Security and privacy
No analytics.
Your photos stay yours.
What Lumenkeep does, what it refuses to do, and exactly what leaves your device.
What Lumenkeep never does
- Collect usage data, crash reports, photos, file names or anything about your libraries. There is no analytics or advertising code.
- Ask you to create an account, or send anything to a server I run. There isn’t one.
- Keep a master key, a reset password or a reviewer-only way in.
- Ask for access to your whole photo library to import. The system picker gives Lumenkeep only what you choose.
- Pretend to be a different app.
What leaves your device, and when
| What | Where to | When |
|---|---|---|
| Encrypted backup snapshots (already encrypted on your device) | Your own iCloud Drive, in Lumenkeep’s app folder | Only if you turn on iCloud backup (Lumenkeep Plus) |
| An encrypted library transfer | Your other device, on your local network | Only while you run Lumenkeep Transfer on both devices |
| Purchase and restore | Apple | When you buy or restore Lumenkeep Plus |
Security model
- Content: AES-256-GCM with a separate key for every item; videos in authenticated chunks, so a damaged or altered chunk is rejected.
- Passphrase: Argon2id, memory-hard, with parameters tuned so each guess is slow on any hardware.
- Face ID and Touch ID: a Secure Enclave key on this device wraps the library key, with access tied to the current biometric enrolment.
- Key file: a fixed set of equal-size slots, so its size does not reveal how many libraries exist.
- Storage: iOS Data Protection on top, and files excluded from unencrypted device backups.
- Backups: encrypted before upload; Apple stores data it cannot read. Restoring needs your passphrase or recovery key.
Limits
No app can protect photos on a device that is already compromised, or from someone who can force you to unlock it. The alternate library helps against a casual look, not a forensic examination. The encryption design has not had an independent security review. It is built from standard, well-studied pieces: AES-256-GCM from Apple’s CryptoKit, and Argon2id from libsodium for the passphrase. The design is described in full on this page.
Report a vulnerability
Please email security@lumenkeep.eu. I reply within three working days. Please give me 90 days before publishing. See also security.txt.
This website has no cookies, no analytics, no JavaScript and no third-party requests, and sends a strict Content Security Policy.