Privacy Policy

We use the information we collect to:

• • Provide, maintain, and improve our Services
• • Create and manage your account
• • Process transactions and send related information
• • Personalize your LUKi companion experience
• • Maintain your conversation history and memories
• • Send you technical notices, security alerts, and support messages
• • Respond to your comments, questions, and customer service requests
• • Monitor and analyze usage trends to improve user experience
• • Detect, prevent, and address technical issues and fraudulent activity
• • Comply with legal obligations

Legal Basis (GDPR): We process your data based on: (a) your consent, (b) performance of our contract with you, (c) our legitimate business interests, and (d) compliance with legal obligations.

We may share your information only in the following limited circumstances:

• Service Providers: Trusted third parties who assist in operating our Services:
  • - Supabase (database, authentication, file storage)
  • - Stripe (payment processing on web)
  • - RevenueCat (subscription state and entitlement management on mobile)
  • - Vercel (hosting infrastructure)
  • - Cloudflare (bot protection via Turnstile)
  • - Resend (transactional email delivery through the Supabase Auth SMTP relay: password reset and email confirmation)
  • - Apple (Sign in with Apple OAuth, and speech-to-text on iOS. The system uses on-device recognition or Apple's network service depending on your language, and we receive only the final transcript, never the audio.)
  • - Google (Sign in with Google OAuth on mobile, and speech-to-text on Android. The system uses on-device recognition or Google's network service depending on your language, and we receive only the final transcript, never the audio.)
  • - Expo Push Service, APNs (Apple), FCM (Google): push notification delivery on mobile
  • - PostHog (product analytics), only when you have explicitly opted in via cookie preferences AND your browser does not assert a Global Privacy Control signal
  • - Sentry (crash and performance diagnostics in the mobile apps, stored in the European Union in Frankfurt). Account IDs, email addresses and request parameters are removed on your device before a report is sent, Sentry does not store IP addresses, and we never attach your account to a crash report. You can turn it off in Settings, under Privacy, with Help Improve LUKi.
  • - First-party product analytics: we record a limited set of in-app events on our own servers (Supabase) to understand activation and retention, for example completing onboarding, sending a first message, or viewing an upgrade screen. These events are linked to your account ID and contain no message content.
• Legal Requirements: When required by law, court order, or governmental authority
• Safety: To protect the rights, property, or safety of LUKi, our users, or others
• Business Transfers: In connection with a merger, acquisition, or sale of assets
• With Your Consent: When you explicitly authorize us to share information

Crisis signals in your messages

LUKi reads each message you send so it can reply. As part of that, an automated check looks for language suggesting you may be in danger, such as talk of suicide or self-harm. When the signal is strong, LUKi includes crisis helpline details in its reply, matched to the language you are using.

This check is automatic and runs as you send. It produces no diagnosis and no health assessment. It creates no score, label or profile that we keep, and we store nothing from it against your account. No employee reviews it. No other user sees it. It plays no part in advertising and is never used to train any AI model. It makes no decision about you and has no legal or similarly significant effect on you.

Because its purpose is to protect life, you cannot switch this check off.

Our lawful basis is your vital interests and the vital interests of others, under UK and EU GDPR Articles 6(1)(d) and 9(2)(c), supported by our legitimate interest in running a safe service.

Weekly Insight

Weekly Insight is optional. LUKi writes one only when you open the Insights screen, and only when you have saved at least three memories in the past seven days. If you never open that screen, none is ever created.

When you ask for one, LUKi reads up to 25 of your recent saved memories. It does not read your full conversation history. It returns up to three short observations, an optional closing sentence, and one overall sense of your week recorded as "brighter", "steady" or "quieter". We save that in your account so you can read it again.

This is a companion reflection, not a health assessment. LUKi is instructed never to diagnose, never to assess health, and never to mention symptoms, disorders, therapy or treatment. What we save is never used for advertising, never sold, and never used to train any AI model.

You can turn Weekly Insight off in Settings at any time. LUKi then writes no new reflections, and the ones already written stay in your account. Each reflection is written from your saved memories, so a memory you delete on the Memory screen stays out of every reflection written after that. Deleting your account deletes all your reflections.

Our lawful basis is your consent. You give it by opening Insights and asking for a reflection, and you can withdraw it at any time in Settings.

Sensitive information you choose to share

You decide what you tell LUKi. People sometimes share things that data protection law treats as special category data, such as health, religious belief, political opinion or sexual orientation.

We never ask for that information and we have no field designed to collect it. When you choose to share it, we handle it as part of your conversation and your memories, under the protections described in this policy. Our lawful basis is your explicit consent, given by choosing to share it. You can delete any memory at any time, and you can delete your account.

We implement robust security measures to protect your information:

• • Encryption in Transit: All data transmitted using TLS/HTTPS encryption
• • Encryption at Rest: Data is encrypted at rest by our database provider. Your saved memories carry an additional layer of encryption applied by LUKi.
• • Wallet-Derived Encryption: Optionally derive the key for your saved memories from your crypto wallet
• • Secure Password Storage: Passwords hashed using industry-standard algorithms
• • Access Controls: Strict authentication and authorization protocols
• • Regular Audits: Periodic security assessments and vulnerability testing

Depending on your location, you have the following rights regarding your personal data:

• Access: Request a copy of the personal data we hold about you
• Correction: Request correction of inaccurate or incomplete data
• Deletion: Request deletion of your personal data ("right to be forgotten")
• Portability: Receive your data in a structured, machine-readable format
• Objection: Object to processing of your data for certain purposes
• Restriction: Request limitation of processing in certain circumstances
• Withdraw Consent: Withdraw consent where processing is based on consent

To exercise these rights, please contact us at privacy@luki-ai.app. We will respond within 30 days.

We retain your information for as long as:

• • Your account is active
• • Necessary to provide you with our Services
• • Required to comply with legal obligations
• • Needed to resolve disputes or enforce agreements

When you delete your account, we will delete or anonymize your personal data within 30 days, except where we are required to retain certain information for legal, tax, or audit purposes.

Your information may be transferred to and processed in countries other than your own, including the United States and countries in the European Economic Area. We ensure appropriate safeguards are in place, including Standard Contractual Clauses approved by the European Commission, to protect your data in accordance with this Privacy Policy.

LUKi is not intended for users under 13 years of age (or 16 in the EU). We do not knowingly collect personal information from children. If we learn that we have collected personal data from a child without parental consent, we will delete that information promptly. If you believe we may have collected information from a child, please contact us.

We may update this Privacy Policy from time to time. When we make material changes, we will notify you by updating the "Last Updated" date and, where required, provide additional notice (such as via email or a prominent notice on our Services). Your continued use of our Services after changes become effective constitutes acceptance of the revised policy.

If you have questions about this Privacy Policy or our privacy practices, please contact us: