Legalume Privacy Policy

Last updated: August 24, 2026 · Applies to the Android release where live AI analysis is disabled

1. Product and account scope

Legalume is an Android document, OCR, secure local workspace, and business recovery organization tool. It is software, not a law firm, and does not provide legal advice or guarantee payment, recovery, or any legal or business outcome.

Legalume does not currently provide a developer-operated user account, sign-in, or cloud document account. It creates a random app-installation identifier only to protect Google Play premium verification; that identifier is not a user account.

2. Local data

The app can process the following data on the device:

• imported or scanned files and camera images;
• OCR/extracted text;
• Vault/workspace organization;
• Business Recovery cases, counterparty and business-profile details, amounts, payment records, dates, notes, timelines, contact details, and message drafts;
• local preferences, reminder records, app-lock settings, and AI-consent metadata;
• a user-previewed diagnostic report.

These items are stored in app-private paths and protected by the application's local storage/security design. Documents and extraction cache use the app-managed encrypted durable-storage path. Android backup and device-transfer extraction are disabled for app-private data.

Camera scanning and OCR are performed on-device. Live AI analysis is disabled and fail-closed in this release, so Legalume does not send an AI document scope or question off device. Any future AI-enabled release requires a new consent, provider, retention, Data Safety and policy review before activation.

The app has no advertising SDK, first-party remote behavioral-analytics SDK, or automatic crash-report upload. Bundled Google SDKs have separate operational telemetry paths. Google ML Kit components may independently collect device/app information, performance or API metrics, error events, and per-installation identifiers for diagnostics and usage analytics as described in Google's ML Kit disclosure. The Google Play Billing library can send library-operation events, billing response/subresponse codes, and error/debug metadata to Google for operational diagnostics. These SDK flows are not first-party Legalume behavioral analytics.

3. User-controlled export and sharing

Copy, export, diagnostic-report share, and document share begin only after a user action. The selected Android application or destination then handles the copy under its own terms and privacy practices. Legalume does not automatically send recovery messages to counterparties.

The user can also create a password-protected .lgbak archive. Its content is authenticated-encrypted with a password-derived Argon2id key and chunked AES-256-GCM before the user selects an external destination. Restore uses the user-selected Android content stream and an app-private temporary copy. Copies exported outside app-private storage remain under the user's control.

4. Google Play purchase verification

When a user starts, restores, or resynchronizes a premium Google Play purchase, the app sends limited data over HTTPS to the configured Legalume entitlement service:

• Google Play purchase token;
• package name, product ID, and purchase type;
• a random app-installation ID;
• request timestamp, nonce, short-lived session ID, and HMAC authentication metadata.

The service uses Google Play/Android Publisher to validate the purchase and receives or derives purchase status such as expiry, auto-renewal, acknowledgement, void/refund state, and an entitlement decision. The service uses the connection IP transiently to derive a keyed rate-limit identifier; the application service does not intentionally log or retain the raw IP.

The purposes are premium app functionality, replay/rate-limit protection, fraud prevention, security, and purchase compliance. No document, OCR, case, message, biometric template, contact list, location, advertising identifier, or AI document payload is included in the purchase-verification request.

Release entitlement endpoints must use HTTPS and cleartext traffic is disabled. If verification is unavailable, premium stays locked.

5. Retention

The current purchase-verification code constrains configured time-to-live values to these defaults and maxima:

Request nonces expire with their session. Expiry makes state eligible for physical deletion; the code runs retention purge opportunistically during normal service requests or through an authenticated administrative retention operation, rather than claiming deletion at the exact expiry instant. The deletion tombstone contains only a keyed installation hash, a globally unique generation, deleting/deleted state, and its expiry; it exists solely to reject late writes and finish deletion safely after an in-flight operation or process crash. The entitlement service uses protected transactional storage for the limited server state described above.

These are code-level configuration bounds, not proof of the live service's exact deletion time. The production deployment settings, host/proxy logs, database backups, and operation of the purge path must be independently verified before release; this candidate does not assert an unverified live retention duration.

Local data remains until the user deletes it, uses the in-app deletion action, clears Android app data, or uninstalls, subject to copies the user exported.

Live AI analysis is disabled in this release. No AI provider receives document text or questions through Legalume while that release control remains off.

6. Deletion and subscriptions

Settings → Delete local data first blocks ongoing app writes, then removes local Vault/temp files, recovery data, local reminder records, the complete Legalume secure-storage namespace, and local entitlement installation/session credentials. Before erasing those local credentials, it attempts authenticated deletion of installation-linked server state with a bounded retry and attempts cancellation of scheduled Android notifications. User-exported backup archives outside app-private storage are not deleted by the app.

When the entitlement service is configured and active, an authenticated deletion with no active operation immediately removes that installation's sessions/nonces, install/session rate-limit buckets, and installation-linked minimal audit events. If an operation is already active, the service first blocks the old installation generation and returns a pending result. That state is finalized when the operation completes or renews, on another authenticated deletion, or by the next normal-request/administrative retention purge after the renewable operation lease expires. The minimal deletion-fence tombstone then remains subject to the TTL and purge boundary above. Purchase-token reconciliation, Real-time Developer Notification deduplication, and token-level fraud/decision state are also subject to the TTL and purge boundary above. The app has no account to delete.

If the app cannot confirm remote installation cleanup or scheduled-notification cancellation, it still erases the former local installation/session credentials and reports the relevant cleanup as unconfirmed. It does not claim that running local deletion again can target the former installation. Any remaining service state is governed by the code-level TTL and purge limits above, while the live production retention path remains a mandatory release-verification gate.

Deleting Legalume data does not cancel a Google Play subscription. Subscription cancellation is managed separately in Google Play; cancellation does not delete local Legalume data.

7. Other parties and infrastructure

• Google Play Billing: purchase and subscription operations, plus the library-operation, billing response/subresponse, and error/debug telemetry path described above.
• Google Android Publisher: backend purchase, subscription, refund/void, and entitlement verification.
• Entitlement-service infrastructure: protected network delivery, execution and bounded storage for purchase verification under the developer's instructions.
• Google ML Kit / Google Play services: scanner/model delivery plus the SDK diagnostics and usage data described in Google's published disclosure.
• User-selected Android recipients: only when the user deliberately exports or shares content.

No data sale or advertising use is implemented.

8. Security boundary

Legalume uses app-private storage, app-managed encryption for protected local data paths, HTTPS-only entitlement transport, signed requests, replay protection, bounded retention, and fail-closed premium decisions. Optional biometric authentication is performed by Android; Legalume does not receive or store biometric templates. No system can guarantee absolute security.

9. Children

Legalume is a professional document and business-workflow tool intended for adults and is not designed for children.

10. Your choices and privacy requests

You can deny camera/notification permissions, disable app lock or screenshot protection, choose whether to export/share, and delete local data in Settings. Subject to applicable law, privacy questions or requests may be sent to dasguardcore.notify@gmail.com. Because Legalume has no account and most content remains only on your device, the developer may not possess or be able to identify that local content.

11. Developer, updates and contact

Legalume is operated by the developer identified on its Google Play listing. Product and privacy contact: dasguardcore.notify@gmail.com.

This policy may change when product behavior, providers, law or Play requirements change. The date above identifies the current revision. A material change must be reflected in the app, Play Data Safety answers and public page together.