Privacy Policy
Version 0.2 (draft) · Early access · Effective [effective date, set at sign-off] · Draft, pending legal review
1. Early access
Lumbung is in early access and is free. Some features are not built yet, and some may change. This policy describes only what the app does today.
2. Who we are
Lumbung is run by [legal entity name, owner to confirm], [registered address, owner to confirm], [registration number, owner to confirm]. For any question about your data, write to support@lumbung.banuacoder.com.
3. Data we collect (draft)
Account: your name and email address, and your passkey’s public key. We do not store a password, and your biometric data never leaves your phone. Device: a device ID, used for sign-in sessions. Your money data: the accounts, categories, transactions and notes you enter, which the app syncs to our server while you are signed in. Drafts: the suggested entries made by the tools in section 4, with the amount, date, merchant, note and which tool made them. A voice draft also holds the words you said, and a receipt draft also holds item names and amounts. Drafts sync like other entries. A Money Manager backup file: only if you choose to import one. Support: your email, message and our replies, if you write to us. Technical: our servers see your IP address when you connect, to limit abuse. In a shared workspace, the change log can also record the IP address of the person who made a change. We do not collect your location or contacts. We do not receive your voice audio or your receipt photos. The app has no advertising or analytics tools.
4. Ways to add entries (draft)
You can type an entry, or use the tools below. Each tool makes a draft: a suggested entry that waits in your Drafts inbox until you add it or dismiss it. Voice entry: Lumbung asks for the microphone and listens only while the voice sheet is open. Your phone’s speech recognizer hears the audio and Lumbung receives only the text, never the audio. By default the recognizer may send the audio to its provider; the switch “On-device recognition only” keeps it on your phone. We save the words you said with the draft. Receipts: you can take a photo or choose one. Lumbung opens your phone’s camera app or photo picker. The text is read on your phone with Google ML Kit, the photo is not uploaded, and Lumbung deletes its copy when you leave the receipt screen. We save the merchant, date, total, and item names and amounts as a draft. Share sheet: you can share text or an image from another app. While the app is locked, Lumbung holds it in memory only, then handles it after you unlock. For text we save the amount, date and merchant, not the text you shared. A shared image goes through the receipt steps. Import: a CSV file is read on your phone and is not uploaded. A Money Manager backup is different: Lumbung uploads it to our file storage so our server can read it. We delete it when the import ends, and a cleanup job removes any file left after 24 hours. Payment notifications are off in this version, and Lumbung reads none. When we turn this on, you must first allow Notification access in Android. Lumbung will look only at notifications from an approved list of bank and e-wallet apps, read them on your phone, keep only the amount, date, merchant and app, and throw away the notification text. We will update this section before then. Not active yet, and collecting nothing: email forwarding, NFC card reading, WhatsApp, Gmail, capture keys, and cloud OCR or AI reading. We will update this policy and ask for your choice before any of them goes live.
5. How we use it
To run your account, sync your data between your devices and the people you share a workspace with, keep the service safe, and answer support. We do not sell your data and we do not use it for advertising.
6. Who else handles your data (draft)
Our server host: [server host and country, owner to confirm]. Google Drive, where we store daily database backups. An email provider, [email provider, owner to confirm], which sends account and support email. Server monitoring, which holds counts, timings and errors, not your entries. Object storage for imports, [storage provider and country], which holds a Money Manager backup only until the import ends and never more than 24 hours after. Your phone’s speech service: if you use voice entry without the on-device switch, the audio may go to the provider of your phone’s recognizer, not to us. Other members of a shared workspace, who see what you add there according to their role. We may also share data when the law requires it.
7. How we protect it
The database on your phone is encrypted, and you can lock the app with a PIN or biometrics. Data travels between the app and our server over encrypted connections. Sign-in uses passkeys, so there is no password to steal. Data on our server is not end-to-end encrypted: we keep it in readable form, so people with server access could read it. We limit that access. No system is perfectly safe. If a breach affects you, we will tell you as the law requires.
8. Keeping and deleting your data (draft)
We keep your data while your account is active. You can delete your account in the app: Settings, then Security, then Delete account. Your account is disabled at once and erased after a waiting period of 30 days. If you cannot sign in, write to support. If you own a shared workspace that others still use, hand it over or delete it first. We keep entries you added to someone else’s workspace, without your name. We keep billing records for 10 years if you ever paid, and referral records for 24 months. Backups are not used for anything else and age out after [backup period, owner to confirm]. A Money Manager backup file is deleted when the import ends, or within 24 hours. Waitlist and status-page subscriptions are separate: ask support to remove them.
9. Your rights and a copy of your data
You may ask to see, correct or delete your data, and to withdraw consent. There is no export button in the app yet. Write to support and ask for a copy. We will reply within [reply time, owner to confirm].
10. Children
Lumbung is for people aged [minimum age, counsel to confirm] and over. If you think a child has an account, tell us and we will delete it.
11. Other countries
Our server and backups may be outside Indonesia. We will update this section with the locations and the safeguards we use.
How to delete your account: Delete account page.
Read the Terms of Use.