Privacy Policy

Pilot with limited spots. Last updated November 9, 2026 (AI requests are now answered by Anthropic, a company in the United States, with DeepSeek, in China, as a fallback; AI consents are asked again). Before that, November 6, 2026 (Who I want to be, in testing with the team, with AI help for the sentence and for the priorities of the year’s focus). Earlier, November 1, 2026 (Finances in testing with the team, now with entries, suppliers, card bills and reports; account deletion request and notifications in the Android app).

Versão em português

Who is responsible for your data

Lumens Live is the data controller. For any request about your data, write to hello@lumenslive.com.

What we store and why

Your email, for sign-in by link and to keep your session (30 days without use). There is no password.
Waitlist: if you ask for access before a spot is available, we store your email and the request date, only to grant access and notify you.
Your name, if you fill it in under My routine, to show it in the corner of the screen. It is optional.
Your routine (time zone, days and hours of sleep, work, commute both ways, exercise and study), to calculate how much time fits in your month.
Your tasks and appointments (title, description (notes), duration, deadline, priority, day and time, the repeats of an appointment and, when you tell how it went, how it was done and the minutes it took), the app's notices and the history of changes to your plan. The description is free text and may contain a link or information about other people, if you write it; it never goes to the AI, usage measurements, technical logs or your Google Calendar (only the title goes there). Notices about appointments, reminders, habits, the daily review, the weekly review and deciding on a priority, and the record of which ones went out, are kept for 30 days.
External calendars, only if you connect them (Google Calendar or Outlook): the account email, a long-lived access token stored encrypted, and the timed events of your primary calendar (start, end, title and link), from 7 days back to 60 days ahead. They are used to subtract that time from your plan and to show the events in the app's calendar. If you turn on writing, the app creates a “Planejador” calendar in your Google account with your routine, your scheduled appointments and your deadlines for the next 4 weeks, and does not touch your other calendars. Titles may reveal personal information (for example, a medical appointment): they never go into usage measurements or technical logs.
Reminders you write down (what to remember, day, optional time, type, repeat and when you want the notice: days ahead and time), to show in your plan and notify you. They take no time. A pending task can be linked to a reminder and have a notice before its deadline.
Lists: the name, type, tags and items of your lists (text, checked or not, order and the linked task, if you turn an item into a task). Lists are not sent to the AI or to Google; an item you turn into a task follows the rules for tasks. For grocery and wish lists, also each item's quantity, unit, category, price, link and note. My products: the products you have added to a grocery list (name, category, unit and last price), to fill in the next one, and the price history: the price, unit and date of each priced item you checked. None of this is sent to the AI or to Google.
Notes: the title, the formatted text, tags, whether it is a favorite and the link to tasks created from it. Notes are not sent to the AI or to Google. What you turn into a task (the title or the passage you choose) becomes part of the task and follows its rules: the name may go to Google Calendar and to the AI weekly review; the description stays in the app. The task stays if you delete the note.
Meal plan and recipes: your saved recipes (name, servings, ingredients with quantity and unit, notes and method) and the weekly meal plan (the recipe or text of each meal, with servings). Ingredients use the products in My products. Items the meal plan adds to a grocery list are marked "From the meal plan". None of this is sent to the AI or to Google. If you share the meal plan with your Family, the other person sees and edits the meals of every week, including past ones. They only see a recipe of yours if you share it. If either of you leaves, the meals stay in the plan of whoever created it, including the ones the other person added, and recipes go back to being their creator's only.
Password vault: what you keep in the Vault (name, category, site, login, password, notes and recovery details) is encrypted on your device with your vault password before it leaves it. We only store the encrypted result, which not even the Planejador team can open. Only the date you asked to be reminded to change a password (without saying which), the lock time, the date the vault was created and how many entries it holds are stored unencrypted. The contents of the Vault are never sent to the AI, to Google, to Family, to telemetry or to logs; telemetry only counts that a Vault reminder was sent. If you forget your vault password and lose your recovery key, nobody can recover its contents.
Finances (in testing with the team): your accounts (name, bank, opening balance and its date), your cards (name, bank, limit, closing and due days, and the account that pays the bill), your expense and income categories, your account entries (amount, date, supplier, category and note), your suppliers with their aliases, transfers between your accounts, card purchases (including installment purchases, with the projected installments), refunds, card bills (dates, the bank total you enter and whether it was checked) and bill payments. It is only for you to organize your money. It never goes to the AI, to Google or to the Family, and it is not part of telemetry. We never ask for card, branch or account numbers or bank passwords. Avoid storing health data there.
