Last updated · May 16, 2026

Privacy Policy

Lucilla is a private daily journal. This policy explains, in plain language, what personal data we collect when you use Lucilla, why we collect it, who can see it, and the rights you have over it. It is written to align with the EU General Data Protection Regulation (GDPR) and the UK GDPR.

1. Who we are

Lucilla (the "Service") is operated by the Lucilla team (the "data controller"). For any privacy question or to exercise the rights described below, contact us at privacy@pages.app.

2. What we collect

• Account data — your email address and (optionally) a display name, collected when you sign up.
• Journal content — the entries you write each day, with their date and timestamps.
• Weekly recaps — short AI-generated summaries derived from your entries.
• Authentication data — sign-in timestamps and a session token stored in your browser so you stay signed in.

We do not use third-party analytics, advertising trackers, or fingerprinting. We do not sell or share your personal data.

3. Why we use it (legal basis)

• Performance of a contract (Art. 6(1)(b) GDPR) — to give you the journal you signed up for: storing your entries, showing your streak, and signing you in.
• Legitimate interests (Art. 6(1)(f) GDPR) — to keep the Service secure (e.g. preventing abuse) and to generate the weekly recap that is core to the product.
• Consent (Art. 6(1)(a) GDPR) — for any optional communications you opt into. You can withdraw consent at any time.

4. Where your data lives

Your data is stored on managed Postgres infrastructure provided by Lovable Cloud inside the European Union. Weekly recaps are generated by language-model providers accessed through the Lovable AI Gateway; only the entries needed to produce a recap are sent, and providers are contractually prohibited from training models on your content.

5. How long we keep it

We keep your account and entries for as long as your account exists. When you delete your account from Settings → Account, your profile, entries, and roles are removed immediately, and the underlying authentication record is deleted with them. Backups rotate out within 30 days.

6. Your rights under GDPR

You have the right to:

• Access a copy of the personal data we hold about you (Art. 15).
• Rectify inaccurate data (Art. 16) — edit your display name in Settings.
• Erase your data (Art. 17) — the "Delete account" button in Settings does this in one step.
• Port your data (Art. 20) — the "Export my data" button returns everything as a JSON file.
• Restrict or object to processing (Art. 18, 21).
• Lodge a complaint with your local supervisory authority.

Most rights are self-service from Settings → Account. For anything else, email privacy@pages.app and we'll respond within 30 days.

7. Cookies

We use a single essential cookie / local-storage entry to keep you signed in. No analytics, advertising, or tracking cookies are set. Because the cookie is strictly necessary, no consent banner is required under ePrivacy.

8. Security

Data is encrypted in transit (TLS) and at rest. Row-level security policies in our database ensure one account cannot read another's entries. Administrative access is limited and audited.

9. Children

Lucilla is not intended for children under 16. If you believe a child has created an account, please contact us and we will delete it.

10. Changes to this policy

If we materially change how we handle your data, we'll update the date at the top of this page and, where appropriate, notify you by email.