What we can and cannot see.
LucinOS holds the most personal data a productivity app can hold — what you believe, what sets you off, how you cope. That deserves specifics rather than reassurance. Here is exactly how it works today.
Three things that are true right now
Each of these is a property of the code, checked before this page was written.
Your Inner Map and journal are read by no server-side code.
Your values, beliefs, principles, non-negotiables, strengths, emotional triggers and coping strategies — plus your journal, gratitude notes, decision journal and life events — are touched by no part of our backend. They sync so that you can reach them from any device you own. Nothing on our side opens them.
Lucian builds its picture of you on your device.
When you write to Lucian, your browser assembles the context — your map, your week, what you are working on — and sends it with the message. Our server never queries your data to write that prompt. It passes the message on and streams the answer back.
The app runs locally first.
Every screen renders against data already on your machine. Sync is a layer on top, not the thing the app depends on. LucinOS keeps working when the network does not.
What leaves your device, and where it goes
The complete list. If something is not here, it is not leaving.
Encrypted in transit. Each account is isolated at the database level.
Your message plus the context your browser assembled. Processed to answer you, not used to train models.
Audio, transcribed and then discarded.
The image, read once and discarded.
An automated pass pulls out product feedback — bugs, things missing — and we read those extracts. It also writes a private summary back into your own thread, which stays yours.
The error trace. Personal data is not attached to it.
Which page, nothing from inside it.
Your data sits in our database, which means that as the operator we could technically query it. We do not, and no code does. But “no code reads it” is a fact about how this is built, while “nobody could read it” would take encryption — and that has not shipped yet. When it does, this page will say so, and the difference will be real rather than a promise. We would rather be precise than reassuring.
What comes next
End-to-end encryption for the personal half
Your journal, Inner Map, gratitude, decision journal, life events and conversations encrypted on your device before they ever sync. We stop being able to read them even in principle. Because nothing of ours reads them today, this costs you no features.
A recovery key
Encryption means a forgotten passphrase cannot be reset by us — that is the point of it. You will get a recovery key once, at setup, and be asked to keep it somewhere safe.
Download everything
Your entire account as files you keep. Ownership you can verify rather than take on trust.
Local-only mode
For anyone who would rather trade sync away entirely and keep a copy that never leaves the machine.