Privacy

Lucid · last updated 14 October 2026

This page is written from Lucid's own source code and is accurate about what the software does. It has not been reviewed by a lawyer, and one blank — who legally answers for this data — is a decision nobody has made yet and is marked in yellow below. Until that is filled in and the list at the foot of this page is answered, read this as a plain description of the software rather than as a finished legal notice: before this page is published.

Lucid holds a great deal about the person using it — mail, calendars, contacts, text messages, health figures, bank balances, a journal, a vault. This page describes what it actually does with all of that: not what a privacy policy usually says, but what this codebase does, rewritten whenever the two stop matching.

The short version, because the rest is long and these are the sentences people are looking for. Your data is not sold, not shared for anybody else's purposes, and not used to train any model — see nothing here trains anything. It leaves Lucid's own server in four named circumstances and no others, all of them under what actually leaves. You can take a copy of it, or destroy all of it, from your data page, without asking anybody — and the copy tells you what it could not carry rather than letting you find out later. A copy of your recent mail also sits on the device you are reading this on, and signing out deletes it. Nothing in Lucid is ever deleted because of money.

Who is responsible for it

Lucid is operated by [DATA CONTROLLER — TO BE NAMED, with a registered postal address], which is the party responsible for the data described here.

You can write to support@lucid.invalid — placeholder, a real support address has not been chosen yet about anything on this page, including a request to see, correct, export or delete what is held about you. You do not have to write to anybody to export or delete: both are buttons on your data page.

Whose data this is

Mostly yours. Lucid connects to mail, calendar, task, messaging, music and banking accounts that you sign in to or pair yourself, and it reads them on your behalf. Three things about the people you deal with, rather than about you, are also held, and each is described plainly further down rather than folded into "yours": when someone you email opens a message you sent (under mail you send is watched for opens), what Lucid has worked out about how they correspond with you (under things Lucid worked out), and the free, self-published lookups Lucid does about a contact when you press the button (under what actually leaves). Nothing else is gathered about anyone who has not connected an account.

What is stored, and where

Lucid keeps its own copy of some of what it reads, so that the app is fast and so that years of it can be searched. That copy lives in a private database (Supabase) which only Lucid's own server functions can reach, and every row in it is tagged with the account that owns it. There are two other places your things sit, and both get a section of their own below because neither is obvious from the outside: five buckets of files beside the database, and a copy of your recent mail on the device you are reading this on.

Mail. The messages themselves — sender, recipients, subject, date and body — from the mailboxes you connect at Microsoft and Google, plus what you do with them in Lucid: what you saved, what you scheduled to send, which senders you have unsubscribed from or silenced.
A search index over that mail. The same messages cut into passages, each with a long list of numbers beside it standing for its meaning, so that "what did the roofer say about the skylight" can find a message that never used those words. Building it sends the text of those passages to OpenAI — described in full under the search index, because it is the one place where the body of your mail leaves Lucid.
Calendar and tasks. Events from every calendar you connect — Microsoft, Google and Apple iCloud — task lists from Microsoft To Do and Google Tasks, and Lucid's own projects, sections, boards and subtasks.
Contacts. People — from Microsoft, Google and Apple iCloud, and the ones you enter yourself — and the companies they work for, their addresses, phone numbers and photographs, your own notes about them, how you know them, and the gifts and promises you have recorded against them.
Text messages — iMessage and SMS — if you set up the companion program on your Mac to bring them in. Nothing about your phone's messages reaches Lucid unless you run that program yourself.
Health and body data your phone is willing to send once you pair it — steps, sleep, resting heart rate, weight, workouts, the sets and repetitions you logged — and any medicines you choose to record. This one is a key your phone holds and uses to write to Lucid directly, not an account Lucid signs into, and it stops the moment you forget that key in Settings.
Money. If you connect a bank through SimpleFIN, Lucid holds the accounts it finds — the institution, the account name, the currency and the balance — and their transactions: date, amount, payee, description and memo. It also holds the credential that reads them, sealed. See your bank, specifically.
Your own life, written down. Journal entries, the timeline, life events, decisions, goals and the habits you track; recipes, the pantry, the meal plan and the shopping list; trips and their segments; what you want to watch, read and listen to; the places you want to go; the subscriptions and renewal dates you keep, and the documents in your vault.
What you asked the assistant, and what it answered — kept as your conversations, with a note of what each question cost.
Things Lucid worked out rather than things you typed. It keeps a list of what it has noticed about you — a preference, a habit — with the sentence that suggested each one, every earlier version of it, and what each nightly pass changed. It keeps a similar and much smaller list about the people you deal with most: roughly how quickly you and they answer each other, and how you tend to write to them. Both are shown to you in the app, both are in your export, and both are deleted with everything else.
Whether, when, and how many times someone opens a message you sent through Lucid, and a rough guess at the device they read it on — see below.
The audio of anything Lucid has read aloud to you, kept as sound files so the same sentence is not bought from a speech provider twice. It is scoped to you rather than shared with other accounts — deliberately, because "has anyone here ever heard this exact sentence" is a worse question for a life vault than the pennies it saves.
Access tokens for the accounts you connect, so Lucid can keep reading them; the sealed bank credential; the fingerprints — never the keys themselves — of the phones and wall screens you have paired; and the links you have chosen to share.
A record of what went wrong. When something in Lucid fails, it writes down which part failed, the message the failure produced, which account it happened to and when — so that a fault can be found and fixed instead of waiting for somebody to report it. It holds no message bodies, no prompts and no answers, and it is cleared after thirty days.
What your plan is and what has happened to it — which plan, whether it is in trial, paid, late or locked, and the events that moved it between those. No card details of any kind: see money.

