Trust · Verified against the code

What we can and cannot see.

LucinOS holds the most personal data a productivity app can hold — what you believe, what sets you off, how you cope. That deserves specifics rather than reassurance. Here is exactly how it works today.

Three things that are true right now

Each of these is a property of the code, checked before this page was written.

01

Your Inner Map and journal are read by no server-side code.

Your values, beliefs, principles, non-negotiables, strengths, emotional triggers and coping strategies — plus your journal, gratitude notes, decision journal and life events — are touched by no part of our backend. They sync so that you can reach them from any device you own. Nothing on our side opens them.

02

Lucian builds its picture of you on your device.

When you write to Lucian, your browser assembles the context — your map, your week, what you are working on — and sends it with the message. Our server never queries your data to write that prompt. It passes the message on and streams the answer back.

03

The app runs locally first.

Every screen renders against data already on your machine. Sync is a layer on top, not the thing the app depends on. LucinOS keeps working when the network does not.

What leaves your device, and where it goes

The complete list. If something is not here, it is not leaving.

SyncYour account

Encrypted in transit. Each account is isolated at the database level.

A message to LucianAnthropic or OpenAI

Your message plus the context your browser assembled. Processed to answer you, not used to train models.

A voice noteOpenAI

Audio, transcribed and then discarded.

A photo of a written pageOur OCR provider

The image, read once and discarded.

The end of a conversationAnthropic, then our feedback table

An automated pass pulls out product feedback — bugs, things missing — and we read those extracts. It also writes a private summary back into your own thread, which stays yours.

A crashSentry

The error trace. Personal data is not attached to it.

A page viewVercel Analytics

Which page, nothing from inside it.

The one thing we will not claim

Your data sits in our database, which means that as the operator we could technically query it. We do not, and no code does. But “no code reads it” is a fact about how this is built, while “nobody could read it” would take encryption — and that has not shipped yet. When it does, this page will say so, and the difference will be real rather than a promise. We would rather be precise than reassuring.

What comes next

End-to-end encryption for the personal half

Your journal, Inner Map, gratitude, decision journal, life events and conversations encrypted on your device before they ever sync. We stop being able to read them even in principle. Because nothing of ours reads them today, this costs you no features.

A recovery key

Encryption means a forgotten passphrase cannot be reset by us — that is the point of it. You will get a recovery key once, at setup, and be asked to keep it somewhere safe.

Download everything

Your entire account as files you keep. Ownership you can verify rather than take on trust.

Local-only mode

For anyone who would rather trade sync away entirely and keep a copy that never leaves the machine.

Read the privacy policy