result of your using the App, and are not, in respect of that information, a controller within the meaning of the UK GDPR or the EU GDPR. You remain in sole control of it at all times. Where this policy uses the terms “personal data”, “controller”, “processor” and “processing”, they carry the meanings given in those Regulations.

1.4This policy is written to satisfy the UK GDPR and the Data Protection Act 2018, the EU GDPR for users in the European Economic Area, and the consumer privacy statutes of the United States, including the California Consumer Privacy Act as amended by the California Privacy Rights Act.

2.What the App collects

2.1Alumbus collects no personal information. There is no registration, no account, no sign-in, no email address, no name, no postal address and no telephone number. The App does not ask for and cannot obtain your identity.

2.2It contains no analytics software, no crash-reporting software, no advertising software development kits, no advertising or device identifiers, no cookies, no pixels, no fingerprinting and no third-party trackers of any kind.

2.3The App does not ask for, receive or store payment details. Subscriptions and purchases are made through Apple, as clause 16 describes.

2.4For the purposes of the California Consumer Privacy Act, the categories of personal information collected by the publisher through the App in the preceding twelve months are: none. No personal information is collected through the App, and none is therefore retained, disclosed for a business purpose, sold, or shared for cross-context behavioural advertising.

3.What you enter, and where it is kept

3.1The information you enter — account names and balances, planned income, expenses and transfers, confirmed balances, categories, groups, notes and preferences — is written to a private database inside the App's own storage area on your device.

3.2That storage is protected by the operating system's application sandbox and by device encryption when a device passcode is set. Backups the App writes are additionally marked for complete file protection, which keeps them unreadable while the device is locked. This storage is not readable by other applications.

3.3None of it is transmitted to us, to any server operated on our behalf, or to any third party. There is no copy anywhere other than on your device and in any backup you choose to create.

3.4Because we never receive it, we cannot access, disclose, correct, recover or delete it, and we cannot be compelled to produce it. Nor can we restore it if it is lost.

4.No bank connections

4.1Alumbus does not connect to any bank, card issuer or financial institution, and has no capability to do so. It never requests banking credentials, one-time passcodes, card numbers, sort codes or account numbers, and it cannot initiate, authorise or view any payment.

4.2Every figure shown in the App is one you entered, or one calculated from figures you entered.

5.Network activity, and the only data that leaves

5.1Alumbus makes one category of network request of its own, and only when you hold balances in more than one currency: a request for published foreign-exchange reference rates.

5.2That request is made to frankfurter.dev, which republishes the European Central Bank's daily reference rates. It carries the currency codes involved (for example GBP and EUR) and the information any internet request necessarily carries, including your device's IP address as seen by that service. It carries no balances, no account names, no identifiers, and nothing describing you or your finances. It is unauthenticated: there is no account with that service, and nothing sent to it can be associated with you by us.

5.3An IP address is capable of being personal data. Our lawful basis for that request is our legitimate interests under Article 6(1)(f) of the UK and EU GDPR — specifically, providing a feature you have asked for by keeping more than one currency — balanced against the minimal and non-identifying nature of what is sent. We consider that balance plainly met, and you may object to it at any time by the switch described below.

5.4You may disable this entirely under Settings › Exchange rates. With automatic updates switched off, Alumbus makes no network request at all unless you expressly ask it to refresh rates. This is the whole of the App's own outbound network activity; there is no other.

5.5That service operates its own infrastructure and may process the request outside the United Kingdom or the European Economic Area. Data sent to it is governed by its own terms and privacy practices, over which we have no control and for which we accept no responsibility. Since no data identifying you or your finances is sent, we do not consider any transfer safeguard under Chapter V of the UK or EU GDPR to be engaged on our part.

5.6Separately, the App Store services built into your device communicate with Apple to show prices, process purchases and confirm whether a subscription is active, as clause 16 describes. Those exchanges take place between your device and Apple, under Apple's privacy policy, and nothing in them is sent to us.