The five buckets of files, and the one that is public

Anything that is a file rather than a row lives in file storage beside the database, in five buckets, every object filed under your account:

Vault documents — whatever you put in the vault. This is the passport scan, the birth certificate, the insurance policy and the warranty paperwork. Private.
Frame photographs — the pictures a wall screen shows. Private.
Board pictures — anything pinned to a board. Private; the link your browser is given for one is signed for that request and expires.
Spoken audio — the sound files of anything Lucid has read aloud to you. Private, and never handed out as a link at all: Lucid's own server fetches the file and plays it to you.
Your email signature image — and this bucket is public. That is a deliberate decision rather than an oversight, and it is the one thing on this page worth reading twice. A signature image is fetched by the mail client of the person you wrote to: their copy of Outlook or Gmail has no Lucid session, so it cannot be handed a signed link, and a private bucket would mean a broken image in every message you have ever sent. So the address of your signature image needs no sign-in: anybody who has that address — anybody you have mailed, and anybody they forward it to — can open it for as long as the file exists. Nothing else of yours is in that bucket and nothing else in Lucid works this way.

What a backup would and would not bring back

Most products do not tell you this and it matters more than most of what they do tell you. Lucid's database is backed up by Supabase. Those backups do not contain the files above. Supabase says so plainly — "database backups do not include objects you store via the Storage API, as the database only includes metadata about these objects" — and point-in-time recovery is the same machinery and covers the same database.

So if storage were lost, a restore would bring back the row that says a document called "Passport.pdf" exists, and not the document. The live bucket is the only copy. That is the reason the terms of service ask you to keep your own copies of anything you cannot afford to lose, and it is why it says so rather than gesturing at "reasonable measures".

The copy on the device you are using

Lucid keeps a slice of your mail in the browser itself, so that typing in the mail search box answers instantly instead of waiting for a round trip to the server. It is a real copy of real mail and it is on your own disk, so here is exactly what is in it:

Up to four thousand of your most recent messages — roughly a season of a busy mailbox, about four megabytes.
For each one: who it is from and their address, the recipient address, the subject, the first four hundred characters of the body, the date, whether it is unread or flagged, and whether it has attachments. Not the rest of the body, not the attachments themselves.
It is tagged with the account it belongs to, and mail written under one sign-in is never shown to another.

Signing out deletes it. Not clears the reference to it — deletes the database off the disk, and the same thing happens if your session expires or is refused. A copy of somebody's correspondence surviving their sign-out would be a security fault rather than a performance feature, so the deletion sits beside every other thing that is dropped when a session ends. If your browser will not give Lucid a store at all — a private window, a refusal, a full disk — nothing is written and search simply works the way it did before, from the server.

The rest of what the app has drawn recently is also held in that browser for a few minutes so screens do not flicker. It is tied to the signed-in account and is dropped at sign-out with everything else.

How long it is kept

Most of it is kept until you delete it, because most of it is the point: a life vault that quietly forgot last year would not be one. What does have a clock on it:

The mail copy: about two years. Lucid's own copy of your mail is pruned back to the most recent twenty-four months. Your actual mailbox at Microsoft or Google is untouched — that is the real copy and always was.
Mail you binned: about a month. Something you delete in your mailbox stays in Lucid's copy for a grace period of thirty days before it goes, so a clear-out you regret is recoverable.
Fault records: thirty days. See above.
Everything you made: until you remove it — journal, vault, projects, contacts, notes, recipes, trips, the timeline. Deleting an item in Lucid deletes it.
Spoken audio: about three months. The sound files above are dropped ninety days after they were made.
A saved answer to a question you already asked: a fortnight. Kept so the same question does not cost twice; it expires by itself. What you asked and what Lucid said is kept as part of your conversations, above, until you remove it.
Access tokens: until you disconnect the account, which removes them immediately.
The copy on your device: until you sign out, and it is a rolling window of four thousand messages, so anything older than that has already fallen out of it. See above.
All of it: gone within minutes if you ask. See your rights over it.

