Turn messy files into meaningful names.

Highlights in 1.2.3

• Ollama Cloud, a fifth cloud provider. Bring your own Ollama key and Lumen names documents and photos with Gemma 4 (31B) hosted on Ollama’s cloud service — not on your Mac. A free Ollama account is enough for a key; usage counts against your plan’s limits rather than a per-token bill, so Lumen shows token counts for it but no cost estimate. Ollama states that prompts and responses are processed transiently and never used for training. As with every cloud provider, you are shown exactly what is sent and asked before the first document goes.
• Providers listed by cost. Every provider menu and Settings list now runs from lowest to highest typical cost for an ordinary text document — Local AI (free), Ollama Cloud, OpenAI, xAI, Gemini, Claude — at August 2026 list prices; the User Guide says so and why the order can differ for you.
• Step-by-step provider setup in Help. The User Guide and this site’s help page now walk through getting a key from each of the five providers: the exact page, what to click, whether you need to add credit first, the traps a first-time user hits, and what each provider says about training on your data — stamped “as of August 2026”.
• Cleaner Name Review. A “name” containing a digit — phone numbers, IDs, product codes — never reaches Name Review any more, whichever provider produced it.

Privacy policy

Effective date 17 August 2026. Ollama Inc. (Ollama Cloud) is added to the providers section; each provider entry now also links the document that governs data sent through its API (their consumer privacy policies exclude API traffic); two provider legal names were corrected to what their current policies state (OpenAI OpCo, LLC; X.AI LLC). What Lumen sends, and when it asks, is unchanged.

Under the bonnet

• Price defaults refreshed to today’s list prices (Claude Sonnet 5 $2/$10 — its launch price is now permanent; gpt-5.6-luna $0.20/$1.20). Your own overrides in Settings are untouched.
• Provider dispatch is compiler-checked: a provider without an analyser can no longer fall through to Claude.

Highlights in 1.2.2

• Clearer duplicate selections. When files in different folders share a basename, Lumen now includes the parent folder in their spoken selection labels across Drop Zone, Results, Unprocessed, Batch Rename and Revert Renames.
• Organisation mappings in filenames. Saved name mappings now also canonicalise extracted organisation names when Lumen composes filenames.
• Website link in About. Open the Lumen website directly from the About panel.

Highlights in 1.2.1

• Built-in update checks. Automatic checks are on by default and run after launch when a daily check is due. Turn them off under Settings → Advanced → Software Updates, or use Lumen → Check for Updates… at any time. Available updates download from GitHub Releases; downloading and installation remain your choice.

Large-PDF privacy

For an accepted PDF larger than about 30 MB, Lumen now reads text locally from a temporary copy of up to its first five pages, whichever of the five providers you use. The whole large PDF is not uploaded. Only when the first result is weak may Claude or OpenAI also receive that temporary excerpt inline, and only where it fits the request limit.

New in 1.2

• Names database backup and restore. Settings → Advanced → Names Backup exports your name mappings, ignored names, and naming schema to a single file, and imports one back — validated end-to-end before anything changes, with a safety copy taken first. Merge with existing names or replace all.
• Send files between tabs. Results can send ticked, resolved files to Batch Rename with suggested or original names; Unprocessed can send ticked files, or all visible files when none are ticked. Sent rows can be returned to their source tab until they are renamed or a new processing run starts.
• Session recovery. If Lumen quits before you rename — after a crash, restart or ordinary quit — the next launch can offer to restore completed results and review state: saved proposals, approvals, hand edits, photo numbering and the Name Review queue; rows previously sent to Batch Rename return to their source tabs.
• Crash-safe undo. Reverting renames now keeps a per-file recovery record as it works. If the app is interrupted mid-revert, Lumen tries to apply the recorded recovery information on the next visit to Revert Renames — and when an external log is reopened — then reports anything that still needs attention.
• Multi-select across the working lists. Highlight several rows with ⌘-click, ⇧-click, or ⌘A in Drop Zone, Results, Unprocessed, and Batch Rename — and Y/N ticks or unticks them all at once.

Clearer and more honest

• Privacy disclosures corrected. Every statement about what leaves your Mac was re-audited against the code and corrected — including that the original filename, your known-name mappings, and a photo's capture date accompany cloud requests, and removing claims about content that is never sent. Because the wording changed, existing users are shown the corrected disclosure once per provider before the next cloud use. The privacy policy and this website were updated to match.
• Truthful messages throughout. Failed saves in Name Mappings now say exactly which file failed and keep your typed values on screen; the Progress tab's counters stay honest when files are sent away or trashed mid-run; cloud truncation errors are reported clearly instead of as a generic failure; the in-app User Guide was expanded and corrected to match the app's real behaviour.

