Privacy policy

1. Information we collect

We collect what you give us and what is created as you use Lucidity:

Account data

• Your email address
• Your first and last name, if you enter them at sign-up
• If you sign in with Google or GitHub: the name, email address, and profile picture link that the provider shares with us
• Your time zone
• Your password is handled by Supabase, our sign-in provider, and stored only in hashed form. We never see it.

Tasks, projects, and notes

• Tasks, projects, lists, and their details, such as titles, descriptions, priorities, due dates, and time estimates
• Notes you write
• Tags and how you organize your work
• Your daily plans (which tasks you intend to do) and, if you use scheduling, your schedule blocks (when you plan to do them)
• Goals, where that feature is available to you

Focus session data

• When sessions start and end, and how long they last
• Which tasks you worked on during a session
• Energy ratings
• Notes and reflections you add during or after a session
• Whether a session was completed, paused, or stopped early

Technical and error data

• Error reports and performance traces, collected by Sentry (see section 4)
• Your IP address and browser details, which our hosting and sign-in providers record in their logs
• We count page views with Vercel Web Analytics, which sets no cookies and receives only the page path and any campaign tags from each address. We do not use advertising trackers.

Google Calendar (optional)

• Only if you connect it in Settings
• The permission we request lets us view your calendars. We only use Google's free/busy service, which returns the start and end times of busy periods and nothing else. We do not read event titles, descriptions, attendees, or locations.
• We use busy times to avoid scheduling over them. We do not store them in our database.
• We never create, change, or delete anything in your Google Calendar
• We store the email address of the Google account you connected and when you connected it

Canvas LMS (optional)

• Only if you connect it in Settings. You paste your school's Canvas address and a personal access token from your Canvas account. Some schools may connect through Canvas sign-in instead.
• A Canvas access token can do anything your Canvas account can do. Lucidity only uses it to read. We encrypt it with AES-256-GCM before storing it, and you can revoke it in Canvas at any time.
• We read your active courses (name, code, term, and dates) and their assignments (title, description, due and availability dates, points, submission types, whether you have submitted, and a link back to Canvas)
• We do not read grades, messages, files, or classmates
• We never submit, post, or change anything in Canvas. Lucidity is not affiliated with Instructure or your school.

Email recaps (optional)

• Off by default. You can turn on weekly or monthly recaps in Settings.
• A recap can include tasks completed per project, how many daily plans you completed, upcoming Canvas deadlines with course names, scheduled focus time, and recommendations
• If you choose a different delivery address, we store it
• We keep a log of each recap we send (address, period, and whether it was delivered)

2. How we use your data

We use the information we collect to:

• Run Lucidity: Tasks, planning, focus sessions, and insights
• Find patterns: Work out your trends, energy cycles, and suggestions on our own servers, from your own data
• Fix problems: Investigate errors and slow pages
• Contact you: Account emails, such as confirming your address, and any recaps you turn on. We do not send marketing email.
• Keep Lucidity safe: Prevent abuse and unauthorized access

We do not sell your data. We do not use it for advertising. We do not use it to train AI models.

If you are in the European Economic Area or the United Kingdom, our legal bases are: our agreement with you (to run the service), our legitimate interests (to keep it secure and fix errors), and your consent (for optional integrations, email recaps, and any optional AI feature we turn on). You can withdraw consent at any time by turning the feature off.

3. Data storage and security

Here is where your data lives and how we protect it:

• Where: In a Postgres database run by Supabase, in the United States. The app is hosted on Vercel.
• Encryption: Data is encrypted in transit (HTTPS) and at rest by Supabase. Canvas tokens get an extra layer of AES-256-GCM encryption.
• Access control: Every table in our database uses row-level security, so one account cannot read another account's data
• Sign-in: Supabase Auth handles email and password sign-in, and sign-in with Google or GitHub
• Operator access: Lucidity is run by one person, who has administrative access to the database for maintenance. We look at your content only to fix a problem you report, to investigate abuse, or when the law requires it.

If you use Lucidity from outside the United States, your data is transferred to the United States. Where the GDPR applies, we rely on the safeguards in our providers' data processing terms, such as standard contractual clauses.

No system is perfectly secure. If a breach affects your personal data, we will tell you promptly and notify regulators where the law requires it.

4. Third-party services

These services process data for us so Lucidity can run:

• Supabase: Database, sign-in, and account emails. United States.
• Vercel: Hosting. Processes request data such as IP address and browser type.
• Sentry: Error and performance monitoring. United States. Reports can include your browser and device type, the page you were on, an internal account ID, and your IP address. We do not attach your name or email. When an error happens, Sentry may record a replay of the page around that moment. A replay can show text that was on screen, such as task titles. Text you type into form fields is masked. Reports pass through our own domain (/monitoring) on the way to Sentry.
• Resend: Delivers email recaps, only if you turn them on. United States.
• Google: Sign-in with Google, if you choose it, and calendar free/busy times, if you connect Google Calendar. Lucidity's use of information received from Google APIs follows the Google API Services User Data Policy, including its Limited Use requirements.
• GitHub: Sign-in with GitHub, if you choose it
• Canvas LMS (your school): If you connect it, we read from your school's Canvas. Your school and Instructure control that data under their own policies.
• Stripe: Not active. Lucidity does not take payments today. If we add paid plans, Stripe will handle payments and we will never see your full card number. We will update this policy before that happens.
• Anthropic and OpenAI: Not active. See section 5.

Each of these services has its own privacy policy. We do not sell personal data or share it for anyone else's advertising.

5. AI features (optional, currently off)

Lucidity does not currently send your data to any AI provider. The code for some optional AI features exists, but those features stay off unless we add the provider keys, and we have not done so. If and when we turn any of them on, we will update this section first, and we will tell you in the app and ask for your agreement before any of your data is sent.