Nothing here is deleted because of money. Not on cancellation, not after a failed payment, not on a timer, not ever. Being locked out is not the same as being erased, and erasure belongs to you rather than to a billing system: the code that decides billing states has no delete verb in it at all, and a test fails the build the day it grows one.

Nothing here trains anything

Your data is not used to train any machine-learning model. There is no model in this project, nothing here is used to build one, and nothing is sold, rented, brokered or handed to anybody as a business relationship. No advertising, ever. There is no analytics service anywhere in Lucid — no Google Analytics, no tag manager, no Mixpanel, no session recorder, on this page or in the app — so nobody is counting what you clicked.

Where Lucid sends text to an AI provider, described below, it does so through those providers' APIs, whose terms say data sent that way is not used to train their models. That is their commitment rather than Lucid's, and which one applies depends on which provider this installation uses; if it is pointed at a model running on the owner's own Mac, the question does not arise, because nothing leaves the building.

What actually leaves Lucid's server

Four things go out carrying something of yours. They are listed together here, before the longer sections, because this is usually the list a person is looking for and usually the hardest one to find:

An AI provider gets your question and what Lucid reads to answer it. Plainly: when you ask the assistant something, the text of your question and the material it uses — which can include your mail, your calendar, your contacts, your notes and your journal, according to what you have allowed — are sent to a model provider, once you have said yes to AI features. It also happens without you asking for the daily brief and the day's picture, and nightly for memory if you turned it on. See the assistant, and which company sees the question, which is more than one.
OpenAI gets passages of your mail, to build the search index — only if that index is switched on. See the search index.
Voyage AI gets passages of your mail and texts, to put the best ones first — when Ask Lucid looks something up, and only if this installation has a key for it and you have said yes to AI features. Without both, nothing is sent to Voyage AI.
A web search backend gets the search phrase, when the assistant is asked something it has to look up. Only the phrase travels — never a message body, never a document from your vault — to whichever backend is configured, most of which advertise zero retention on the query itself.
Free, self-published lookups, only when you press "look" on a contact. Enriching a contact can fetch that person's Gravatar profile (a page they made and attached to their own email address on purpose) and the single front page of their own website or their employer's, if one is on file. Nothing is bought from a data broker — Clearbit, Apollo, PeopleDataLabs and similar services were considered and deliberately left out, because they hold a copy of your contact list on their own servers in exchange for answers whose origin you cannot see. Lucid only ever reads a page the person or the company already published about themselves.

Beside those four there are the companies Lucid runs on, which hold the data rather than receive it, and the services Lucid asks about the world rather than about you. Both are named in full below.

The companies Lucid runs on

These hold or handle your data in order for Lucid to work at all. The list is read off the code rather than off a template, and it is meant to be kept current.

Supabase — the database and the file storage. Everything Lucid keeps is here.
Netlify — the hosting, and the server functions that do all of the work. Everything Lucid does passes through here.
Anthropic — the AI model behind summaries, the daily brief, memory and the assistant's own answers; or a model running on the owner's own Mac, if this installation is pointed at one. Details under which company sees the question.
Voyage AI, for one job that is not the assistant: re-ordering the passages Ask Lucid found so the model reads fewer, better ones. It is never called without your yes to AI features.
OpenAI, for two jobs that are not the assistant: the search index over your mail, and reading a sentence aloud when you ask Lucid to speak. If this installation has not been given a key for it, the index is never built and your own device speaks instead.
A web search backend, when the assistant looks something up. It receives the search phrase and nothing else. Which one depends on how this installation is configured; the ones it can be pointed at are Parallel, Tavily, Exa, Linkup and Brave.
SimpleFIN, if you connect a bank. It stands between Lucid and your bank, and Lucid asks it for balances and transactions. See below.
Apple, if you connect iCloud. Apple already holds the calendar and contacts Lucid is asking for; what is new is that Lucid keeps a copy of them and keeps the password that reads them, sealed. See Apple iCloud, specifically.
GitHub, for one job that is not about you at all: checking that Lucid's own code backup is current. It is sent the name of Lucid's repository. Nothing of yours goes with it.
Whichever push service your browser belongs to — Apple, Google or Mozilla — if you turn notifications on. It carries the notification to your device. The contents are encrypted to your browser before they are handed over, so the carrier cannot read them; what it does see is that Lucid sent something to that device, and when.
Google Fonts, for the typeface this page and the rest of Lucid are set in. Google's font servers see that a browser asked for a font file, and the address it asked from. It is the only thing on this page that comes off the network.

