Privacy for

Lumen Privacy Policy

Effective September 2026

Lumen is a photo viewer for folders on your Mac. There are no Papermint servers, no accounts, no analytics and no ads. Your photos are read from the folders you open, and they never leave your Mac.

In short

Lumen collects nothing: your photos, the search index and your settings stay on your Mac, and we never see any of it.

What we collect2

Nothing. Lumen has no accounts, analytics, advertising, tracking or third-party code. We receive no personal data, no usage statistics and no identifiers.
Lumen has no crash reporting of its own. If you choose to share analytics with app developers in macOS settings, Apple may pass us anonymous crash reports under Apple's own terms.

Your photos and folders5

Lumen is sandboxed by macOS. It can only reach the folders and files you choose in the open panel, drop onto its window, or open from Finder.
To reopen your folders later, Lumen saves macOS access permissions (bookmarks) for them on your Mac, along with your folder list and the folder and photo you were last viewing. Remove from Folders deletes a folder's saved permission.
Lumen only changes files when you ask it to: moving photos to the Trash, renaming, pasting, duplicating, or saving an edited copy, crop, export or conversion.
When you pick, reject, star or colour-label a photo, Lumen writes those marks to a small .xmp file next to the photo, in the same folder, so other photo apps can read them. It never writes inside the photo file. These files stay in your folders on your Mac.
Thumbnails are kept in memory while Lumen is open and are not saved to disk.

Search and on-device analysis7

To make photos searchable, Lumen reads the photos in your library folders and the folder you have open, on your Mac, using Apple's on-device Vision framework. It picks out the kinds of things in each photo, reads any text in it, counts whether people appear, and reads the date, camera and location stored in the file.
Lumen notices that people are in a photo, but it never recognises faces or works out who anyone is.
If you turn on smart search, Lumen downloads an on-device model (EmbeddingGemma 2, by Google) once, and uses it on your Mac to turn each photo, and each search you type, into a list of numbers that describes what it shows. Photos and searches are never sent to Google, Apple or us.
Place names come from a city list built into the app, so a photo's location is matched offline and never sent anywhere for search.
The results are kept in a search index inside Lumen's own container on your Mac (Application Support › Lumen › Search). It holds file and folder names, dates, camera details, locations, recognised subjects and text, the smart search numbers, a visual fingerprint used for Find Similar and Similar shots, and any descriptions written by earlier versions of Lumen. It is never uploaded or synced.
To spot exact copies, Similar shots compares the contents of photos that have the same file size, on your Mac. Nothing about your photos is sent anywhere.
Remove from Folders deletes that folder's entries from the index, unless it is the folder open at the time, and moving a photo to the Trash removes it too. Settings › Smart Search › Remove deletes the model. To remove everything Lumen has stored, delete the app and the folder ~/Library/Containers/com.papermint.lumen.

Network use5

Lumen never sends anything about you, your photos or your searches over the internet. It uses the network only for the smart search download and for Apple's own services.
Smart search model. When you choose to download smart search, Lumen fetches the model files from downloads.papermint.studio, our download server, hosted by Cloudflare. The request contains nothing about you, your photos or your searches; like any web request, it shows your IP address to Cloudflare, which keeps standard short-lived logs. After that, smart search works offline.
Purchases. StoreKit contacts the App Store when Lumen starts, to check for Lumen Pro and the free trial, and when you start the trial, buy or restore.
Maps. When the info panel shows a photo that has a location, Apple Maps loads the map around that spot from Apple's servers. Open in Maps hands the location to the Maps app. This is governed by Apple's privacy policy, and nothing reaches us.
Sharing. If you use Share, the photo goes only where you choose to send it.

Purchases3

Lumen Pro is a one-time purchase processed entirely by Apple through the App Store. We never see your name, Apple Account or payment details, and Apple's privacy policy governs that transaction.
Lumen checks your purchase with the App Store on your Mac to unlock Pro. There is no Papermint account and no server of ours involved.
The 7-day free trial is a free App Store purchase. Apple records when you started it on your Apple Account, which is how the trial keeps its end date if you reinstall Lumen or use another Mac. We never see it.

Children1

Lumen collects no data from anyone, including children.

Changes to this policy1

If Lumen ever handles data differently, we will update this page and its effective date before that version of the app is released.

Contact1

Questions? Email hello@papermint.studio.

Still need a hand?

A person reads every message, usually within a day.

hello@papermint.studio