Privacy Policy
Application: Lucy AI
Effective date: 14 June 2026
Last updated: 15 August 2026
1. Introduction
Lucy AI (the "App") is a personal wellness application that combines daily mood tracking with a private AI-powered chat companion named Lucy. Lucy learns about you over time to provide a more personalised experience.
This Privacy Policy explains what personal data we collect when you use the App, how we use it, with whom we share it, and the rights you have over it. It also covers the yourfriendlucy.com website, including the email address you provided if you joined our waitlist — that email is treated as account data under this policy (see Sections 8 and 9 for retention and your rights).
We are committed to processing personal data lawfully, transparently, and in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (the General Data Protection Regulation, "GDPR") and, where applicable, French Law No. 78-17 of 6 January 1978 on Information Technology, Data Files and Civil Liberties (Loi Informatique et Libertés) as amended.
2. Data Controller
The data controller for your personal data is:
- Name: Vincent Legardien
- Status: Auto-entrepreneur, France
- SIRET: 98377742600013
- Contact email: help.lucyai@proton.me
No Data Protection Officer (DPO) is required under Article 37 GDPR for the scale of processing currently performed. For any privacy-related question, please write to the contact email above.
3. Data We Collect
3.1 Account data (provided by you at registration)
- Email address
- Password (stored as a one-way cryptographic hash by Supabase; we never see your plaintext password)
- Or, if you use Sign in with Apple / Sign in with Google: an authentication token and, depending on your settings, your name and email address as provided by Apple or Google
3.2 Profile data (collected during onboarding)
- First name
- Date of birth (stored as a date; used only to calculate your age for the AI context and to verify the minimum age requirement)
- Gender (male / female / other / prefer not to say — optional)
- Timezone (auto-detected from your device; can be updated)
- Notification preferences (enabled/disabled, reminder types)
- Push notification token (stored only if you grant notification permission; used solely to deliver in-app reminders)
- Profile photo (optional; URL stored if uploaded)
3.3 Mood tracking data
- Daily mood scores on a 1–5 scale, one entry per day
- Date of each mood entry
3.4 Chat conversation data
- All messages you send to Lucy (full text)
- All responses generated by Lucy (full text)
- Message timestamps and sequence numbers
3.5 AI-derived memory data (structured profile built from your conversations)
As you interact with Lucy, the App progressively builds a structured profile that Lucy uses to personalise her responses. This profile includes:
- Identity context: your first name, calculated age, gender, general location (if you share it), occupation and professional situation (if you share it)
- Personality traits: up to 5 trait keywords inferred from how you describe yourself (e.g. "anxious", "ambitious", "introverted")
- Preferences: up to 20 category/value items about your likes and dislikes (inferred from conversations)
- Relationships: first names and relationship types (e.g. "Sophie — partner") of people you mention
- Life events: significant events you share (e.g. a job change, a bereavement)
- Ephemeral events: upcoming or recent short-term events you mention (e.g. an exam, a trip)
- Goals: personal or professional objectives you share
- Mood context: today's mood score and a 7-day rolling average (derived from your mood tracker entries)
3.6 Technical and usage data
- Device platform (iOS or Android)
- App version
- Server-side error logs (retained for a short operational period; do not contain message content)
3.7 Subscription data
Lucy AI is offered through an auto-renewing subscription sold by Apple. Payment is handled entirely by Apple: we never see or receive your payment card details. To know whether your subscription is active, we use RevenueCat, Inc. as our subscription management provider. The following is shared with RevenueCat:
- Your account identifier (the same anonymous identifier used in our database)
- A device identifier generated by RevenueCat
- Purchase history and App Store receipt data (which plan, purchase and expiry dates, trial eligibility, country and currency of your App Store account)
We use this data to unlock the App for subscribers and to know when a subscription has ended. The legal basis is performance of the contract (Art. 6(1)(b) GDPR): without it we cannot provide the service you paid for.
Data we do not collect: We do not collect precise geolocation, payment card or bank details, contacts, photos (other than an optional profile picture), microphone or camera data, or any data from other apps on your device.