The one payment processor Lucid is built to use is Stripe. It is wired in test mode only, so nobody can be charged today. When you start a checkout or open the billing portal, Lucid asks Stripe to create that session for your account, and Stripe is the thing that holds a card number — no card details are held in Lucid, and no live payments are taken until that is switched on on purpose.

Two things Lucid deliberately does not use, worth saying because most products in this shape do. There is no third-party sending service anywhere in it — no Mailchimp, no SendGrid, no Resend — because mail Lucid sends goes out through your own mailbox at Microsoft or Google using the permission you granted, so nobody else ever handles the text of a message you write. And there is no data broker: see the note on contact lookups above.

The services that are asked about the world

These are not in the list above, because they receive a question and never your data. What they do see is that somebody asked, from Lucid's server rather than from your browser — so the question reaches them without your address, your name or any identifier of yours attached. They are named because "some third-party APIs" is the sentence a privacy policy uses when it does not want to be checked:

TMDB and Movie of the Night's Streaming Availability API — what a film or programme is, and where it is streaming where you live. They are sent a title.
ESPN, MLB and the NHL — fixtures, scores and team lists. They are sent a league or a team, never who is asking.
Open-Meteo — the weather. It is sent a place.
OpenStreetMap's Nominatim — turning a place name into a point on a map.
Stooq — a share or index price. It is sent a ticker, and it is never told what you hold.
Ticketmaster, the Apple iTunes catalogue, the Metropolitan Museum's open collection and the USDA's farmers-market directory — events, podcasts, pictures and markets, by search term or by rough location.
OpenTable, Resy and Tock — when Lucid offers to book a table it builds a search link to each of them for you to follow. Lucid's own server never calls them and sends them nothing. The restaurant, the date and the size of the party are in the address you click, and from the moment you click it you are on their site under their policy rather than this one.
Panels you embed yourself — a Facebook Page, or an Elfsight widget. These sit differently from everything else in this list and are worth reading twice. Lucid's server does not fetch them. The panel is placed into the screen and your own browser loads it straight from Facebook or from Elfsight, so that company sees the request come from you — your address, and the fact that you were on that screen — exactly as an embedded panel on any other site would. An Elfsight widget goes one step further than a framed panel: it is a script, so it runs alongside the rest of the page rather than inside a box of its own. Nothing is embedded unless you embed it, and deleting the source removes it.
The feeds you subscribe to yourself — a news site, a blog, a public Reddit or Bluesky or YouTube feed — and any web address you save to a board, which Lucid fetches once to read the page's own title and picture. Lucid fetches the address you gave it, from its own server. The site at that address learns that Lucid asked for it and nothing else about you.

None of these is sent anything from your mail, your calendar, your vault or your journal, and none of them is told who you are.

The assistant, and what the model sees

This is the paragraph most products bury in one vague sentence, so it is early here and it is blunt. When you ask Lucid something, the text of your question and the material Lucid reads in order to answer it are sent over the internet to a model provider. That material is your own data: it can include your mail, your calendar, your tasks, your contacts, your notes, your journal, your vault and your text messages. There is no way to answer a question about your life without showing a model some of your life, and a product implying otherwise is not being straight with you.

What you control is the source list. Exactly which of your own data the assistant may bring into an answer is switched on and off, per source, under Settings → Assistant → Access. Nothing you have switched off there is ever read into a prompt.

Nothing is sent to an AI provider until you say yes. The first time a feature would need one, Lucid shows you what would be sent and to whom, with OK and Not now. Not now keeps every AI feature off and the rest of Lucid works as normal. Your answer, and when you gave it, is recorded, and you can change it at any time under Settings → Your data → AI features. The server enforces that answer as well, including for the jobs that run while you are signed out, so the question on screen is a courtesy rather than the only lock.

