Privacy Policy

Who is responsible

Lucid is operated by Lilia Omet, the controller for the processing described here. For privacy questions, support or a request about your personal data, contact info@lucidtodo.de.

This policy covers the Lucid iOS, macOS and watchOS apps, their widgets, this website, the optional Lucid account service and the separate Notion connection service. Services you choose to connect, and Apple services such as iCloud and TestFlight, also have their own privacy information.

Tasks stay with the storage you choose

Lucid stores tasks and settings on your device. If you enable iCloud synchronization, relevant tasks, reminders, saved views, automation rules, integration-account metadata and preferences are synchronized through Apple services. Widgets and Apple Watch use app-generated task snapshots and commands to show and update your tasks.

Connecting Apple Reminders, Todoist, Google Tasks, Home Assistant, Habitica, a Lucid API provider, Nextcloud or a CalDAV server lets the app exchange the task data needed for that integration directly with the chosen service. Its operator controls that service's storage and retention. Credentials for these integrations are stored in Apple's Keychain; optional credential synchronization uses the app's existing iCloud Keychain setting. The separate Notion trial below does not synchronize its credentials or connection records through that setting.

Lucid requests system permissions when a feature needs them, for example Reminders, calendar access, notifications or location-based reminders. You can manage these permissions in system settings. Permission to access a device feature does not give the Lucid account server access to its data.

Apple Intelligence features use supported on-device models. Lucid does not send your task text to a Lucid-hosted AI service. Features depend on your device, operating system and Apple's availability requirements.

You can edit or delete your tasks in the app. Deletions affecting a connected service must synchronize successfully, and copies or backups held by Apple or that provider follow its own rules. Removing an integration or uninstalling Lucid is not a request to erase the provider's account.

Optional Notion integration

Notion is being introduced in stages. The connection-only trial does not read or change Notion tasks. In a build where task syncing is enabled, you must explicitly select each Notion data source before Lucid reads it. This does not enable cloud-hosted tasks or a web task interface.

A free Lucid account is required to protect Notion sign-in and renewal requests. You authorize Notion separately on each device and choose the content to share on Notion's authorization screen. The connection's configured permissions may include reading, updating and inserting content. Notion controls its own service and permissions under its applicable terms and privacy information.

When you select a Notion data source, Lucid reads its mapped task properties and sends your task creations, completions and edits directly between your device and Notion. Selected task data is cached only on that device; Lucid's account and connection servers do not receive task contents. Notion retains data under its own policy. Signing out pauses sync while cached tasks remain.

Lucid's separate connection service sends authorization codes or renewal credentials to Notion and temporarily processes the returned access and refresh credentials. It retains the relevant Notion user, workspace and connection identifiers, not the names, email fields or icons that Notion may also include in its response. The Lucid account API does not receive these Notion credentials. The connection service can read credentials while processing them; this is not end-to-end encryption against the Lucid server operator.

Your device saves its Notion credentials, bound account/session identifiers and recovery proofs in a device-only Keychain. An optional connection name you choose is stored there too; it is not sent to the connection service. These records are not synchronized through Lucid's iCloud settings. Connecting another device requires separate authorization, not copying a shared rotating token pair.

To recover an interrupted sign-in or renewal, the server keeps an encrypted pending credential result and its recovery key in protected, non-swapping host memory rather than ordinary disk storage. Retrieval expires no later than 24 hours after the provider request and never later than the bound Lucid session's expiry; repeated retrieval does not extend it. A successful device acknowledgement removes the pending result. Cancellation, confirmed session invalidation and expiry also trigger removal. Independent expiry cleanup runs even when the connection service is stopped, but host outages or operational failures can delay physical cleanup. A server reboot loses unfinished memory results and may require fresh Notion authorization.

The encrypted disk recovery ledger contains Lucid account/session/connection and Notion identifiers, operation identifiers and status, timestamps, generation numbers, deadlines and security hashes used to prevent reuse. It contains no Notion task content or stored access/refresh-token pair. Active records expire by the original bound Lucid session's expiry, at most 90 days, with earlier cleanup after cancellation or confirmed invalidation; operational failures can delay removal. Encrypted or hashed identifiers are not anonymous. Backup copies follow the separate rules below. Loss, corruption or an older restoration of this ledger or its key requires fresh Notion authorization for affected connections.

Signing out of Lucid or confirmed session revocation pauses Notion access on that device; it does not erase the saved device connection or revoke the Notion authorization. A new Lucid session may require fresh Notion authorization. A temporary network failure alone is not treated as revocation. Disconnect first removes usable credentials from the device connection once the app has verified your Lucid account, then requests server recovery-state cleanup. If cleanup is unconfirmed, the app keeps retry proofs unless you explicitly choose to forget them after a warning. Forgetting or removing a local record does not prove server cleanup or revoke access at Notion. A disconnected record can retain its private name and identifiers until you remove it.

Deleting a Lucid account invalidates its sessions. The connection service removes associated recovery records when it confirms that invalidation or when they expire; the account-deletion response is not an acknowledgement of immediate cross-service erasure. The device that receives confirmation of account deletion also removes that account's local Notion records, retrying if local cleanup fails. This is not a remote wipe of records held on other devices. These actions do not delete your Notion account or tasks and do not guarantee provider-wide revocation. You can also manage or remove the connection's access within Notion.

Diagnostics are your choice

Lucid's diagnostic recording is opt-in and stored on your device. It can include app version and build, device and operating-system information, timings, errors and technical details about synchronization, networking, iCloud, widgets and Watch communication. Recording automatically ends after seven days; the normal local log-retention window is seven days.

Diagnostic detail depends on the settings you select. If you explicitly include content, records or exports may contain task or service content. Credential redaction is applied, but you should still review what you share. Lucid does not automatically upload these diagnostic bundles: you choose whether to export and send them, for example when asking for support. Copies you share are no longer controlled by the app's local cleanup.

