Lucy: Privacy Policy
Last updated: 9 October 2026
Lucy is an AI wellness companion built as part of a master's thesis project at Nova SBE (Nova School of Business and Economics, Lisbon). This policy explains what data Lucy collects, why, who processes it, how long it's kept, and how you can see or delete it.
Who is responsible (data controller): Indigo Gibbons, master's student at Nova SBE and the developer of Lucy. Contact: privacy@chatwithlucy.com. Lucy is an independent project; the developer alone decides how your data is used.
1. Lucy is an AI
Lucy is an AI, not a person, a therapist or a medical service. In a crisis, contact emergency services (112 in Portugal) or the services shown in the app.
2. What we collect and why
| Data | Why | Where it's kept |
|---|---|---|
| Email address | Sign-in with a one-time code | Our database (Supabase) |
| First name, pronouns (optional), timezone | So Lucy can talk to you and know your time of day | Our database |
| Setup answers: focus areas, reminder preference and time, how Lucy holds you accountable | To tailor Lucy | Our database |
| Your chat messages and Lucy's replies | The conversation itself; Lucy uses today's chat, and can search earlier chats | Our database |
| Notes Lucy saves about you ("memories") | So Lucy remembers what matters to you | Our database |
| Goals, milestones, progress logs, focus sessions | The goals features | Our database |
| Daily moods (with time) | Lucy's tone, and your weekly recap | Our database |
| Rewards: XP, level, streak, badges, theme | The rewards features | Our database |
| Feedback: what you send in "Send feedback", ideas you ask Lucy to pass on, your answer to "what would you love me to do?", and thumbs up/down on Lucy's messages, with date, app version and the screen it came from | To improve the app | Our database |
| Usage records of the AI: number of tokens and cost per day (no message content) | To keep costs in check | Our database |
| Apple Health (only if you connect it): steps, workouts, last night's sleep | So Lucy can notice progress and tick off movement goals | Not stored. A short summary is sent with your messages and used only for that reply |
| Spoken messages (only if you use voice mode): what you say is turned into text on your phone by Apple's on-device speech recognition; the text is saved as a normal chat message marked as spoken. Per conversation: when it started, how long it lasted, how many turns, how many characters were spoken, and why it ended (no text, no audio) | The voice conversation feature, its daily limit, and (if you opted in to research) counts of spoken and typed messages | Our database. Your voice is never recorded, stored or sent anywhere. |
| Live voice (only if you use it): your voice as live audio for the length of a call, sent to our voice partners. We never record or store it; what you say becomes text (a normal chat message marked as spoken). Per call: when it started, how long, how many turns and why it ended (no audio) | The live voice conversation feature and its daily limit | Audio is not stored. It goes to LiveKit (EU) and Deepgram (section 3), the text is saved in our database |
| Reminders and the focus-timer alert | Notifications you asked for | Only on your phone (scheduled locally) |
| Circles (only if you join one): your name in the circle, the goals you choose to share (title, done today, last 7 days, streak), your level (unless you switch it off), cheers, blocks and reports | So friends you invite can cheer each other on | Our database. Visible to the members of your circle: only the shared goals, never chats, moods, health data, misses or XP |
| Answers to Lucy's check-in after a difficult moment | Safety, and research if you opted in | Our database |
Some of this is information about your health and wellbeing, and things you share can be sensitive in other ways too: see 2a. We only process it with your explicit consent, given in the app before your first chat (and separately for Apple Health).
We don't use your data for advertising, don't sell it, and don't use tracking.
2a. Sensitive information, and information about other people
Sensitive information. Lucy is a wellbeing companion, so what you share with her often includes information about your health, for example your mood, sleep, stress, or mental and physical health. You may also mention things that reveal other sensitive information, such as your relationships (which can reveal your sexual orientation), religious or philosophical beliefs, ethnic origin or political opinions. European data protection law (GDPR, Article 9) treats these as special categories of personal data.
We process this information only to support you in the app, and only with your explicit consent, which you give separately before your first chat. You can withdraw it at any time (see "Your choices").
Where it can appear:
- Your chat messages and Lucy's replies (stored in our database; recent messages are sent to Anthropic to generate replies, see section 3).
- Notes Lucy saves about you ("memories"). Lucy saves short notes about things that matter across days: people in your life, projects, work or study, routines, preferences and upcoming events. She doesn't save passing states (like being tired today), never guesses at diagnoses, and never saves anything from a conversation in which you were in crisis.
- Daily moods you log, answers to Lucy's check-in after a difficult moment, and feedback you choose to write.
Apple Health data is never stored (section 2).