Once you have said yes, text reaches an AI provider in these circumstances, and these are all of them:

whenever you ask the assistant something, together with whatever it looks up to answer you;
once a day, when it writes the daily brief — the paragraph at the top of Home — from your calendar, your tasks and the senders and subjects of the mail waiting on you; and when it chooses the day's picture and writes the week's story under it, from your calendar, the senders and subjects of your mail, your trips and your timeline;
when the "Needs you" list explains why an unread message needs you: the message's sender, subject and first lines;
when you ask for a summary of one contact, for a draft reply, or for a summary of a call you recorded (its transcript);
once a night, only if you have switched on memory ("learning overnight") in Settings. It reads only the sources switched on for it, and there are three: your conversations with the assistant (the only one on unless you change it); your sent mail, reduced to the words you wrote yourself, with the quoted thread and signatures removed; and your text messages, both what you sent and what was sent to you, with every line labelled with who said it, so that something a friend said about themselves is remembered as a fact about them and not about you. It writes short facts worth remembering, each one visible in Settings and each one deletable. It does not read your journal;
once, if you start the text-message import that does the same thing for your older texts, which states its cost before it starts and can be stopped;
when you ask Lucid to make French practice cards from your week (your open promises, and the titles, places and invitees of the coming week's meetings), or to write a recipe (what you asked for and the list of what is in your pantry);
to turn text into the numbers behind search by meaning, and to read a sentence aloud when you press the speaker — both described under the search index.

If you never say yes, none of these happens, and nothing from your mail, calendar, texts or notes reaches a model at all. One exception is stated here because it is true today: writing a recipe does not yet check your answer, so asking for one sends your pantry list even if you said Not now. The museum notes beside the art on Home are written by a model too, but from the museum's own records; nothing of yours is in them.

And a good many questions never reach a model at all. A question that is plainly a lookup against your own data — "what is on tomorrow", "who have I not replied to" — is answered by Lucid's own code, from your own database, with nothing sent anywhere. That is done to save you money and a wait; the privacy of it is a side effect, but it is a real one.

Which company sees the question

For the writing — summaries, the daily brief, memory and the assistant's answers — one company: Anthropic. Under its API terms it does not train its models on what Lucid sends. If this installation is pointed at a model running on the owner's own Mac, that model is tried first for background work, and nothing sent to it leaves the building.

Lucid does not send your mail to a free model hosted by anyone else. Free tiers are paid for with content, and Lucid's input is somebody's mail, so they are refused on their terms rather than on their price.

None of what is sent is used to train a model, none of it is sold, and every one of those is a commitment made by the provider rather than by Lucid. Which providers are actually configured for the installation you are using is a question you are entitled to ask, and the address below is where to ask it.

The search index over your mail

Lucid can search your mail by meaning rather than by keyword. To do that it cuts each mirrored message into passages and asks OpenAI's embedding service to turn each passage into a list of numbers; the numbers are stored beside the passage in Lucid's own database, and the searching happens there. Building the index therefore sends the text of your mail — passages of the real thing, not a summary — to OpenAI. Most of what goes to a model is what one question or one summary needs; this sends mail in bulk, and so does the overnight memory job if you switch your sent mail on for it. It is worth knowing before you press the button.

It runs by itself once you have said yes to AI features, and not before: new mail and new text messages are added every hour, and older ones are worked through a slice at a time, newest first, until the history is done or a spending ceiling stops it. Your text messages and the facts in memory are indexed the same way. If you said Not now, nothing is indexed and nothing is sent; an installation with no OpenAI key configured never builds it either. The same service is asked to embed your search phrase when you search, and to speak a sentence aloud when you press the speaker: the sentence itself is sent to OpenAI's speech service and the audio comes back. OpenAI's API terms say data sent through the API is not used to train their models.

Google user data, specifically

Lucid's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Lucid requests these permissions and uses them only for these purposes:

gmail.modify — to show your mail inside Lucid and search it; to mark it read, star, label, archive or move it to the bin when you do; to save drafts; to be told when new mail arrives; and to send a message when you press Send. It cannot permanently delete mail, and Lucid does not ask for the scope that could.
calendar.events — to show your events and create, change or delete one when you ask; calendar.calendarlist.readonly — to list which calendars you have. Lucid cannot create, delete or share a whole calendar.
tasks — to show your task lists, create a task when you ask, and tick one off in both places when you tick it in either.
contacts.readonly — asked for separately, only if you turn contact photographs on, and only to copy a face onto a contact card.
contacts.other.readonly — asked for separately, only if you turn on “people you have emailed”, and only to add the names and addresses Google has already collected from your own correspondence to your contacts in Lucid.
userinfo.email, openid — to know which account you just connected.

Google user data is never used to train any machine-learning model, is never sold, and is never transferred to anyone except as needed to provide the features above. Where mail from a Gmail account goes into the search index described above, that transfer is to the embedding provider for the single purpose of making your own mail searchable by you.