Fixed

• Keyboard and context-menu actions no longer act on an arbitrary row when several are highlighted (including one destructive case: Move to Trash).
• The Batch Rename working set survives switching tabs.
• A fast double-click on "Try with…" could analyse the same file twice and land a duplicate row.
• Renamed files can be re-checked and renamed again without a restart.
• A FIFO, symbolic link, or other special file can no longer hang the app.
• Switching providers can no longer wipe a stored API key.
• Reverting: importing a log no longer mistakes an I/O error for a corrupt file, and case-only renames revert correctly.
• Name Review's retry can no longer erode the names-database safety copy; cross-set name edits no longer leave case-variant residue.
• Settings name counts refresh immediately after Name Mappings edits.
• CSV exports neutralise spreadsheet formula injection.
• The completion message no longer tells you to note a rename manually when that rename was in fact saved to the undo log.
• Photo-naming settings and Help now list the real set of name fields — the optional Label was missing from the descriptions.
• Each queued image now carries the exact photo permission and location setting it was created with — what the consent dialog described is exactly what can be sent. Changing either setting mid-run affects your next run or re-check, never work already queued, and after a crash recovery Lumen follows your current setting instead of an old saved one.
• Closing the window and reopening from the Dock now returns you to the same session instead of an empty window with your run still going invisibly.
• Restoring a saved session now reconciles eligible document proposals with name mappings added in the meantime, while preserving hand-edited filenames.
• Filenames can no longer keep invisible line separators that some documents carry, including in the file extension.
• The share-safe log export no longer keeps the original file extension, and a deliberately odd file or folder name can no longer expose text the export is meant to hide.

Under the bonnet

• The names database is now served by one shared, gate-checked file module (identical behaviour, mechanically enforced).
• Revert-status writes are journalled with the same crash-safety as rename logs; every journal has a terminal disposition — nothing can nag forever.
• Undo logs are now flushed to disk before their temporary recovery records are removed, and recovery refuses a corrupt undo record outright instead of silently dropping it — your rename history survives a power cut or a damaged file rather than being quietly thinned.
• Debug logs rotate at 50 MB; photo-caption requests are now logged like every other analyser call; share-safe export hardened further.

Upload safety (Claude)

When a large PDF has to be uploaded to Claude for analysis, Lumen now records that it is about to send it — before any bytes leave your Mac. If the app is interrupted at exactly the wrong moment, so that the upload may have arrived but Lumen never learned its file identifier, the next launch shows a plain notice explaining that a copy may exist at the provider and that Lumen cannot delete it automatically. The notice is informational and dismissable; nothing about your local files changes.

Privacy policy

The policy now describes the session-recovery snapshot introduced by crash recovery: what it holds, when it is replaced or removed, that a snapshot the app cannot read (or that a different app version wrote) may remain in the app's container, and that snapshots are never transmitted or included in the share-safe log export. Settings now names Apple's geocoding service consistently with the rest of the app.

Name-database safety

Names now go through one safety check wherever they enter Lumen — imports, the Name Mappings tab, and Name Review. Line breaks, control characters, text-direction overrides and byte-order marks are refused, because a name carrying them could smuggle instructions into the request Lumen sends the AI with every document. Names in Indic, Persian, Arabic and other scripts are unaffected: the joiners and direction marks those languages need are explicitly allowed, as are tabs and ordinary punctuation. If a name already stored on your Mac contains one of the refused characters, the affected rows are flagged in Name Mappings with a Select Affected Rows button so you can find and remove them, and until then the names Lumen sends are escaped so they cannot read as instructions. A detected name that cannot be added safely no longer blocks the rest of your review — it holds its own file back from Execute and tells you to edit that filename or untick the file.

Undo reliability

The temporary record Lumen keeps while renaming is now transactional: if writing an entry fails and the rename is put back, the partial bytes are removed, so a rename that was undone can never reappear in Revert Renames and point at the wrong file. If that repair itself fails, Lumen keeps every earlier rename's evidence rather than discarding the whole batch, and says so plainly instead of promising a recovery it cannot make. Recovery folders that cannot be used are listed with a Show in Finder button and honest guidance on whether refreshing will help.