6.Biometric authentication

6.1If you enable the App lock, Alumbus asks the operating system to confirm your identity using Face ID, Touch ID or your device passcode.

6.2Alumbus receives only a yes-or-no result. It never receives, processes, stores or has any access to your biometric data, which remains under the exclusive control of the device's secure hardware. No biometric identifier or biometric information within the meaning of any state biometric privacy statute is collected, captured, converted, stored or shared by the App or by us.

7.Backups and exports

7.1Alumbus can create a backup file containing the whole of a profile, and can export comma-separated files for use in a spreadsheet.

7.2Automatic backups are written inside the App's own storage. If, and only if, you select a destination folder, Alumbus additionally copies each backup to that folder. That folder may be on your device or may be provided by a third-party storage or cloud provider of your choosing.

7.3Backup and export files are not encrypted. They contain the information described above in readable form, and any person or application able to open the file can read it. Alumbus relies on the protection of wherever the file is kept.

7.4Where you choose such a destination, the information in that backup leaves the App's protected storage and becomes subject to the terms, security and privacy practices of the provider you selected. We have no visibility of, control over, or responsibility for that provider. You should choose a destination whose protection you consider adequate for unencrypted financial information — a device secured with a passcode, or an account secured with a password and two-step verification.

7.5Anything you share, send or save out of the App by any other means is likewise outside the App's control from the moment it leaves.

8.Notifications

8.1If you grant permission, Alumbus may schedule local notifications — for example a reminder to confirm a balance, or notice that a backup did not complete.

8.2These are generated on your device by the App itself. No push notification service is used and no notification content is sent to or through any server.

8.3A notification may name an account and a figure. Whether such a notification is visible on a locked screen is governed by your device's own settings, under Notifications › Alumbus › Show Previews.

9.How long anything is kept

9.1We keep nothing from your use of the App, so no retention period arises on our part in respect of it.

9.2What you enter remains on your device until you delete it, erase it through Settings › Erase all data, delete the profile it belongs to, or remove the App. Backup files remain wherever they were written until you or the operating system remove them; the App keeps the eight most recent of its own and deletes older ones as new ones arrive.

10.Automated decision-making

10.1The App performs arithmetic on figures you supply and displays the result. It does not profile you, and it makes no decision producing a legal or similarly significant effect concerning you within the meaning of Article 22 of the UK or EU GDPR. No such decision-making, automated or otherwise, is carried out by us.

11.Your rights in the United Kingdom and the European Economic Area

11.1If you are in the United Kingdom or the EEA you have the rights of access, rectification, erasure, restriction of processing, data portability and objection, together with the right to withdraw consent where processing is founded on it, in respect of personal data a controller holds about you.

11.2Because we hold no personal data about you from your use of the App, there is nothing there against which those rights can be exercised. This is not a refusal: it is the consequence of a design in which no data from the App ever reaches us.

11.3In respect of the information on your device you exercise these rights directly and immediately: you may view, correct and delete any record at any time; you may export the whole of it, in a structured, commonly used and machine-readable form, using Settings › Back up everything or the spreadsheet exports; and you may erase all of it using Settings › Erase all data, or by deleting the App, which removes its storage with it.

11.4You have the right to lodge a complaint with a supervisory authority. In the United Kingdom this is the Information Commissioner's Office (ico.org.uk). In the EEA it is the supervisory authority of the country in which you live or work, or in which you believe an infringement occurred.

11.5Where we are not established in the EEA, we do not monitor the behaviour of people in the EEA and we process no personal data of theirs in connection with offering the App. We therefore do not consider a representative under Article 27 of the EU GDPR to be required. Should that position change, a representative will be appointed and named in this clause.

12.Your rights in the United States

12.1If you are a resident of California, the California Consumer Privacy Act as amended by the California Privacy Rights Act gives you the right to know what personal information is collected, used, disclosed and sold or shared about you; the right to delete it; the right to correct it; the right to opt out of its sale or sharing; the right to limit the use of sensitive personal information; and the right not to be discriminated against for exercising any of these.