Microsoft user data, specifically

The same list for the other mailbox. Lucid asks Microsoft for Mail.Read, Mail.ReadWrite and Mail.Send to show, file and send your mail; Calendars.ReadWrite to show and edit your calendar; User.Read to know which account you connected; and offline_access so it can keep reading without asking you to sign in every hour. Two more are asked for separately and only if you say yes: Tasks.ReadWrite for Microsoft To Do, and Contacts.Read for contact photographs.

Apple iCloud, specifically

If you connect iCloud, Lucid reads your calendars and your contacts from Apple over CalDAV and CardDAV — caldav.icloud.com and contacts.icloud.com — and it does so read-only: there is no request anywhere in it that can create, change or delete anything in your iCloud account. It reads events from ninety days behind you to a year ahead. It skips your iCloud Reminders rather than folding them into Lucid's own tasks, and reports how many it skipped so that you can see it happened rather than wondering where they went.

It signs in with an app-specific password that you create at Apple and can revoke there at any moment without disturbing the rest of your account. Lucid stores that password sealed, never in the clear, and keeps three things beside it: which calendars and address books it found, the events and contact cards it read, and when it last looked. iCloud Mail is not read at all — Lucid's mail is a Microsoft and Google feature, and nothing in the iCloud connector opens a connection to it.

Instagram / Meta user data, specifically

If you connect Instagram, Lucid asks only for instagram_business_basic — enough to show your own recent posts back to you inside Feed. It never posts, comments or messages as you, and it never asks to. What is kept is a long-lived access token and your Instagram user id and username, so the connection can be renewed without asking you to sign in again every sixty days.

Meta requires every app built on its login to offer a way to have that data deleted on request. Disconnecting Instagram in Settings removes the token immediately. Meta can also trigger deletion directly — Lucid runs a Data Deletion Request Callback at /.netlify/functions/data-deletion-callback, verified by the signature Meta itself signs the request with, so nobody else can trigger it. It deletes the whole of the Lucid account the Instagram connection belongs to — not only what came from Instagram — using the exact same deletion described below, and hands back a confirmation code you can use to check that it happened.

Spotify

If you connect Spotify, Lucid reads what you are playing, what you played recently, your top artists and your playlists, and can control playback when you press a button inside Lucid. It keeps the access token and what it read. It never posts anything to your account and never changes your library.

Your bank, specifically

Lucid can show your balances and your recent transactions. It does this through SimpleFIN, a small read-only protocol: you subscribe to SimpleFIN's Bridge, connect your banks there, and hand Lucid a one-time setup token. Lucid exchanges that token once for a long-lived credential, and from then on only ever asks for account balances and transactions.

It is read-only. There is no arrangement of this protocol under which Lucid can move money. It cannot make a payment or a transfer, and it never asks for the ability to.
Lucid never sees your online banking password. Your bank credentials are given to SimpleFIN, not to Lucid.
The credential Lucid does hold is sealed with AES-256-GCM under a key that lives in the server's environment rather than in the database — so a stolen copy of the database alone does not contain a working key to your bank. Lucid refuses to connect a bank at all if that key is not configured, rather than quietly storing the credential in the clear.
What is kept is the accounts (institution, name, currency, balance) and the transactions (date, amount, payee, description, memo). It stays in your account and is never shared.
Disconnecting deletes the credential immediately and stops all reading. The balances and history Lucid already fetched are kept, because they are your own record — unless you ask for those to go too, which is one more press. Deleting everything removes all three regardless.

Nothing Lucid shows you about money is financial advice, and nothing it shows you about your body is medical advice. Both are your own records, arranged.

Lucid can make a link to one board, one trip, one goal or the kitchen, so that somebody else can see it without signing in. A link exists only because you made it, it expires on a date you choose, you can revoke it at any time, and while it is alive anybody holding it can see what it points at. The same is true of the key that lets a screen on a wall show your day, and of any app you have connected to Lucid. All of them are listed in Settings and all of them can be revoked there — and revoking works even on an account locked for non-payment, because somebody who cannot shut a door they opened is being punished rather than billed.

Mail you send is watched for opens

Lucid can embed a tiny tracking image in mail you send through it, so it can tell you when the message is opened — the same mechanism most "read receipt" features use. This means Lucid records, about the person you wrote to, whether and when they opened your message, how many times, and a rough guess at their device and mail client, read off the request the image made — the same kind of thing any tracking pixel in any piece of marketing mail already does, made visible to you rather than to a stranger. It is not disclosed to the recipient, because there is currently no accepted way to disclose a tracking pixel to the person it is measuring — this is stated here as a fact about how it works, not as a feature being defended. It is never shared anywhere outside your own Lucid account, and a message you send outside Lucid — directly from Outlook or Gmail, say — carries none of it.

