Privacy Policy

This comes first because it is the point of the design. Lucid has no server holding your record. There is no account to create, nothing to sync, and no copy of your drinking anywhere but the phone in your hand.

What you are tracking here is your own drinking — how much, on which days, when the cravings land, and the nights it went past the plan. That is sensitive by anyone's standards, and the most reliable way to keep it private is not to collect it. So we do not.

• 01The date your plan started, and the plan itself — how much you used to drink, on which days, and what it cost you.
• 02Every day you have logged: how many drinks, the allowance that day carried, and whether you marked it clear or slipped.
• 03Every craving you opened the breathing exercise for, and whether you rode it out.
• 04Which milestones you have earned, so the app does not celebrate the same one twice.
• 05Your first name, if you gave one, and the language and reminder time you chose.

All of it is written to your phone's own storage. The widget reads a small summary of it through an App Group, which is a shared folder between Lucid and its own widget on the same device — it does not leave the phone either. Deleting the app removes the lot; there is nothing left behind on our side because there was never anything on our side.

A record of how much someone drinks, and of the days they could not stop, is health information about a named person's body. Under Art. 9 of the GDPR that is special-category data and it deserves the strongest protection available.

The strongest protection available is not to have it. We do not process this data — not "we process it carefully". It never reaches us, so there is no Art. 9 condition for us to satisfy, no breach of ours that could expose it, and no subpoena we could answer with it.

Lucid is a paid subscription, and the one thing the app genuinely has to check over the network is whether yours is active. That check goes to RevenueCat, our subscription provider, and it carries a random identifier generated on your device. It is not your name, your email or your Apple ID, and it is not linked to anything you have logged.

Apple handles the payment itself. We never see your card, and we are never told who you are — a purchase reaches us as an anonymous identifier that is now entitled.

Once, on your first launch, Lucid asks our attribution provider which campaign the install came from. This is how we learn that an advert worked.

It sends four things: the anonymous subscription identifier described above, the platform ("ios"), your iOS version, and the two-letter code for the language your phone was set to. It sends nothing about your drinking, because at that moment you have not told the app anything about your drinking. The answer is a campaign code, which is stored against the same anonymous identifier so that a later purchase can be counted against the right advert.

It runs once per install and never again. If you would rather it did not run at all, deny the app network access on first launch or install from the App Store without following an advert link — nothing in the app depends on it.

Since version 1.1.0, Lucid sends anonymous usage events to PostHog, a product-analytics service run by PostHog Inc. on its US Cloud (us.i.posthog.com). They tell us where people stop during setup and whether the paywall works, so that we can improve the app. They are not used for advertising, they are not used to track you across other companies' apps or websites, and they are never sold.

An event can contain:

• 01Which setup screens you viewed and completed, in what order, how long each one took, and when you went back.
• 02When the paywall was shown and which plan you selected, and the outcome of a purchase or a restore: the product identifier, the period, whether it included a free trial, the price and the currency — or an error code if it failed.
• 03Whether you allowed notifications.
• 04When the app is opened or sent to the background, and when you reach the home screen.
• 05The app version, the language, the platform, and the basic device details the PostHog library adds on its own, such as the iOS version and the device model.
• 06A random identifier created when the app is installed. It is not your name, your email or your Apple ID. After a purchase it is linked to the anonymous RevenueCat identifier described above, so that a purchase can be joined to the steps that led to it, and RevenueCat stores the PostHog identifier for the same reason.

An event never contains your name, any answer you gave during setup (how much you drink, on which days, what it costs you, what sets it off, how you feel), anything you log, any health data, your contacts, your location beyond the approximate country PostHog works out from the connection's IP address, or your advertising identifier. Session recording and automatic capture of what is on screen are switched off.

PostHog keeps events for its standard retention period. Settings → Erase all data also resets the analytics identifier, so anything sent afterwards starts from a new random identifier and cannot be linked to what came before.

• 01Nothing you log, and no answer you gave during setup. The anonymous analytics described above record which screens are reached, never what is on them.
• 02No session recording and no capture of screen content.
• 03No advertising identifiers, no third-party ad SDKs, and no data sold or shared with data brokers.
• 04No contacts, photos, microphone, camera, health-app data or precise location.
• 05No email address and no password, because there is no account.
• 06No crash reporting service — a crash tells us nothing, because nothing reports it.

If you use iCloud Backup, your phone may include Lucid's local data in that backup. That is a copy held by Apple under your Apple ID and your control, governed by Apple's terms rather than ours. We cannot read it and we are not told it exists. Turning Lucid off in your iCloud backup settings stops it.

• 01What you log: for as long as the app is installed. Erase it whenever you like from Settings, or by deleting the app.
• 02Subscription records: held by RevenueCat and Apple for as long as their own retention and tax obligations require.
• 03Attribution: the campaign code stays attached to the anonymous identifier for as long as the subscription record does.
• 04Anonymous analytics events: held by PostHog for its standard retention period. Erasing your data in the app starts a new analytics identifier.
• 05Support emails: kept while we are dealing with your question, then deleted.

That is the complete list, and none of them receives anything about your drinking. Transfers outside the European Economic Area are covered by the Standard Contractual Clauses in our agreements with each provider.

• 01Performance of a contract (Art. 6(1)(b) GDPR) — running your subscription.
• 02Legitimate interests (Art. 6(1)(f) GDPR) — knowing which of our adverts brought an install, understanding through anonymous analytics where the app can be improved, and answering you if you write to support. You can object to any of these at the address below.
• 03Consent — notification permission, granted through the iOS prompt and revocable at any time in your phone's settings. Reminders are scheduled by the app on your device; we do not send push messages, because we have nothing to send them from.

Under the GDPR you have the right to access, correct, erase, restrict and port your personal data, and to object to processing based on legitimate interests. Here they are unusually easy to exercise:

• 01Access and portability: everything we could give you is already on your phone, in the app.
• 02Erasure: Settings → Erase all data, or delete the app. Both are immediate and neither asks us for permission. Erasing also resets the anonymous analytics identifier. Events already sent carry no name and stay with PostHog for its retention period; write to us if you want us to delete them.
• 03Everything else: write to us and we will do it.

Write to support@mirandanetwork.es. If you think we have handled your data badly you can complain to the Spanish data protection authority (AEPD) or to the authority where you live.

Lucid is for adults of legal drinking age and is not directed at children. We do not knowingly collect anything from anyone under 18 — which is easier than it sounds, given we do not knowingly collect anything from anyone.

If this policy changes we will update the date at the top and, where the change is significant, say so in the app. Continuing to use Lucid after a change means you accept the updated policy.

Miranda Network SL, Tenerife, Spain. Data protection enquiries: support@mirandanetwork.es.