12.2We collect no personal information from you through the App, sensitive or otherwise. We do not sell personal information and have not done so in the preceding twelve months. We do not share personal information for cross-context behavioural advertising and have not done so in the preceding twelve months. We disclose no personal information for a business purpose, because we hold none. No “Do Not Sell or Share My Personal Information” mechanism is required or offered, because there is nothing to sell or share, and we do not process opt-out preference signals for the same reason.

12.3California's “Shine the Light” law (Civil Code § 1798.83) permits residents to request details of personal information disclosed to third parties for their direct marketing purposes. We make no such disclosures.

12.4Comparable rights under the privacy statutes of Colorado, Connecticut, Delaware, Iowa, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Texas, Utah and Virginia, and of any other state enacting equivalent legislation, are answered in the same terms: we hold no personal information about you, conduct no targeted advertising, no sale, and no profiling in furtherance of decisions producing legal or similarly significant effects.

12.5We hold no personal information about you from the App, so there is nothing from it to which a request to know, delete or correct, or to opt out of a sale or sharing, could relate. Were such a request made, no account and no identifying information would be required in order to answer it, no charge would be made for answering, and an authorised agent could make it on your behalf with written permission.

13.Children

13.1Alumbus is a general-purpose personal finance tool intended for adults. It is not directed at children, and it is not designed to appeal to them.

13.2The App collects no personal information from anyone, and so collects none from children. We do not knowingly collect personal information from a child under 13 within the meaning of the United States Children's Online Privacy Protection Act, nor from a child below the age of digital consent in their country of residence under Article 8 of the EU GDPR, which is 13 in the United Kingdom and between 13 and 16 across EEA member states.

14.Security

14.1Alumbus relies on the security the operating system provides: application sandboxing, file protection, device encryption, and — at your option — biometric or passcode authentication before the App will open.

14.2No system is perfectly secure. A device that is unlocked, shared, jailbroken or otherwise compromised may expose information stored on it. You are responsible for the security of the device on which you run the App and of any destination folder to which you send backups.

14.3Because no personal data from the App reaches us, there is no circumstance in which a breach of our systems could expose the information you enter in it, and accordingly no personal data breach of ours could be notifiable under Article 33 of the UK or EU GDPR.

15.The App Store

15.1Alumbus is distributed through the Apple App Store. Apple collects information about downloads, purchases and, where you have permitted it, diagnostics from your device, under Apple's own privacy policy and not ours. We receive from Apple only aggregate sales, subscription and usage figures and financial reports, from which no individual can be identified.

15.2The privacy information shown on the App's App Store listing declares that no data is collected. That declaration and this policy are intended to say the same thing.

16.Subscriptions and purchases

16.1Alumbus can be used during a free trial, and then with a subscription or a one-off lifetime purchase. Every purchase, subscription, trial, renewal, cancellation and refund is processed by Apple through your Apple Account, under the Apple Media Services Terms and Conditions and Apple's privacy policy.

16.2We never receive your name, your email address, your Apple Account, or any card or billing details. Apple does not give them to us, and we do not ask for them.

16.3To decide whether the App may be used, the App reads, on your device, the purchase records that Apple's App Store services hold for your Apple Account, and checks that each one is genuinely signed by Apple. That check happens entirely on your device. The records are not sent to us, and we operate no server that could receive them.

16.4An offer code is typed into Apple's own screen and checked by Apple. We learn only aggregate figures, such as how many codes have been redeemed.

17.Our website

17.1Our website, alumbuslabs.com, sets no cookies, runs no analytics, collects nothing you could enter and loads nothing from any other site. It is served by Cloudflare, which processes the technical information that any request to a website carries, including your IP address, in order to deliver the site and protect it from attack.

18.Changes to this policy

18.1This policy may be updated to reflect changes to the App or to the law. The effective date shown at the top of this page indicates when the current version took effect, and the current version is always available here within the App.

18.2Where a change materially affects how information is handled you will be asked to read and accept the updated policy before continuing to use the App, and the change will be described in the App's release notes.