Privacy Policy

1. Information We Collect

1.1 Account Information

When you create an account, we collect:

• Email address
• Display name (optional)
• Payment information (processed by our third-party payment provider; we do not store credit card numbers)

1.2 Conversation Data

Lucy stores the content of your conversations to provide her core feature: persistent memory. This includes:

• Messages you send to Lucy
• Lucy's responses to you
• Memory summaries and emotional context derived from your conversations
• Achievement progress and trust level data

1.3 Technical Data

We automatically collect limited technical information to keep the Service running:

• Device type and operating system
• App version
• Crash logs and performance data
• General usage patterns (e.g., session frequency, not message content)

We do not collect your location, contacts, photos, or any data from other apps on your device.

2. How We Use Your Information

We use your information for one purpose: to make Lucy work for you.

• Conversation memory: To remember your stories, preferences, and the details that make Lucy feel like someone who knows you.
• Emotional intelligence: To understand context and respond appropriately to your mood and needs.
• Account management: To manage your subscription, authenticate your account, and provide support.
• Service improvement: To fix bugs and improve app performance using aggregated, anonymized technical data only.

3. What We Never Do With Your Data

This section is the most important part of this policy:

• We never use your conversations to train AI models. Not ours, not anyone else's. Ever.
• We never sell your data. To anyone, for any reason.
• We never share your conversations with third parties. Your messages stay between you and Lucy.
• We never show you targeted advertising. Lucy has no ads, and your data is never used for ad targeting.
• We never read your conversations. Our team does not have access to your message content.

4. Data Storage and Security

Your data is stored on secure, encrypted servers. We use industry-standard security measures including:

• Encryption in transit (TLS 1.3) and at rest (AES-256)
• Strict access controls — no employee has access to your conversation content
• Regular security audits
• Secure authentication protocols

While no system is 100% secure, we treat your data with the same care we'd want for our own private thoughts.

5. Your Rights and Controls

You have full control over your data at all times:

• Export: You can export all your conversation data at any time from the app settings.
• Delete: You can delete individual memories, entire conversations, or your complete account and all associated data.
• Access: You can request a full copy of all data we hold about you.
• Correction: You can correct any information Lucy has remembered incorrectly.

When you delete data, it is permanently removed from our servers within 30 days. We do not retain backups of deleted data beyond this period.

6. Data Retention

We retain your conversation data and memories for as long as your account is active. This is essential to Lucy's core promise: she remembers you.

If you cancel your subscription, your data remains accessible and exportable for 90 days. After 90 days of inactivity with no active subscription, we will notify you before any data is deleted.

If you delete your account, all associated data is permanently erased within 30 days.

7. Third-Party Services

We use a limited number of third-party services to operate Lucy:

• AI model provider: Your messages are sent to our AI provider to generate Lucy's responses. These messages are processed in real time and are not stored or used for training by the provider.
• Payment processing: Subscription payments are handled by a third-party processor. We never see or store your full credit card number.
• Hosting infrastructure: Our servers are hosted on secure cloud infrastructure with data encrypted at rest.

We require all third-party providers to maintain strict data protection standards.

8. Children's Privacy

Lucy is not intended for children under 16 years of age. We do not knowingly collect personal information from children under 16. If we become aware that we have collected data from a child under 16, we will promptly delete that data.

9. International Users

Lucy is available globally. Your data may be transferred to and processed in countries other than your own. Regardless of where your data is processed, the protections described in this policy apply in full.

If you are located in the European Economic Area (EEA), United Kingdom, or other jurisdictions with data protection laws, you have additional rights under applicable regulations including the GDPR. To exercise these rights, contact us at the address below.

10. Changes to This Policy

We may update this Privacy Policy from time to time. If we make material changes, we will notify you through the app or by email before the changes take effect. We will always make the current version available within the app and on our website.

11. Contact Us

If you have questions about this Privacy Policy or want to exercise your data rights:

• Email: privacy@lucyai.app
• Web: lucy-openai.vercel.app/contact

We aim to respond to all privacy-related inquiries within 7 business days.