Here is exactly what each feature would send:

• Task matching (OpenAI text-embedding-3-small): The title and description of a task when you create or edit it, and the title and description of a goal. OpenAI returns a list of numbers (an "embedding"). We store it and use it to link tasks to goals and to suggest a project for a task.
• Skill classification (Anthropic Claude Haiku): The title, description, and internal ID of a task, in batches of up to 15 tasks. Claude returns skill labels such as "writing" or "research".
• Weekly reflection letter (Anthropic Claude Haiku): Your weekly totals: focus minutes, number of sessions, average flow score, average energy at the end of sessions, top skill areas with minutes, the titles of your goals (with and without progress that week), and whether the week was up or down from the last. Task titles, task descriptions, and notes are not included.

What these requests leave out. None of them include your name or email address. Titles you write can still contain personal details, which is why these features will be your choice. Both providers say in their API terms that they do not train models on API data by default. They may keep requests for a limited time for abuse monitoring, under their own policies.

Features that use no outside service. These run on our own servers, using only your data in our database. Nothing is sent to a third party:

• Pattern engine: Finds trends in when and how you focus
• Session length prediction: Suggests a focus duration from your past sessions
• Break timing: Suggests when to take a break, based on your past sessions
• Focus environment suggestions: Recommends a focus environment based on what has worked for you

6. Cookies and local storage

We use only what Lucidity needs to work. There are no advertising cookies, no analytics cookies, and no cross-site tracking.

• Sign-in cookies: Supabase sets cookies that keep you signed in. If you connect Google Calendar, the short-lived Google access token is kept in these cookies too. Lucidity cannot work without them.
• Local storage: Lucidity saves some data in your browser so it loads quickly and survives a refresh: your theme (light or dark), your active focus session, a cached copy of today's plan, your last selected project and view, the mode you last used, dismissed suggestions, and a few app preferences. Some of this can include task titles.
• Offline cache: Lucidity can be installed as an app. A service worker stores app files and an offline page on your device. It also keeps copies of recently visited pages and up to 16 recent data responses for up to 24 hours, so the app still opens on a bad connection. These copies can include your tasks and plans.

Signing out does not clear local storage or the offline cache. On a shared device, clear this site's data in your browser settings after you sign out. Because we do not track you across sites, there is nothing for Do Not Track or Global Privacy Control signals to switch off.

7. Data retention

We keep your data while your account exists, except where a shorter period applies below. A cleanup job runs every day.

• Account, tasks, notes, and settings: While your account exists. Tasks and notes you delete are erased right away. Projects you delete are archived, not erased, until you delete your account.
• Focus session detail: Session events, notes written during a session, closing notes, and per-task timing are erased after 90 days. We keep a summary of each session, such as its length and your energy rating, but not the text of your notes.
• Sessions, daily plans, and schedule blocks: Erased after 365 days (sessions and schedule blocks once they have ended). Summary statistics remain.
• Summaries and patterns: Daily and per-session summaries, detected patterns, and recommendations are kept while your account exists
• Internal records: Priority signals and old planning drafts after 90 days. Planning override history and stale suggestions after 180 days. The email recap log after 365 days. Snoozes 7 days after they expire.
• Canvas data: Kept while connected. Your token, courses, and assignments are deleted when you disconnect. Tasks you created from assignments stay.
• Calendar busy times: Not stored in our database
• Error reports: Kept by Sentry for up to 30 days
• When you delete your account: Deleting it yourself in Settings, Account removes your account and all of its data right away. If you ask us by email instead, we do it within 30 days of your request. Copies in our providers' backups expire on their own schedule, and error reports already sent to Sentry, which can carry an internal account ID, expire within 30 days.

8. Your rights

You can ask us to do any of the following. We answer within 30 days, and it costs nothing.

• Access and export: Download your data as a JSON file from Settings, Account, under Export your data. It covers your profile, projects, lists, tasks, notes, focus sessions, plans and schedules, settings, Canvas courses and assignments, saved environments, and goals. It never includes passwords or connection tokens. For anything the file does not cover, such as detected patterns, ask us and we will send it in a machine-readable format.
• Correction: Edit your tasks, projects, and notes directly in the app. For anything you cannot change yourself, ask us.
• Deletion: Delete your account yourself in Settings, Account, under Danger zone. It takes effect immediately and cannot be undone. If you cannot sign in, email us from the address on your account, and we will delete it and confirm when it is done.
• Disconnect integrations: Disconnect Canvas or Google Calendar in Settings at any time. You can also revoke access from your Canvas or Google account settings.
• Turn things off: Turn off email recaps in Settings. Withdrawing consent does not affect what happened before.

EEA and UK: You also have the right to restrict or object to processing, to receive your data in a portable format, and to complain to your local data protection authority.

California: You have the right to know what we collect, to delete it, and to correct it. We do not sell or share your personal information, as the CCPA defines those terms, and we will not treat you differently for using your rights.

We give these rights to everyone, wherever you live. To use any of them, email us at the address in section 11. We may ask you to confirm the request from your account email.

9. Children

Lucidity is made for students, but it is not directed at children under 13. You must be at least 13 to use it, or at least 16 if you live in the European Union. We do not ask for your date of birth, so we rely on you to meet this requirement. If you are under 18, check with a parent or guardian first. If we learn that an account belongs to someone under the minimum age, we will delete it. If you think this has happened, contact us.

10. Changes to this policy

When we change this policy, we update the date at the top. If a change affects how your data is used, for example turning on an AI feature or starting to take payments, we will tell you in the app or by email before it takes effect.

11. Contact us

Questions about this policy or your data? Email us at:

Email: privacy@lucidity.work