This feature records the behaviour of somebody who never agreed to anything, and whether it should exist at all is a legal question that has not been answered. It is the item on this page most in need of a lawyer, and it is first on the list at the foot.

What protects it

Every row carries the account that owns it, and every read Lucid's server makes is scoped to the account asking — which is checked by a harness that reads every query in the codebase and fails the build when one is not, rather than by trust. Row-level security is switched on in the database as well; what it stops is anything other than Lucid's own server reading a table at all, since the server holds a key that passes it. So the owner check in the code is the thing that keeps two accounts apart, and it is honest to say which of the two is doing the work. The bank credential is sealed under a key held outside the database. The vault can be locked behind your device's own Face ID or fingerprint, and the credential that unlocks it cannot be copied to another device. Wall keys, share links and pairing keys are stored only as hashes, so the database does not contain anything that could be presented as one of them. Four of the five file buckets are private: nothing comes out of them without Lucid's server checking whose account is asking, and where your browser is handed a link to a file at all it is signed for that one request and expires. The fifth, your signature image, is public, and the reason is above. None of that is a certification: no security assessment or compliance audit has been carried out on Lucid, and this page will say so until one has.

Your rights over it, and how to use them

These do not go through the owner and are not a favour to ask for. Both are buttons, both act on your own account and no other, and both are on your data page — reachable from Settings inside Lucid and directly at /erase.html. Both keep working in every billing state, including a locked one.

A copy of everything you wrote, as one file — and the honest limits of it. The download is a single data file containing every record that exists only in Lucid: people, notes, projects, journal, timeline, the assistant's conversations, your recipes and trips, the health, workout and money records, your read receipts, your plan, and the things Lucid worked out about you that you never typed. It also names, table by table, everything deliberately left out of it and why, so that a short export is something you can see rather than something you discover.

Two things are not in that file, and one of them has an archive of its own. Your mail is deliberately not in it, because that is a copy of a mailbox you already own at Microsoft or Google and it runs to hundreds of megabytes. Your files are not in it either — the vault documents, the frame photographs, the board pictures, your signature image and the spoken audio are stored as files rather than as records, and a download that has to come back through one request cannot carry a twelve-megabyte scan without failing for the person who most needs it. The export lists every one of those files with its path, so a short export is something you can see rather than something you discover. And keys are not in it — access tokens, the sealed bank credential, pairing keys — because each is a credential rather than a fact, and several could not be restored from a file even if they were in one.

The full archive, which does carry the files. The same Settings panel will build you a zip containing both halves: the records, as the same data file described above, and the actual bytes of every document, photograph, board picture, signature and spoken clip on your account, in named folders. It is built in the background rather than handed straight back, because a request cannot return that much, and you are given a link to it when it is done. Inside the archive is a plain-text file, WHAT-IS-IN-HERE.txt, naming every file that is not in it and why — a vault you had locked, a file that would not come out of storage, a file too large for one archive — and when nothing was left out it says that instead. A large account is split into several zips, each of which opens on its own. Nothing is claimed finished until it is: the screen tells a build that failed apart from an account that has never asked for one, and the counts it shows are what was written rather than what was intended.
Deletion. Every row across every table Lucid holds for your account, plus the files behind them — the vault documents, the photographs, the board pictures, your signature and the spoken audio — in one pass, reporting back exactly what was removed, table by table, rather than a bare "done". If any part of it does not go, the page says which part and says the deletion was partial rather than calling it finished. You are shown the full count before anything happens and have to type your own address to confirm. There is no undo, and there is no retention period afterwards.
Correction, and seeing what is held. Everything Lucid holds is shown in the app and can be edited there. Anything that cannot, write about.

A few things are named on that page instead of being deleted, and they are named here for the same reason. The list of who is allowed to sign in to this installation is not your data to delete; neither is the registration of an app that connects to Lucid, nor the shared key this installation uses to send notifications. And the record of what you have paid — which plan, and the events behind it — is left in place, because in several jurisdictions the right to erasure does not override a duty to keep a financial record, and destroying one may not be ours to do. Nothing is written to those tables today, because there is no payment processing, which means the question is being settled while it still costs nobody anything. It is on the list at the foot of this page.

Two honest limits. Deletion leaves the sign-in itself in place and empty rather than removing the account outright — the data goes, the empty account remains, and the reasoning is written out in the comments of delete-everything.js in the source. And it does not, by itself, revoke the permission you granted at Microsoft, Google, Spotify, Instagram or SimpleFIN; that has to be removed from those accounts directly. Disconnecting an account in Settings removes its stored access token immediately and stops all reading from it, but that is reversal rather than deletion — the rows Lucid already holds stay until deletion is asked for separately.