Apple may separately process TestFlight feedback and crash information under its own terms and your Apple settings. This is distinct from Lucid's optional diagnostic recording.

Optional Lucid accounts

Lucid accounts are optional and part of the beta. Registration availability is shown in the app. Cloud-hosted tasks, a task web interface and task end-to-end encryption are not available.

Local tasks, integrations other than Notion and optional iCloud synchronization work without a Lucid account. The optional Notion integration requires a free account. When account registration is available, Sign in with Apple authenticates you. The app requests neither your name nor your email address from Apple. We store Apple's app-specific identifier, a separate Lucid account identifier, account status and timestamps, session identifiers or token hashes, session expiry and iOS/macOS platform information. Account records can also contain yearly beta-participation badges, recent beta status and account feature settings.

Each Lucid account has a unique username. You can choose or change it in the app; if you do not choose one, we assign a random username. We store it with your account. There is currently no public profile or username search.

To award beta badges automatically, Lucid sends Apple-signed app transaction information to its server, including app and transaction identifiers, app version, verification values and timestamps. We verify it and retain earned years, verification and expiry dates, and hashed values that limit reuse across accounts—not the raw signed transaction. Replay-protection hashes remain only while their evidence can be accepted, for up to 90 days after signing; newer signed evidence can renew this period. The Active badge normally lasts 30 days after verification and may expire sooner when its evidence expires. Badge history remains until account deletion. Existing deletion and backup-retention terms apply.

The account API does not collect task contents, connected-service credentials, a hardware identifier, precise location or an advertising identifier. It does not use your account for advertising or tracking across other companies' apps. The separate Notion connection service's credential handling is described above.

Lucid session credentials stay in a device-only Keychain and are not synchronized through iCloud. Apple authorization credentials needed for authentication checks and revocation are encrypted in the server database with a separate server key. The server can decrypt those service credentials; this is not end-to-end encryption.

Apple account-change notifications are used to update authorization and account state, including revocation and deletion. The account API retains the relevant event type, time and state, not incoming email fields. A verified tester badge does not by itself promise a paid tier or future entitlement.

Deleting an account and retention

You can request Lucid account deletion in the app after confirming your Apple identity again, or contact us about a privacy request. Once the deletion commits, account/profile information, sessions, badges and feature overrides are removed and Apple authorization revocation is queued. A connection error is not confirmation of deletion. Deleting a Lucid account does not erase your local, iCloud or connected-provider tasks.

Sessions have limited lifetimes: access tokens expire after 15 minutes, refresh sessions after 30 days of inactivity, and sessions have a 90-day absolute limit. Short-lived authentication challenges and retry records have separate expiry cleanup. Minimal security/deletion and processed-notification records normally expire after 35 days. Unfinished revocation or notification work remains until it can be processed; operational failures can delay cleanup.

Backups and restoration

Encrypted daily database backups retain approximately 30 days of history, plus version and storage-lifecycle processing delays. Deletion from backups is not immediate. A restoration must account for subsequent deletion requests before the restored service accepts traffic.

Separate full-server disk backups can contain account data, server credential/key files and Notion recovery metadata, including its on-disk encryption key. They are not covered by the database-backup exclusions. Under the protected-memory and disabled swap/crash-dump configuration, pending Notion credential results and their memory-held keys do not enter these disk backups. Automatic server backups use seven rolling slots; a new backup replaces the oldest once those slots are full. If backups stop, older copies can remain longer. We do not currently use manual full-server snapshots. Restored services must account for later deletion requests and require fresh Notion authorization where recovery state may be stale before admitting use.

Hosting, service providers and this website

Hetzner hosts this website, the account backend, the separate Notion connection service and the server/database backups described above. Apple supplies Sign in with Apple and the Apple services you choose to use. Your selected task providers receive the data needed for their integrations. These providers may process data under their own applicable terms, locations and transfer arrangements; choosing iCloud or another provider is separate from creating a Lucid account.

Network addresses are necessarily processed to deliver requests; the account and Notion connection services also use short-lived, in-memory rate limits for security. Lucid's API, connection service and web proxy do not enable request access logs or record authorization headers and request bodies. Limited operational error logs are retained in size-bounded rotation; the Notion service uses fixed outcomes without credentials, identities or task content. Hosting-provider infrastructure processing is separate.

This static website uses no cookies, analytics, advertising, forms, JavaScript or third-party fonts. Links to other sites only contact those sites when you follow them. The page is publicly accessible, with instructions asking search engines not to index it; these instructions are not access controls.

For those providers' own processing, see Apple's privacy information, Hetzner's privacy information and Notion's privacy information, as well as the policy of each other service you connect.

Purposes, choices and your rights

Data needed to provide the features you request is processed to provide that service (Article 6(1)(b) GDPR). Protecting the service against abuse and maintaining its security are legitimate interests (Article 6(1)(f)). Optional diagnostic recording is based on your consent (Article 6(1)(a)); you can stop it in the app. Withdrawing consent does not affect processing that was lawful before withdrawal. Information you choose to send with a support request is used to respond to that request.

Subject to the applicable legal conditions, you may request access, correction, erasure, restriction or portability of personal data, and object to processing based on legitimate interests. Contact info@lucidtodo.de; we may need information sufficient to verify your identity without collecting more than necessary. You may also complain to a competent data-protection supervisory authority, including where you live, work or believe an infringement occurred.

A Lucid account is not required by law or to use local tasks and integrations other than Notion. Account authentication data is needed if you choose account features, including the optional Notion connection trial. Lucid does not use automated decision-making that produces legal or similarly significant effects about you.

We will update this policy when relevant features or data practices change. The date at the top identifies this version.