Habits, only if you want: the name of each habit and the days you checked it. Because a habit can reveal health information (a medication, quitting smoking), we ask for your consent before the first one and store the date. You can delete everything and withdraw consent at any time, under Habits. Habit names never go into usage measurements.
Daily review: for each item of your routine, the planned time, what actually happened and whether you followed it. It helps you see, over time, what is working.
Mood, day score and sentence, only if you want: in the daily review, how you felt (from very bad to very good), a score from 0 to 10 and a short sentence. Because mood and the sentence can reveal health information, including mental health, we ask for your consent before the first entry and store the date. It never goes to the AI, the weekly review, usage measurements or technical logs. You can delete everything and withdraw consent at any time, under Daily review → “Delete mood and sentences and withdraw consent”; the routine review stays. Once the Journal is available to you, the same consent also covers emotions and the Journal, and the button becomes “Delete mood, journal and withdraw consent”, which deletes everything at once, without going through the Trash.
Journal, only if you want: entries (date, title, text, answers to the prompts, emotions, tags and favorite) and “Como estou” check-ins (the emotions of the moment and a sentence). The title, text and answers are encrypted in the database with a key kept outside it; the date, emotions and tags are not. Only with your consent — the same one as for your daily mood, now extended to the Journal. The Journal is never sent to the AI, to Google or to Family, and is kept out of usage measurements and technical logs. If you turn on the reminder, it carries a generic message, never what you wrote.
Weekly review: for each week you review, what was left behind and the decision you made (done, reschedule, back to the list, drop), with an optional reason, how it went and the minutes it took, your answers to the reflection questions and, if you want, the “was the plan realistic?” rating. It lets you close the week in one go and keep what you thought about it.
AI summary, only if you want: in the weekly review you can ask for a summary, one suggestion per item left behind and questions to reflect on. To do that we send to Anthropic, a company in the United States, or, if it is unavailable, to DeepSeek, a company in China, the titles of the appointments left behind, the reasons you wrote when using free time and the week's numbers, with no links, emails or long numbers. Nothing from your Google Calendar, habits, task descriptions or email is sent. A title can reveal personal information, including health: that is why we ask for your specific consent before the first request and store the date. The AI only suggests; nothing in your plan changes without your click. You can withdraw consent at any time, under Weekly review → “Stop using the AI and delete the suggestions”: this deletes what the AI generated and keeps what you wrote.
Life Priorities, only if you want: what is a priority for you right now (title, why it matters, start and end or review date), the challenges of each one (how you will know you made progress: a number from where to where, with a unit, or a milestone, and the deadline), the check-ins (value or done, how you feel it is going and an optional note) and which pending tasks, appointments and habits are part of each challenge. A priority can reveal information about health, beliefs, family or money: that is why we ask for your specific consent before the first one and store the date. The time invested in each priority is calculated from your plan and from the minutes you enter when completing an appointment. Titles, values and notes never go into usage measurements or technical logs. You can delete everything and withdraw consent at any time, under Priorities → “Delete everything and withdraw consent”; your pending tasks and habits stay.
New priority assistant, only if you want: when creating a priority, you can ask for help to organize it. To do that we send to Anthropic, a company in the United States, or, if it is unavailable, to DeepSeek, a company in China, only the text you wrote, with no links, emails or long numbers. Nothing from your calendar, pending tasks, habits, other priorities or email is sent, and we do not store the text. From the answer, we store only the suggested actions you tick (title, type and duration and, for a repeating appointment, the suggested days and time, plus the time of day and the times per week), in each challenge, until you create or dismiss them, and whether you created, dismissed or changed them before creating. When you create or dismiss one, we delete the title, days, time, time of day and times per week. The rest of the answer stays on the screen until you create the priority. Because the text can reveal information about health, beliefs, family or money, we ask for a specific consent for this transfer, separate from the weekly review summary, and store the date. The AI only suggests; nothing becomes a pending task, habit or appointment without your click. You can withdraw consent at any time, under Priorities → “Stop using the AI”: this deletes the stored suggested actions, and what you already created stays.
