Lucid Privacy Policy

Last updated: May 24, 2026

1. Who We Are

Lucid is a study application developed by Egemen Günel and Caner Olcay (“we”, “us”, “our”). Lucid lets students create flashcard collections, take quizzes, and chat with an AI assistant trained on their own uploaded material.

For any privacy-related questions or requests, contact us at lecturelensai@gmail.com.

2. Information We Collect

Account and Identity. When you create an account via Apple Sign-In, we receive your full name and email address (or an Apple-generated relay address if you choose to hide your email). We store your name, institution type, and subscription tier alongside a unique account identifier.

Onboarding Preferences. During setup we ask about your study goals and learning preferences. These responses are stored to personalise your experience.

User-Generated Content. Lucid stores everything you create within the app: flashcard collections, images you upload from your photo library, text extracted from those images via OCR, quiz questions and scores, and chat conversation titles and messages.

Usage and Metering. We track usage counts needed to enforce plan limits — number of collections created, flashcard batches processed, pages uploaded, and monthly chat tokens consumed. This data is tied to your account and is not shared for advertising purposes.

Subscription State. We store your current subscription tier (Free or Crystal), renewal date, and entitlement status as synced from Apple and RevenueCat.

Data Stored Locally on Your Device. Lucid maintains a local mirror of your content using SwiftData for fast, offline access. Authentication tokens are stored in the iOS Keychain. None of this local data is accessible to us.

3. How We Use Your Information

We use your information to create and maintain your account; generate flashcards and quizzes from your uploaded material; power the AI chat assistant using your own content as context; enforce your plan limits; process account deletion and data export requests; and improve Lucid using anonymised, aggregated usage patterns.

We do not sell, rent, or share your personal data with any party for advertising or marketing purposes.

4. Third-Party Service Providers

We work with the following sub-processors. Each receives only the minimum data required for its function. Raw images, your identity (name, email), and device identifiers are never sent to AI providers.

Supabase handles authentication, database storage, and file storage — it receives all account records, user-generated content, and uploaded images. Google Cloud Run hosts our backend API and receives all traffic between the app and our servers. Google Cloud Tasks manages background jobs such as image processing, receiving job payloads with image and account identifiers. Google Cloud Vision performs OCR to extract text from your uploaded images, receiving raw image bytes at the time of upload. OpenAI generates vector embeddings from your text content, receiving text chunks of up to 2,000 characters from your uploads. OpenRouter / Google Gemini powers AI chat and quiz generation, receiving your message along with relevant text chunks retrieved from your own uploads. RevenueCat manages subscription entitlements, receiving your account identifier, App Store receipts, and subscription tier. Superwall handles paywall presentation, receiving your account identifier and feature-trigger events. Apple App Store processes all payments — payment information is handled entirely by Apple and we never see it.

5. AI and Machine Learning Processing

Neither OpenAI nor OpenRouter use your data to train their models. Your content is used solely to generate responses during your session. We have confirmed this with each provider’s API terms.

When you upload an image or document: The image is sent to Google Cloud Vision for text extraction. The extracted text is sent to OpenAI to generate vector embeddings. The original image is not sent to OpenAI. Your identity and email are not included.

When you use the AI chat assistant: Your message, along with the most relevant text chunks from your own uploads, is sent to OpenRouter/Gemini to generate a response. No raw images or account information are sent. The context used is always drawn from your own material — never from other users’ data.

When you take a quiz: Quiz questions are generated using the same retrieval pipeline as chat. Your message and relevant chunks from your uploads are sent to the model. No additional data is shared.

6. Data Retention

DataRetentionAccount records, flashcards, chats, quizzesUntil account deletion. Soft-deleted records permanently purged after 30 days.Uploaded imagesPermanently deleted 90 days after account soft-deletion.Local content mirror (device)Until you uninstall Lucid or delete your account.Authentication tokensUntil you sign out or uninstall the app.Server request logsPlatform default. Logs automatically redact tokens, credentials, and authorization headers.

7. Data Storage and Security

All communication is encrypted over HTTPS. Database access is protected by Row-Level Security — your records are only accessible by your account. Authentication uses JWT tokens and we never store or see your password. Your auth tokens are stored in the iOS Keychain. Server logs automatically redact sensitive fields. Lucid contains no advertising SDKs, analytics trackers, or behavioural profiling tools.

No method of transmission or storage is 100% secure. If you become aware of a security concern, contact us immediately at lecturelensai@gmail.com.

8. Account Deletion

You can permanently delete your account directly within Lucid via Settings → Delete Account → Confirm.

When you initiate deletion: your uploaded images are queued for removal (permanently deleted within 90 days); your Apple Sign-In refresh token is revoked with Apple; all your database records are soft-deleted then permanently purged within 30 days; and your Supabase authentication account is removed. After deletion is complete, your data cannot be recovered.

9. Your Rights

Access and Correction. You can view and edit your profile information directly within the app. For questions about other stored data, contact us at lecturelensai@gmail.com.

Deletion. You can delete your account and all associated data at any time from within the app, as described in Section 8.

Data Export (Portability). We do not currently offer an in-app export feature. If you would like a copy of your personal data, email us at lecturelensai@gmail.com and we will provide it within 30 days.

EU / EEA Residents (GDPR). You additionally have the right to object to or restrict certain processing, lodge a complaint with your local data protection authority, and withdraw consent where processing is based on consent. Contact us at lecturelensai@gmail.com — we respond within 30 days.

Opt-Out of AI Processing. If you do not wish your content to be processed by AI services, do not upload images or use the chat and quiz features. You can continue to use manual flashcard creation without AI processing.

10. Children’s Privacy

Lucid is intended for users aged 13 and older. We do not knowingly collect personal information from children under 13. If you believe a child under 13 has created an account, contact us at lecturelensai@gmail.com and we will delete the account promptly.

Users between the ages of 13 and 15 in the EU or EEA are required to have parental or guardian consent before using Lucid, as required by applicable data protection law.

11. In-App Purchases and Subscriptions

Lucid offers a free tier and a paid subscription called Crystal. Crystal unlocks higher limits on collections, flashcard batches, pages uploaded, and monthly AI chat usage.

All payments are processed exclusively through Apple’s in-app purchase system. We do not collect, store, or have access to any payment card or billing information. Apple’s privacy policy governs all transaction data.

Crystal is an auto-renewing subscription. It will automatically renew at the end of each billing period unless cancelled at least 24 hours before the renewal date. You can manage or cancel your subscription at any time through your Apple ID settings. Refunds are handled by Apple. You can restore previous purchases at any time from the Lucid Settings screen.

12. Device Permissions

Lucid requests access to your Photo Library (read-only) so you can select images to upload for flashcard generation. We do not access your photos without an explicit action from you.

Lucid does not request access to your camera, microphone, location, health data, contacts, or calendar.

13. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will revise the “Last updated” date at the top of this page. For material changes, we will notify you within the app. Continued use of Lucid after changes are posted constitutes your acceptance of the updated policy.

14. Contact

Egemen Günel & Caner Olcay
lecturelensai@gmail.com
We aim to respond to all privacy-related requests within 30 days.