4. How We Use Your Data and Legal Basis
The GDPR requires us to have a valid legal basis for each processing activity. The table below sets out every purpose for which we process personal data, the data categories involved, and the applicable legal basis.
| Purpose | Data categories | Legal basis |
|---|---|---|
| Creating and managing your account; authenticating you | Email, password hash, OAuth tokens | Art. 6(1)(b) GDPR — performance of a contract |
| Personalising the App (name, timezone, language, notifications) | First name, date of birth, gender, timezone, notification preferences, push token | Art. 6(1)(b) GDPR — performance of a contract |
| Providing the mood tracking feature (recording and displaying your mood history) | Daily mood scores, entry dates | Art. 9(2)(a) GDPR — explicit consent (wellness / health-adjacent data) |
| Providing the Lucy AI chat feature (generating responses) | Chat messages (user and assistant), AI-derived memory profile, mood context | Art. 9(2)(a) GDPR — explicit consent (content may include mental health and personal data) |
| Building and maintaining Lucy's memory to personalise future conversations | AI-derived memory data (traits, preferences, relationships, events, goals) | Art. 9(2)(a) GDPR — explicit consent |
| Sending daily mood reminders and other in-app notifications | Push notification token, notification preferences | Art. 6(1)(a) GDPR — consent (you grant notification permission explicitly on your device) |
| Ensuring service security, preventing abuse, and maintaining technical integrity | Server logs (no message content), user identifiers | Art. 6(1)(f) GDPR — legitimate interest (security and fraud prevention) |
| Complying with legal obligations | Any data required by applicable law | Art. 6(1)(c) GDPR — legal obligation |
How consent is obtained
For data categories processed under Art. 9(2)(a) — mood scores, chat messages, and AI-derived memory — your explicit consent is obtained via a clearly labelled opt-in checkbox presented before you first use those features, at the time of account creation or during onboarding. The checkbox text reads (or words to this effect):
"I consent to Lucy AI collecting my mood data, chat conversations, and building an AI memory profile from my conversations, including data that may relate to my emotional wellbeing and mental health. I understand this data will be transmitted to OpenAI to generate responses. I can withdraw this consent at any time by resetting Lucy's memory or deleting my account."
Consent is recorded with a timestamp and the consent text version. No mood, chat, or memory processing occurs before consent is given.
Withdrawing consent
Where processing is based on your consent (Art. 6(1)(a) or Art. 9(2)(a)), you have the right to withdraw that consent at any time without affecting the lawfulness of processing that occurred before withdrawal. You can withdraw consent for AI chat and memory processing by using the "Reset Lucy's memory" option in Settings, which immediately and permanently erases all conversation history and AI-derived memory. You can withdraw consent entirely by deleting your accountfrom Settings > Delete my account.
5. AI-Powered Features: Third-Party Processing by OpenAI
What is sent to OpenAI on each chat request
The following data is included in the API request sent to OpenAI every time Lucy responds to you:
- Your last 30 chat messages (full text, user and assistant roles)
- Your AI memory profile: first name, calculated age, gender, up to 5 personality trait keywords, up to 20 preference items, up to 10 named relationships, up to 10 life events, active ephemeral events, your mood score today and your 7-day mood average
- Lucy's system instructions (App configuration; does not include other users' data)
What is not sent to OpenAI
- Your email address
- Your account UUID (internal identifier)
- Your raw date of birth (only your calculated age is shared)
- Your push notification token
- Your exact timezone
- Your full mood history (only today's score and the 7-day average)
OpenAI's data handling commitments
Data transfers to OpenAI are governed by Standard Contractual Clauses (Module 2, EU Commission Decision 2021/914) and OpenAI's Data Processing Addendum, which we have executed. OpenAI's privacy commitments for API customers are described at openai.com/enterprise-privacy.
- No model training:OpenAI's API data usage policy (effective March 1, 2023) states that data sent via the API is not used to train or improve OpenAI's models unless you explicitly opt in. We have not opted in. Your conversations with Lucy do not train any AI model.
- Retention by OpenAI: OpenAI retains API request logs for abuse monitoring purposes for up to 30 days, after which they are deleted unless longer retention is required by law. Eligible customers may request Zero Data Retention; we will assess this option as the service scales.
