Can I trust Lumo by Proton?

Trust checks

• Secure by Design

  ● Strong

  Strong security foundation

  Why this result

  This check looks for security issues at high severity or above in the code of this build, and none were recorded. Its scope covers stored credentials, how the app protects data on the device, and how it protects data in transit.

  Authentication tokens are protected with hardware-backed device encryption, making them unreadable even on a stolen phone. All network traffic uses encrypted connections and plain-text communication is blocked app-wide. No hardcoded passwords or sensitive credentials were found. No SSL bypass patterns or certificate validation weaknesses were identified. Two medium-severity issues exist — one in the payment interface's origin-checking logic and one about crash-report screen recordings — but neither is easily exploited without first compromising Proton's own servers, and no critical or high-severity vulnerabilities were found.

• Data Minimization

  – Items recorded, result pending review

  Tracking lacks clear disclosure

  Why this result

  This build contains analytics or attribution code written to send data to companies other than the developer. No consent step was found before that code runs, and the app's disclosures do not describe the collection in full. Tracking by itself is ordinary; what this check reports is the combination of collection, recipient and absent disclosure.

• Manifest Mismatch

  – Items recorded, result pending review

  Disclosure incomplete or contradicted

  Why this result

  The check compares the app's privacy disclosures against what the code does, and at least one claim did not match in this build. Mismatches of this kind include a data category collected but not disclosed, a recipient the disclosure omits, and an identifier attached to data the disclosure describes as anonymous.

• User Control

  ● Strong

  No lock-in

  Why this result

  The check looks for a way to export the data an account has accumulated and a way to delete the account itself. In this build, either both were found, or the app has no account of its own and keeps its data on the device. For an app without an account, the developer has no server-side copy to export or delete, and deleting the app removes the data in its own storage.

  No proprietary data formats or artificial barriers to switching services were found. Account management is handled through Proton's standard account infrastructure. No code patterns that would trap user data or prevent users from leaving were identified.

• Truly Local

  ● Strong

  Stays on the device

  Why this result

  This app presents itself as working offline or on the device alone. The check looks for any code written to send personal data to a server, including analytics, crash reporting and advertising code. None was recorded in this build.

  Voice input is processed entirely on-device using an offline speech recognition engine, and the build contains no code to send audio to any server. Authentication tokens are stored with hardware-backed on-device encryption. The app includes code to send AI conversations and requests to Proton's own servers, not to advertising networks or data brokers. Crash reports, when enabled, route only to Proton's own infrastructure. No sensitive user data flows to external parties outside of Proton.

What the app contains

• 14 services

  Third-party services the scan names in the build:

  • Sentry Android 8.37.1
  • Sentry NDK 8.37.1
  • Sentry Android Replay 8.37.1
  • PairIP
  • Vosk
  • Google Play Billing 8.0.0
  • Google Play Core
  • Google GMS (Play Services)
  • Google Datatransport
  • OkHttp 3
  • Coil
  • ZXing (journeyapps)
  • JNA (Java Native Access)
  • Firebase Encoders 17.0.0

Method and limits

Static analysis: the decompiled code, manifest and resources of this build, read file by file. Network traffic at run time is established by a capture of the running app.

Files decompiled

8,959

Scan date

13 June 2026

Corrections

No correction is published for this app.