Your choices:
- Remembering sensitive details is off unless you turn it on. While it's off, Lucy doesn't save notes about health or other sensitive topics: each note she wants to save is first checked by an automatic AI step (run by Anthropic, like the chat) and dropped if it's sensitive. She can still talk about anything in the moment. Change it in Settings → Privacy. Turning it off doesn't delete notes saved before; you can delete those in Account → What Lucy knows about you.
- You can see every note Lucy has saved there, and delete any note, all notes, or your chat history at any time.
- Withdrawing your consent to sensitive information altogether means Lucy can't work as a wellbeing companion. You can delete your account and all its data in Account → Delete account.
Information about other people. When you talk about people in your life, Lucy may save short notes about them as part of your notes: their role (partner, sister, flatmate), sometimes a first name, and what you told her (e.g. "Has a sister, Ana"). These people don't use Lucy and haven't agreed to this. We keep these notes only to support you, store them like your other notes, never share them with anyone (including circles), and delete them with your notes or your account. Please share only what you're comfortable with about others. If someone wants information about them removed, they can contact us (see "Who is responsible") and we'll remove it.
2b. Legal bases (GDPR)
| What | Legal basis |
|---|---|
| Your account and the app's features | Necessary to provide the service you asked for (Art. 6(1)(b)) |
| Health and other sensitive information you share | Your explicit consent (Art. 9(2)(a)) |
| Lucy remembering sensitive details across days | Your separate, optional explicit consent (Art. 9(2)(a)) |
| Apple Health summaries | Your explicit consent (Art. 9(2)(a)), given separately |
| Voice mode (speech turned into text on your phone, and Lucy's replies spoken) | Your consent when you first turn it on (Art. 6(1)(a)); what you say is then handled like your typed messages |
| Live voice (your voice sent as live audio to our voice partners) | Your explicit consent, asked on your first tap (Art. 6(1)(a)); what you say is then handled like your typed messages |
| Research (section 4) | Your optional consent (Art. 6(1)(a) and 9(2)(a)) |
| Short notes about other people you mention | Our legitimate interest in supporting you (Art. 6(1)(f)). They're kept minimal (role, maybe a first name, what you said), private to you, never shared, and deleted with your notes |
| Backups | Legitimate interest in not losing your data (Art. 6(1)(f)) |
3. Who else processes your data
| Service | What they receive | Location |
|---|---|---|
| Anthropic (the AI behind Lucy) | Your recent messages and the context Lucy needs to reply (e.g. goals, notes, today's mood, the Apple Health summary if connected) | United States. Anthropic is our processor under its Data Processing Addendum, which includes the EU Standard Contractual Clauses for the transfer. It doesn't use this data to train its models and deletes it within 30 days, except messages its automated safety systems flag (kept up to 2 years). |
| Supabase (database, sign-in, server functions) | Everything listed as "our database" above | London, United Kingdom (eu-west-2). Supabase is our processor under its Data Processing Addendum |
| Expo (builds and app updates) | No personal data from the app's features. The app downloads updates from Expo's servers, which see technical data such as your IP address and device model | United States |
| Google Cloud Text-to-Speech (Lucy's spoken voice; only if you use voice mode) | The text of Lucy's replies that she speaks, one sentence or so at a time. Not your voice, not your name, not your account details | European Union (Google's EU endpoint). Google is our processor under the Google Cloud Data Processing Addendum. We have not turned on any logging of requests, and nothing from Google is stored in our database except counts |
| LiveKit (live voice connection; only if you use live voice) | Your voice as live audio while a call is on. It is not stored as audio. Also limited connection logs | European Union (a pinned EU region). LiveKit's own account and operational data is processed in the United States under its Data Processing Addendum with EU Standard Contractual Clauses |
| Deepgram (speech recognition; only if you use live voice) | Your voice as live audio, to turn it into text. We have opted out of Deepgram's model-improvement programme on every request. We never record or store your audio; Deepgram processes it only to provide the service | Deepgram's servers (where exactly is being confirmed with Deepgram in writing) |
| Open-Meteo (weather; only if you ask Lucy about the weather) | Only a place name (for example "Lisbon"), sent from our server. Not your name, your device or your IP address | Switzerland (an EU-recognised adequate country). Open-Meteo keeps technical logs of requests for a limited time; the weather data is licensed CC BY 4.0 and credited in the app |
Transfer to the United Kingdom. Our database is hosted by Supabase in London, United Kingdom. The UK is outside the EU, but the European Commission has decided that the UK provides an adequate level of data protection (an adequacy decision under Article 45 GDPR, renewed in December 2025 and valid until 2031), so no additional safeguards are needed for this transfer.
Sign-in emails (your email address and a one-time code) are sent by Resend, from its EU region (Ireland), as our processor.
3b. Voice (optional)
Voice mode is optional and starts only when you tap Talk and agree to the short explanation.