- Your rights with OpenAI: For data held by OpenAI, you may contact OpenAI directly at privacy.openai.com.
6. Third Parties We Share Data With
We do not sell, rent, or trade your personal data. We share data only with the following sub-processors strictly necessary to operate the App:
| Sub-processor | Role | Data shared | Location | Transfer safeguard |
|---|---|---|---|---|
| Supabase, Inc. | Cloud database, authentication, and backend infrastructure | All data stored in the App (account, profile, mood entries, conversations, memory) | USA (AWS us-east-1, N. Virginia) | Standard Contractual Clauses (Module 2); Supabase Data Processing Addendum (executed — available at supabase.com/legal/dpa) |
| OpenAI, LLC | AI language model (chat responses and memory snapshot generation) | Chat messages, AI memory profile (see Section 5) | USA | Standard Contractual Clauses (Module 2); OpenAI DPA (executed) |
| RevenueCat, Inc. | Subscription management and purchase validation | Account identifier, device identifier, purchase history and App Store receipt data (see Section 3.7) | USA (AWS) | Standard Contractual Clauses; RevenueCat Data Processing Addendum (available at revenuecat.com/dpa) |
| Apple Inc. | Authentication (Sign in with Apple — optional); seller of record and payment processing for subscriptions | Authentication token; optionally your name and email as provided by Apple; subscription purchase and billing data held by Apple under its own privacy policy | USA | Apple's own GDPR data processing commitments |
| Google LLC | Authentication (Sign in with Google — optional) | Authentication token; your name and email as provided by Google | USA | Google's standard contractual clauses and Data Processing Terms |
Supabase itself uses Amazon Web Services (AWS) as its primary infrastructure provider. For a current list of Supabase's sub-processors, please refer to Supabase's Data Processing Addendum available at supabase.com/legal/dpa.
7. International Data Transfers
Your personal data is processed in the United States by Supabase (AWS us-east-1) and OpenAI. The United States does not benefit from an adequacy decision by the European Commission under Article 45 GDPR.
To ensure an adequate level of protection for your personal data, these transfers are governed by Standard Contractual Clauses (SCCs) adopted by the European Commission on 4 June 2021 (Implementing Decision 2021/914), Module 2 (Controller to Processor). These clauses impose binding data protection obligations on the recipients. You may request a copy of the relevant SCCs and DPAs by contacting us at the email address in Section 2.
8. Data Retention
| Data category | Retention period |
|---|---|
| Account data, profile, mood history, conversations, AI memory | Until you delete your account. Account deletion triggers immediate and permanent deletion of all associated data across all tables (cascade deletion). |
| Lucy's AI memory (conversations, traits, preferences, relationships, events) | Until account deletion, or until you use the "Reset Lucy's memory" feature in Settings, which permanently erases all AI memory and conversation history (your mood tracker history is preserved). |
| Inactive accounts | If your account has not been accessed for 24 months, we will send a notification and, absent a response, delete the account and all associated data. |
| OpenAI API logs | Up to 30 days from the time of processing (OpenAI's abuse monitoring policy). Not under our control; governed by OpenAI's Privacy Policy. |
| Server-side operational logs | Up to 30 days for technical error logs. Logs do not contain message content. |
9. Your Rights Under GDPR
As a data subject under the GDPR, you have the following rights. You may exercise them by contacting us at the email address in Section 2, or where indicated, directly within the App:
9.1 Right of access (Art. 15)
You have the right to obtain confirmation of whether we process personal data about you, and to receive a copy of that data. To request an export of your data, contact us by email.
9.2 Right to rectification (Art. 16)
You have the right to have inaccurate data corrected. You can update your first name, date of birth, gender, and timezone directly in Settings > Edit profile. For other corrections, contact us.
9.3 Right to erasure (Art. 17)
You have the right to request deletion of your personal data. You can exercise this right:
- For all data: Settings > Delete my account (immediate, permanent, irreversible)
- For AI memory and conversations only: Settings > Reset Lucy's memory (preserves mood tracker history)
- By email: contact us at the address in Section 2
9.4 Right to restriction of processing (Art. 18)
You have the right to request that we restrict processing of your data in certain circumstances, for example while we verify a rectification request.