For an Instagram connection specifically, Meta can trigger this deletion on your behalf without going through anybody at all — see above.

Children

Lucid is built for adults managing an adult life and is not directed at children. There is no age gate in it today. Whether one is required is on the list below.

If something goes wrong

If data held in Lucid is ever exposed or lost, the people affected will be told what happened, what was involved, and what is being done about it, without waiting to be asked. The statutory deadline and the regulator to be notified depend on where the controller is established, which is the blank above; the commitment to tell you does not.

If Lucid itself is not working, the status page says so.

Changes to this page

The date at the top changes when the page does. It is rewritten whenever the code and the description stop matching, which is the only way a page like this stays true — and the reason for every claim on it is written into the source of this file rather than kept somewhere nobody can check.

Contact

Write to support@lucid.invalid — placeholder, a real support address has not been chosen yet, or to [DATA CONTROLLER — TO BE NAMED] at the postal address given above. The terms of service sit beside this page.

Before this page is published — for the lawyer reading it

Everything above this line was written by reading Lucid's own source code and is meant to be true of the software as it stands. Everything below is a decision nobody has made. It is printed here rather than left in a file so that the review is an hour: what follows is the whole of it, and nothing else on the page is waiting on you. This section comes out when these are answered, and while it is here the page is not finished.

The read-receipt tracking pixel, and this is the big one. It records whether, when and how often a person who never visited Lucid opened a message. It is described in full above. Whether it may ship at all, and on what terms, is the largest exposure in this application and it is not close.
The controller. Who legally decides what happens to this data, and the registered postal address. Marked in yellow above, twice, and it is the one blank left in this page. It is the same decision the terms call the operator.
Governing law and jurisdiction follow from that answer. They are stated in the terms against the same blank rather than guessed at here.
The contact address. A real one, in place of the reserved placeholder. Setting LUCID_SUPPORT_EMAIL is enough for this page; the copy on the marketing site has to be edited by hand.
A data protection officer, or an EU/UK representative — whether either is required, which turns on where the controller sits and who the customers are.
The lawful basis for each kind of processing. The page says what is processed and why, in plain English. Naming the Article 6 basis for each, and the Article 9 position on the health, body and medicine data, is a judgement about a specific business.
International transfers. Where the database, the server functions, the AI provider and the embedding provider physically run, and the mechanism covering each transfer.
The breach-notification commitment. The intention is stated above in plain words; the regulator, the deadline and the exact wording are not.
Children. There is no age gate. Whether one is needed is a question about who this is sold to.
The companies named above are the ones the code calls — not a list of signed data processing agreements. Somebody has to sign those, and this list has to be kept current afterwards.
Erasure against a duty to keep financial records. Deletion removes everything except the things named above. The record of what somebody paid is left in place, because destroying a financial record may not be ours to do. Nothing is written to it yet, so this is cheap to settle now and expensive later.
The inferences, some of which are about other people. Lucid keeps what it has noticed about the customer, and separately what it has noticed about the people she writes to. The second is about somebody who never agreed to anything — the same family as item 1, far smaller, and worth looking at in the same sitting.
The mail search index. Passages of a customer's mail — which contain other people's words as well as her own — are sent to a third party to be turned into numbers. That is disclosed above; whether disclosure is enough is not ours to decide.
The public signature bucket. One of the five file buckets is world-readable by design, because the recipient's mail client has to fetch the image and cannot sign in. It is disclosed above. Whether a public object store holding a customer's own image needs anything more than disclosure — consent, a setting, an expiring proxy — is a judgement, and the engineering alternative (proxying the image through a signed redirect that never expires) is a day's work if the answer is yes.
The copy on the customer's own device. Four thousand messages, including four hundred characters of each body, sit in the browser's storage and are deleted at sign-out. It is disclosed above. Two questions come with it: whether a shared or company-managed machine needs anything said about it beyond this page, and whether the customer should be able to switch it off. There is no switch today.
The files are not in any backup. Database backups do not cover object storage, so the live bucket is the only copy of a customer's passport scan. It is disclosed above and the terms ask people to keep their own copies. Whether that is an adequate answer for a paid product that invites somebody to upload identity documents is a question about what is being promised, not about what the code does.
The model provider. Background work and answers go to Anthropic only; a data processing agreement is needed with it, and the list on this page has to be kept in step with the configuration if another model is ever added.
The typeface. These pages load Google Fonts, which passes the reader's address to a Google server. Embedding it has been litigated in at least one EU jurisdiction. Self-hosting the font files removes the question entirely and costs an afternoon.