Privacy Policy

Last updated: July 14, 2026

1. Our Privacy Commitment

Lucive is built with privacy as our foundation. Your journal entries are your most personal thoughts, and we've designed every aspect of our service to ensure they remain completely private. Whether you're using Lucive on your Mac or iPhone, your data stays under your control.

Lucive now has two clearly separated halves, with different privacy designs on purpose:

• Your Journal – local-first and end-to-end encrypted. No account. We cannot read it. Nothing about this has changed.
• Planning (tasks, weekly/monthly/yearly intents, daily scratchpads) – works fully on your device with no account, and can optionally sync through a Lucive account so your devices and AI assistants you connect can read and update it. Planning data you sync is readable by our service; that is what makes assistant access possible, and this policy explains exactly what that means.

2. How Lucive Works

Local-First Architecture

• Your entries stay on your devices – All journal content is stored locally on your device in an encrypted SQLite database
• End-to-end encryption – When you choose to sync between devices, your entries are encrypted before leaving your device
• Zero-knowledge design – Even when using our sync service, we cannot read your journal entries

Platform-Specific Storage

• macOS: Encrypted SQLite database with macOS Keychain integration via Tauri secure store
• iOS: Encrypted storage with iOS Keychain integration

3. Optional Sync Service

If you choose to enable device synchronization, here's what happens:

What the Relay Server Sees

• Device identifiers – Temporary, randomized IDs used only for routing messages
• Encrypted message envelopes – We route encrypted data between your devices but cannot decrypt it
• Connection metadata – Basic connection information (timestamps, message sizes) for service operation
• No personal data – The relay server has zero knowledge of your journal content, titles, or any personal information

What the Relay Server Doesn't See

• Your journal entries – All content is end-to-end encrypted before transmission
• Entry titles or metadata – Everything is encrypted on your device
• Your identity – No user accounts, emails, or personal identifiers required for sync
• Search queries – All search happens locally on your device

How Device Pairing Works

1. Generate a QR code on one device containing a temporary pairing secret
2. Scan the QR code with your other device
3. Both devices derive a shared encryption key
4. All future communication is end-to-end encrypted
5. The relay server only facilitates the connection—it never has access to your encryption keys

4. Optional: Lucive Account and Planning Cloud

Planning works entirely on your device with no account. If you want your plan on multiple devices, or you want to connect an AI assistant to it, you can create a Lucive account. Here is exactly what that involves:

What a Lucive account is

• An email address and nothing else – There are no passwords. Signing in sends a 6-digit code to your email; we store only a hashed copy of that code, and it expires within minutes.
• Device records – Each signed-in device gets a record (a name like “Nick’s MacBook Pro,” its platform, and when it was last used) so you can see and revoke access per device. Sign-in tokens are stored hashed.

What the Planning cloud stores

• Your planning data – Task titles, notes, dates and completion status, period intents, and daily scratchpad text, stored on our servers so your devices and connected assistants can read them.
• Readable by design – Unlike your Journal, synced Planning data is not end-to-end encrypted. It is encrypted in transit and at rest, but our service can read it; that is the property that lets an assistant you authorize work with your plan. If you are not comfortable with that, simply don’t create an account: Planning keeps working locally.
• Never your Journal – Journal entries are not part of the account in any form. They live in a separate, end-to-end encrypted system with no server-side readability, and no account, cloud, or assistant connection can reach them.

Your control

• Creating an account is optional and offered once; declining changes nothing about local Planning.
• You can sign out any device, which revokes its access immediately.
• You can request deletion of your account and all Planning data hosted with it at any time (see Data Retention and Deletion below).

5. Optional: AI Assistants and Agents

There are two separate ways an AI assistant can work with Lucive, with different privacy properties:

Planning: connected assistants (Claude, ChatGPT, and others)

With a Lucive account, you can connect an assistant to your Planning data through the Lucive plugin or connector. Connecting uses the same email-code sign-in as the app, and each connection gets its own revocable authorization.

• What a connected assistant can do – Read your plan (tasks, intents, scratchpads) and, on your instruction, add, update, complete, or delete tasks and update intents. That is the entire surface; there is no access to your Journal.
• Where that data goes – Planning content an assistant reads becomes part of your conversation with it and travels to that assistant’s model provider (for example Anthropic for Claude, OpenAI for ChatGPT). The provider’s terms and data-handling policies apply to that content once it is in your conversation.
• Per-connection control – Each assistant holds its own credentials. Revoking a connection cuts that assistant off; other connections and your devices are unaffected.

Journal: the local MCP server

Separately, Lucive ships with an optional local Model Context Protocol (MCP) server for your Journal. With it enabled, an AI agent running on the same machine (such as Claude Desktop or OpenAI’s Codex CLI) can search, read, and write entries in your journal through the live Lucive app. This feature is off by default, works only on your own machine, and is unrelated to the Planning cloud: it exists precisely because Journal content never goes through any server.

What stays the same when MCP is on

• The encrypted SQLite file is never read directly by an agent. Everything an agent sees is content the live Lucive app has decrypted for you.
• Lucive itself doesn’t add a relay or a cloud database for MCP traffic. The MCP server runs as a local process and talks to the Lucive app over standard input/output on your machine.

What changes when MCP is on

• Entries the agent reads become part of your chat with it. That content travels to the agent’s model provider (for example Anthropic for Claude, OpenAI for Codex) the same way anything else you type to that agent does.
• The model provider’s terms of service and data-handling policies apply to whatever portions of your journal you share with it. Lucive’s privacy commitments don’t override their handling of data once it leaves the Lucive app.