Who I want to be, only if you want: under Priorities, you can write in one sentence who you want to be 3, 5 or 7 years from now and the areas that matter for it (the pillars). We store the sentence, the horizon, the pillars, the next review date and the earlier versions, and which priority comes from which pillar. While you answer the questions, we store your answers in progress until you save the sentence, tap “Do it later” or start over. The sentence, the pillars and the answers can reveal information about health, beliefs, family or money: that is why we ask for a specific consent before storing the first sentence or answer, separate from the Priorities one, and store the date. The sentence, the pillars and the answers never go into usage measurements or technical logs, and none of it goes to the AI unless you ask. You can delete everything and withdraw consent at any time, under Priorities → “Delete Who I want to be and withdraw consent”: this deletes the sentence, the pillars, the versions and the answers, and your priorities stay.AI help with the sentence, only if you want: you can ask the AI to suggest a sentence and pillars from your answers. To do that we send to Anthropic, a company in the United States, or, if it is unavailable, to DeepSeek, a company in China, only the horizon, the answers you wrote and the words you picked, with no links, emails or long numbers. Nothing from your calendar, your priorities, your email or any identifier is sent. The suggestion is not stored on the server: it only shows on the screen and stays on this device until you save, and only what you save becomes your sentence. We ask for a specific consent for this transfer, separate from the consent above and from the other uses of AI, and store the date. You can withdraw consent at any time, under Priorities → “Stop using the AI in Who I want to be”; your sentence, pillars and answers stay. With the same consent, you can ask the AI to suggest one priority for each focus of the year you pick: to do that we send only your sentence, the horizon and the names of those focuses; the suggestions are not stored on the server either, and only the ones you create become priorities.
Month capture with AI, only if you want: in Pending, you can write what you need to do this month and ask for draft pending tasks. To do that we send to Anthropic, a company in the United States, or, if it is unavailable, to DeepSeek, a company in China, only the text you wrote, with no links, emails or long numbers, and today's date. Nothing from your calendar, pending tasks, habits or email is sent, and we do not store the text or the drafts: they stay only on the screen. Only the drafts you tap “Add” on become pending tasks. We ask for a specific consent for this transfer, separate from the other AI uses, and store the date. You can withdraw consent at any time, in “Capture with AI” itself.
Calendar in another app, only if you generate the URL: in External calendars, you can generate a secret URL to see your routine, scheduled appointments and deadlines in Apple Calendar, Outlook or another app. We store only a fingerprint (hash) of that URL, the option to hide names and the dates it was created, expires (90 days) and was revoked. Anyone with the URL sees this data without logging in, so it is shown only once and you get an email when you generate and revoke it. You can revoke it at any time.
Notifications, only if you turn them on: the address your browser creates to receive notifications (it identifies the device), the keys that encrypt each notification, the device type, and the notification types you want on the device and their times. In the Android app, instead of the address and the keys, the identifier that Google's Firebase Cloud Messaging gives the device. You turn them off under Notifications, device by device; signing out in the app also turns them off.
Subscription: if your account is enabled for features that will require a subscription (free during the pilot), we keep whether it is on, since when, and who on the team turned it on or off.
Family: who is in your Family, when they joined and whether they can only view because of their subscription. When you invite someone, we keep their email and send them an email with your name and a link. The invite lasts 7 days and is deleted 30 days after it expires. An invited person without an account skips the waiting list, and we record that. Nothing from the Family is sent to the AI or to Google. What you share with your Family (lists and reminders) is seen by its members, who can add, edit and check list items. We keep who checked and who last changed each item, and an activity log (who did what and when, without the text) for 30 days. Products from shared lists go to the Family catalog. Nothing shared is sent to the AI, to Google or to our usage metrics.
Family: joint appointments, household chores and board: joint appointments (title, description, date and time, who invited and the answer), household chores (title, description, duration, due date, repetition, who is responsible and who did it) and board notes (text, pinned or not, author and whether the other person read it). Only you and the other member of your Family see them. None of it is sent to the AI, not even after leaving the Family or restoring from the Trash. An appointment you accept goes into your schedule and, if you turned on the "Planner" calendar in Google, there too, including the title the other person wrote. Household chores are not sent to Google.
Feedback you send through the app, kept for 12 months.
Usage measurements (for example, “an appointment was scheduled”), with no title, text or email, linked to a pseudonym and deleted after 180 days. They tell us whether the app works.