9.5 Right to data portability (Art. 20)
You have the right to receive your personal data in a structured, commonly used, machine-readable format, and to transmit it to another controller, where processing is based on consent or contract and carried out by automated means. To request a data export, please contact us by email; we will provide your data in JSON format within 30 days.
9.6 Right to object (Art. 21)
Where we process data on the basis of legitimate interest (Art. 6(1)(f)), you have the right to object to that processing. Contact us to exercise this right.
9.7 Right to withdraw consent
Where processing is based on your consent, you may withdraw it at any time without affecting prior processing. See Section 4 for how to withdraw consent.
9.8 Right not to be subject to automated decision-making
The App does not make automated decisions that produce legal effects or similarly significant effects about you. Lucy generates conversational responses based on your data but does not take any binding decisions about you.
9.9 Right to lodge a complaint
If you consider that the processing of your personal data violates the GDPR, you have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, place of work, or the place of the alleged infringement. In France, the competent authority is:
Commission Nationale de l'Informatique et des Libertés (CNIL)
3 Place de Fontenoy – TSA 80715
75334 Paris Cedex 07
Website: www.cnil.fr
Phone: +33 (0)1 53 73 22 22
We kindly ask that you contact us first so we can attempt to resolve any concern directly.
We will respond to any rights request within one month of receipt (Art. 12(3) GDPR), which may be extended by a further two months for complex or numerous requests, in which case we will notify you of the extension.
10. Data Security
We implement appropriate technical and organisational measures to protect your personal data against accidental loss, unauthorised access, disclosure, or destruction, including:
- Encryption in transit: all data between the App, our backend, and Supabase is transmitted over HTTPS/TLS.
- Encryption at rest: Supabase states that data is encrypted at rest on its AWS infrastructure.
- Authentication: access to your data requires a valid JWT session token issued by Supabase. Supabase Auth does not store passwords in plaintext.
- Row-Level Security (RLS): Supabase database policies are configured to ensure that each user can only access their own data.
- API keys: backend credentials are stored as environment variables and are never embedded in the App binary or exposed to clients.
No method of transmission over the internet or electronic storage is 100% secure. In the event of a personal data breach that is likely to result in a high risk to your rights and freedoms, we will notify you and the CNIL as required by Article 33–34 GDPR.
11. Age Restrictions
Lucy AI is intended for adults only. Regardless of your country of residence, you must be at least 18 years old to create an account — a single, uniform threshold, set at the age of majority and matching the age rating under which the App is distributed on the App Store. This threshold is at or above the minimum age of digital consent set by Article 8 GDPR and equivalent national rules (including Article 45 of the French Loi Informatique et Libertés) in every jurisdiction where the App is available.
By creating an account, you confirm that you meet this age requirement. We collect your date of birth during onboarding and use it to enforce it. If we learn that a user is below 18, we will delete their account and all associated data without delay.
12. Changes to This Policy
We may update this Privacy Policy from time to time. When we make material changes, we will:
- update the "Last updated" date at the top of this page;
- notify you via an in-app notification or email at least 30 days before the changes take effect, where the changes affect how we process your data or your rights.
Your continued use of the App after the effective date of any updated Policy constitutes your acknowledgement of the changes. Where the changes require a new consent (e.g. a new processing purpose), we will request it explicitly before the changes apply to your data.
13. Contact Us
For any questions about this Privacy Policy, to exercise your rights, or to report a concern, please contact:
Vincent Legardien
Email: help.lucyai@proton.me
Please include "Privacy Request – Lucy AI" in the subject line. We aim to acknowledge your request within 5 business days and to respond fully within one month (Art. 12(3) GDPR).
If you are contacting us to exercise a right, please provide sufficient information to identify your account (e.g. the email address you registered with) so we can locate your data and respond efficiently. We may request additional identification in certain cases to protect your data from unauthorised access requests.
© 2026 Vincent Legardien. Lucy AI is developed independently and is not affiliated with OpenAI, Apple, or Google.
This policy is currently available in English only. A French version will be provided before the French-language version of the App is made publicly available.