Your control

• MCP is off until you explicitly enable it in Lucive’s settings.
• You can disconnect MCP at any time, which removes the configuration from your agent and stops further sharing.
• If you would rather not extend trust to a third-party model provider for your journal contents, leave MCP off; Lucive runs exactly the same without it.

Full technical details are in our MCP documentation.

6. What We Collect

For the macOS and iOS Apps

• Nothing – The apps themselves collect no data, analytics, or telemetry

For the Marketing Website (lucive.app)

• Basic analytics – Page view counts via Vercel Analytics (no cookies, no cross-site tracking, fully anonymized)
• Purchase data – Email address and Stripe checkout ID for license validation and download delivery (macOS version only)
• Support inquiries – Email address and message content when you contact support

For the Lucive Account and Planning Cloud (Optional)

• Email address – Your account identifier, also used to send sign-in codes
• Sign-in records – Hashed verification codes (short-lived) and hashed device/assistant tokens
• Device and connection records – Device names, platforms, connected assistants, and when each was last used
• Planning data – Tasks, intents, and scratchpads you sync, as described above

For the Journal Sync Service (Optional)

• Service metrics – Anonymous usage statistics (connection counts, bandwidth usage) for service reliability
• Error logs – Anonymized error reports to improve service stability
• No journal content – We never have access to your encrypted journal data

7. What We Don't Collect

We explicitly do not collect:

• Journal entries, titles, or any content
• Personal identifiers (unless you purchase a license or contact support)
• Location data
• Device contacts or calendar information
• Browsing history
• Biometric data
• Advertising identifiers
• Cross-app tracking data

8. Data Security

Encryption Standards

• At rest: Strong encryption for local storage
• In transit: End-to-end encryption with secure transport
• Key management: Device-specific keys stored in platform keychains (macOS Keychain and iOS Keychain)

Infrastructure Security

• Relay server: Hosted on Fly.io with automatic security updates
• Planning cloud: Hosted on Vercel with data in Neon (encrypted at rest); all tokens and sign-in codes stored hashed; every assistant connection individually authorized and revocable
• No data persistence: The relay server doesn't store messages—it only routes them in real-time
• Connection limits: Rate limiting and connection throttling to prevent abuse

9. Third-Party Services

Required Services

• None – Lucive works completely offline without any third-party services

Optional Services (Only if you enable Journal sync)

• Fly.io – Hosts our relay server (processes only encrypted data)
• No analytics services – We don't use Google Analytics, Facebook Pixel, or any tracking services

Optional Services (Only if you create a Lucive account)

• Vercel – Hosts the Planning cloud service
• Neon – Stores account and Planning data (encrypted at rest, US region)
• Resend – Delivers sign-in code emails
• AI assistant providers – Only if you connect one (for example Anthropic or OpenAI), and only for the Planning content used in your conversations with it

For Purchases (macOS version)

• Stripe – Processes payments (we don't store credit card information)
• Email delivery – For sending download links and license keys

10. Data Retention and Deletion

Your Journal Data

• Full control – Delete your data anytime from within the app
• Complete removal – Deleting the app removes all local journal data
• No cloud backup – Unless you explicitly export and back up your data yourself

Sync Service

• No message storage – Messages are routed in real-time and never stored
• Connection data – Temporary connection metadata is automatically purged
• Immediate disconnect – Stop using sync at any time; no data is retained

Lucive Account and Planning Cloud

• Sign out anywhere – Signing out a device or revoking an assistant immediately invalidates its access
• Account deletion – Email support@lucive.app and we will delete your account, devices, assistant connections, and all hosted Planning data within 30 days; in-app deletion is coming
• Local data stays yours – Deleting the account never touches the data on your devices

Purchase Records

• Deletion on request – Email us to remove your purchase record
• 30-day processing – We'll delete your data within 30 days of request
• License revocation – Deleting purchase records will revoke your license

11. Children's Privacy

Lucive doesn't knowingly collect data from children under 13. The app is a general-purpose journaling tool without age-specific features or content.

12. Your Rights

You have the right to:

• Access – Export all your journal data at any time
• Portability – Export in standard formats for use elsewhere
• Deletion – Remove all your data instantly from the app
• Opt-out – Use Lucive without any sync or online features
• Transparency – This policy explains everything we do with data

13. Changes to This Policy

We may update this privacy policy to reflect changes in our practices or legal requirements. We'll notify you of significant changes through:

• The app's release notes
• Our website
• Email (only if you've provided it for purchases or support)

14. Contact Us

For privacy-related questions, data deletion requests, or concerns:

Email: support@lucive.app
Response time: Within 48 hours for privacy-related inquiries

15. Legal Basis for Processing (GDPR)

For users in the European Union:

• Legitimate interests – Operating the sync service (if you choose to use it)
• Contract fulfillment – Processing purchases and providing downloads
• Consent – For optional features you explicitly enable

16. California Privacy Rights (CCPA)

California residents have additional rights:

• Know – What personal information we collect (detailed above)
• Delete – Request deletion of your information
• Opt-out – We don't sell personal information
• Non-discrimination – Equal service regardless of privacy choices

Summary

Your privacy is paramount. Lucive is designed so that your journal entries never leave your control. Even when using our optional sync service, we use end-to-end encryption to ensure that only you can read your entries. We don't track you, we don't profile you, and we can't read your journal. Planning is different by design: if you create an account, the Planning data you sync is readable by our service so that your devices and the assistants you choose can work with it, and nothing more. Your thoughts remain yours alone.

This privacy policy is effective as of July 14, 2026 and applies to Lucive for macOS and iOS (currently in TestFlight beta), our Journal sync service, the Lucive account and Planning cloud, and assistant connections made through the Lucive plugin.