We do not store phone numbers, addresses, location or contacts, and we do not use third-party cookies or trackers.

Where it is stored

The app runs on Cloudflare and the database is hosted by Railway, in the United States; the sign-in email is sent through Resend; encrypted backups are kept on GitHub. If you connect an external calendar, the app talks to Google or Microsoft on your behalf. In the Android app, the notifications you turn on go through Google LLC's Firebase Cloud Messaging, in the United States, with only the device identifier, a generic text and the path of the screen a tap opens. These providers only process data to make the app work. Because some of them are outside Brazil, there is an international transfer, under article 33 of the LGPD (Brazil's General Data Protection Law). If you ask for the AI summary in the weekly review, help from the new priority assistant, the month capture or AI help in Who I want to be, the app sends to Anthropic, in the United States, or, if it is unavailable, to DeepSeek, in China, only what is described above, with your specific consent for each one (article 33, VIII).

Data received from Google

The app's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. This data is used only for the features described above: it is not sold, not used for advertising or to train AI models, and no one reads it, except at your request, to investigate a security issue, or when required by law.

Who we share Google user data with

Data received from Google (the account email, the stored access token and your calendar events) is not sold, rented or given to anyone. It only passes through the infrastructure providers that run the app, which act on our behalf and may not use the data for their own purposes:

Cloudflare, where the app runs: processes the data to build your screens and talk to Google.
Railway, which hosts the database where the data is stored.
GitHub, which keeps database backups, encrypted before they leave the server.

Other than that, we only disclose Google user data at your request or with your consent, or when required by law or a court order. We do not share it with advertisers, data brokers or AI services.

How we protect your data

Encrypted connections: all traffic between you, the app, the database and Google uses HTTPS/TLS.
Encrypted calendar access: the long-lived access token to your calendars is stored encrypted with AES-256-GCM, with the key kept separate from the database.
Per-account isolation: the database enforces row-level security, and each account can only see its own data.
Minimum access: the app asks Google only for what it needs (read your calendar, manage only the “Planejador” calendar it creates, and see the account email). Event titles never go into usage measurements or technical logs.
Encrypted backups: daily backups are encrypted and expire automatically after 35 days.
Encrypted notifications: in the browser, each notification is encrypted end to end up to your device. Your browser's push service (Google, Apple or Mozilla) only receives an opaque address and encrypted bytes; it cannot read the content and does not know who you are. In the Android app, the notification goes through Firebase Cloud Messaging, by Google LLC, which receives the device identifier, a generic text (“You have a new notice”) and the path of the screen a tap opens (for example Today or the Journal, which shows the kind of notice), never the content of the notice: it only shows when you open the app.
Revocation: when you disconnect a calendar, its events are deleted immediately. You can also revoke access directly in your Google Account.
Incidents: if a security incident may affect you, we notify you and the ANPD (Brazil's data protection authority), as required by the LGPD.