- What you say is turned into text on your phone with Apple's on-device speech recognition. The audio is never recorded, never leaves your phone, and is never sent to Apple's servers, to Google, or to us.
- The text of what you say is sent to Lucy like a typed message (to Anthropic, section 3), saved in your chat marked as spoken, and checked for signs that you may need support in exactly the same way.
- Lucy's voice: the text of her reply is sent to Google Cloud Text-to-Speech in the EU to make the audio, which plays on your phone and is not kept. We keep no recording.
- Limits and records: each day voice has its own limit (turns, minutes and spoken characters); we keep only counts per conversation (see section 2). For people who opted in to research, counts of spoken and typed messages and the length of voice conversations may be used (section 4); never the content.
- Crisis: if you say something that suggests you may be in crisis, the conversation ends and the support information appears, as for typed messages.
- Turn it off simply by not using it. Delete any message, or your whole account, as usual (section 6).
3c. Live voice (optional, beta)
Live voice is a second kind of voice conversation, where the microphone stays open and you can interrupt Lucy. It starts only when you tap Tap to talk and agree to a short explanation on your first tap. Unlike the voice in section 3b, your voice leaves your phone.
- In live voice your voice is processed as audio by two providers for the length of the call: LiveKit (the live connection, in the European Union) and Deepgram (which turns your speech into text).
- We never record or store your audio. Our voice partners process it only to provide the service.
- What you say is stored as text in your chat, like typed messages, and can be deleted the same way. It is checked for signs that you may need support in the same way as typed messages.
- Lucy's spoken replies are made from her words only, by Google Cloud Text-to-Speech in the EU.
- If a call mentions something that sounds like a crisis, the call ends and the same support information as in the chat is shown.
- The section on Anthropic and the chat is unchanged: they only ever see text.
- You can use typing, or the voice in section 3b, instead at any time.
3a. Circles
If you join a circle, the up to 4 other members see what's listed above, and nothing else. You can leave at any time (your shared goals disappear from the circle immediately), block someone, or report them; reports are reviewed within 24 hours by the developer (contact: see "Who is responsible"). If you delete your account, you leave your circle and everything about you is removed.
4. Research (optional)
Lucy is part of the developer's master's thesis. If you tick the optional research box during setup, pseudonymised data may be used in the thesis: your account is replaced by a code, so the thesis never shows who you are, but the developer can link the code back to your account (for example to delete your data if you withdraw).
What's used: your daily moods; goal progress; how often you open the app (retention); your thumbs up/down on Lucy's messages and the kind of message rated; the feedback you wrote; your answers to Lucy's check-in after a difficult moment (with the hours since); how many of your messages were spoken or typed and how long your voice conversations lasted (counts only); and, if you're in a circle, its size and how many goals you share.
Never used: your chat messages, Lucy's replies, or the notes Lucy saves about you. Results in the thesis are reported in aggregate. You can use Lucy fully without agreeing, and you can withdraw at any time by emailing privacy@chatwithlucy.com (a setting in the app is planned); your data is then removed from the research data.
The pseudonymised research data is exported before the accounts are deleted at the end of the study (section 5), and kept until 28 February 2027 at the latest, then deleted. Once the accounts are deleted, the codes can no longer be linked back to anyone.
5. How long we keep it
- Your data is kept while you have an account, and at the latest until 30 days after the study ends.
- The study is planned to run in October and November 2026. Within 30 days after it ends, all accounts and their data are deleted. The pseudonymised research data is kept until 28 February 2027 at the latest, then deleted (section 4).
- Test version: everything entered while Lucy is being tested is deleted before the study starts.
- Deleting a note, your chat history, or your account removes that data from our database right away (see section 6).
- Backups: the database is backed up every night into encrypted files kept for 30 days on the developer's computer, in the EU, and Supabase keeps daily backups for 7 days in London. So anything deleted is also gone from all backups within 30 days.
- Anthropic deletes the messages it processes for Lucy within 30 days (except messages its safety systems flag, see section 3).
6. Your rights and controls
In the app:
- Account → What Lucy knows about you: see every note and delete it. You can also remove it from your chat history, or delete your whole chat history.
- Account → Settings → Privacy: whether Lucy may remember sensitive details (off unless you turned it on).
- Account → Settings: change your answers, reminders, accountability style, and disconnect Apple Health (the iPhone permission itself: iPhone Settings → Health → Data Access & Devices → Lucy).
- Account → Delete account: permanently deletes your account and all data listed above from our database, right away. Reminders scheduled on your phone are removed too.
You also have the right to access, correct, and export your data, and to complain to a data protection authority (in Portugal: CNPD). Contact: privacy@chatwithlucy.com.
7. Age
Lucy is for people 18 and older. You confirm this during setup.
8. Changes
We'll update this policy when the app changes, and tell you in the app if the change is significant.