How long we keep it

For as long as your account exists. External calendar events are kept only within the window from 7 days back to 60 days ahead, and are removed as soon as you disconnect (under External calendars), or 7 days after the access expires. What you delete (lists, journal entries, notes, tasks, appointments and reminders) stays in the Trash for 30 days, where you can restore it, and is then deleted for good, with its history and copies (notices and the AI suggestion about that task in the weekly reviews). You can delete it sooner from the Trash. The weekly review summary and questions written by the AI stay until you stop using the AI or delete your account, and may mention the name of a deleted task. AI questions you kept in your reflection stay with it. Your products stay in My products even after the list is deleted; they go when you delete them there. The price history belongs to the product: it stays after the list is deleted and goes when you delete the product in My products. If you ask for deletion, we erase everything within 15 days; backups expire on their own after 35 days. The waitlist email is kept until the end of the pilot, or until you ask to leave the list. If someone leaves the Family, what they created becomes private to them again, and what the other person created disappears for them. If you delete your account, what you created is deleted, including what was shared, and the other person is notified first. Items you added to lists the other person created stay with them, as part of those lists; there, you show up as a former member. Unpinned notes disappear after 7 days, and completed chores after 30. A joint appointment stays while its creator's appointment exists; when the creator cancels it, deletes it for good, leaves the Family or deletes the account, the other person's copy goes to their Trash and is deleted for good after 30 days, also for an occurrence that already happened. A deleted recipe stays in the Trash for 30 days; when it is deleted for good, the meals that used it go too. Clearing a meal, or a whole week, deletes it right away. The meal plan stays while the account exists. The Vault stays while the account exists. Deleting an entry or the whole vault deletes it right away, without the Trash. Finance data stays while the account exists and is deleted with it.

Your rights

You can request confirmation, access, correction, a copy of your data (JSON) or deletion of your account by email at the address above. We respond within 15 days. You can also request deletion in the app, under Settings → Delete account: you are signed out of every device right away, get an email with the deadline and can cancel until then (how to delete your account, in Portuguese). We keep the date of the request, and of the cancellation if any, while the account exists. Your copy includes your lists in full, including the items the other person in your Family added to them, your reminders and your activity. In a copy of your data, the Vault is exported encrypted, with instructions to open it with your password. The copy of your data includes Finances. In Finances, you can also download your data from Reports. Connecting an external calendar is a specific consent, which you withdraw under External calendars → Disconnect. Tracking habits is also a specific consent, requested before the first habit, which you withdraw under Habits → Delete all habits. Tracking your mood and daily sentences is also a specific consent, requested before the first entry, which you withdraw under Daily review → Delete mood and sentences and withdraw consent; with the Journal, it also covers your emotions and what you write, and the button is called Delete mood, journal and withdraw consent (also in the Journal). Asking for the AI summary in the weekly review is also a specific consent, which you withdraw under Weekly review → Stop using the AI. Tracking Life Priorities is also a specific consent, requested before the first one, which you withdraw under Priorities → Delete everything and withdraw consent; and asking the new priority assistant for help is another, separate one, which you withdraw under Priorities → Stop using the AI. Writing Who I want to be is also a specific consent, which you withdraw under Priorities → Delete Who I want to be and withdraw consent; and asking the AI for help with the sentence is another, separate one, which you withdraw under Priorities → Stop using the AI in Who I want to be. Turning on notifications is a per-device consent, which you withdraw under Notifications. If a health-related routine category ever exists, it will only be offered with your specific consent, which you can withdraw at any time.

Back to sign-in