Privacy policy

1.Who is responsible

The controller responsible for your personal data under the General Data Protection Regulation (GDPR) is the operator of Luciai Studio:

as named in our imprint.

For anything about your data, write to adeel.ahm1985@gmail.com.

2.What we process, and why

Visiting this website

When you open a page, your browser sends your IP address and technical details such as the browser type and the page requested. Our hosting provider, Vercel, processes them to deliver the page, keep the service secure and fend off abuse, and keeps them in short-lived logs. We use no analytics or tracking tools on the website. Legal basis: our legitimate interest in a secure, working website (Art. 6(1)(f) GDPR).

Your account

When you create an account, we process your email address, your first name and — if you give it — your last name, your password, when you accepted which version of our terms, whether you want product news, and any profile details you add later. We confirm your email address with a link we send you.

Your account is kept in our own database. Your password is stored only as a salted hash (scrypt), never in plain text or in any form that can be turned back into it; if you use two-step sign-in, the key of your authenticator app is stored encrypted. Legal basis: our contract with you (Art. 6(1)(b) GDPR).

Signing in and security

When you sign in, we record the time, your IP address, your browser's user agent and whether the sign-in succeeded. For each session we keep the same details and when it was last used. This protects your account — for example against attempts to guess your password. Legal basis: our legitimate interest in keeping accounts secure (Art. 6(1)(f) GDPR).

Licenses and devices

We issue your license keys and keep them with your account: the key, its plan, the email address it was issued to, its dates and status, and a history of what happened to it — for example when it was issued, emailed, activated, renewed or replaced by a key without an end date.

When Luciai Studio starts for the first time on a computer, it asks for that computer's free month — no account, no email address; and when it activates a key on a device, the same. Each time it sends a machine identifier, which we store only as a salted hash, together with the device's name, operating system and version, processor architecture and app version; the free month is recorded with that computer, so that each computer gets it once. We record when the key was activated and last checked on each device. This is how your plan's device limit works, and how you can see and free your devices in your account. Legal basis: our contract with you (Art. 6(1)(b) GDPR).

Emails

We send you the emails that belong to your account: address confirmation, your license keys and changes to them, reminders before a key ends, password resets, and answers and updates about requests you made. We send them through Mailjet, and keep a log of each email with its content and the delivery status Mailjet reports back — for example delivered or bounced; we do not track whether you open an email or click its links — so that we can check that an email arrived and send it again if needed. Legal basis: our contract with you (Art. 6(1)(b) GDPR) and our legitimate interest in reliable delivery (Art. 6(1)(f) GDPR).

If you asked for product news, we also send you that. You can withdraw this consent at any time, with the unsubscribe link in those emails or by writing to us. Legal basis: your consent (Art. 6(1)(a) GDPR).

Support, feedback, reviews and feature requests

When you contact support or send feedback, we keep your messages, our replies and the details you give us, to help you and to improve the product. Reviews you write are published on the website only after we check them, and only with your first name. Feature requests are shown publicly with their votes, without your name; we keep who voted, so that everyone votes once. Legal basis: our contract with you (Art. 6(1)(b) GDPR); for published reviews, your consent (Art. 6(1)(a) GDPR).

Anonymous usage statistics from Luciai Studio

Unless you switch them off, Luciai Studio sends us which features are used and how long some actions take; errors and crashes with their type, a redacted message and the stack trace; and the app version, operating system and version, processor architecture and language setting. A random installation ID, made on your computer, lets us count installations; we store it only as a hash. We do not store your IP address with these statistics.

They never contain code, file contents, file names, paths, email addresses or tokens; error messages are redacted before they are stored. The statistics are on by default, Luciai Studio tells you so on its first start, and one switch in its Settings turns them off. Legal basis: our legitimate interest in finding errors and improving the product (Art. 6(1)(f) GDPR); switching them off is your objection, and takes effect at once.

Your code, and the AI models you use

Luciai Studio sends your code and prompts only to the model provider you choose, directly from your computer. We are not involved and never receive them. With a local model through Ollama, nothing leaves your computer; with a cloud provider, or with Claude Code or Codex, that provider's own terms and privacy policy apply. Your API keys stay in your operating system's credential store.

Buying me a coffee

Luciai Studio is free. If you buy me a coffee, you pay on Buy Me a Coffee's website, and Buy Me a Coffee processes the payment: it receives your payment details, under its own terms and privacy policy. We never see your card or bank details.

From Buy Me a Coffee we receive the name, email address and message you give there and the amount. We keep them as the record of what we received; a coffee changes nothing about your account. Legal basis: our legitimate interest in a record of what we receive (Art. 6(1)(f) GDPR).

3.Cookies and local storage

This website uses no tracking, analytics or advertising cookies, and no cookie banner is needed for what it does use: only what is strictly necessary for a service you asked for.

You sign in on this website itself: no other service sets cookies for it. The theme choice is stored only when you pick a theme yourself.

4.Who helps us, and who receives data

These service providers process personal data on our behalf, bound by data processing agreements (Art. 28 GDPR) and only as we instruct:

• Vercel Inc. (United States) hosts this website. The servers that run it are in Frankfurt, Germany; its pages are delivered through Vercel's worldwide network.
• Mailjet (France) delivers our emails.
• Neon Inc. (United States) runs our database, on servers in Frankfurt, Germany.

Buy Me a Coffee, where you can buy me a coffee, is not one of them: you give it your payment details yourself, it handles the payment under its own terms and privacy policy, and it passes us only what is listed above under “Buying me a coffee”.

We do not sell your data and do not share it for advertising. We pass it to authorities only where the law obliges us to. The AI providers you choose in Luciai Studio receive your prompts and code from you directly — not from us.

5.Transfers outside the EU

Vercel and Neon are based in the United States. Our database and the servers that run our services are in Frankfurt, Germany; where personal data is nevertheless transferred to the United States — for example when Vercel delivers pages through its worldwide network — the transfer rests on the EU–US Data Privacy Framework where the recipient is certified under it, and otherwise on the European Commission's Standard Contractual Clauses.

6.How long we keep data

• Your account, licenses and devices: as long as your account exists. When it is deleted, we delete or anonymize them, except what the law requires us to keep.
• Records of coffees from Buy Me a Coffee: as long as we need them as the record of what we received, and longer only where the law requires us to keep them.
• Sign-in records and the email log: as long as needed to protect your account and to show that emails reached you, and no longer than your account exists.
• Support messages and feedback: as long as needed to handle your request and questions that follow from it.
• Usage statistics: individual events for 90 days, and error and crash reports for 180 days. After that, only daily totals remain, which relate to no installation.
• Website logs: briefly, at Vercel, under its retention rules.

7.Your rights

Under the GDPR, you have the right to:

• get a copy of the personal data we hold about you (Art. 15);
• have incorrect data corrected (Art. 16);
• have your data deleted (Art. 17) or its processing restricted (Art. 18);
• receive the data you gave us in a machine-readable format (Art. 20);
• object at any time to processing based on our legitimate interests (Art. 21) — for usage statistics, the switch in Luciai Studio's Settings does this at once;
• withdraw a consent at any time, for the future (Art. 7(3));
• lodge a complaint with a data protection supervisory authority, in particular in the EU country where you live or work (Art. 77).

To use these rights, write to adeel.ahm1985@gmail.com. We may ask you to confirm your identity first, and we answer within one month.

8.How we protect your data

Among other measures: connections are encrypted (HTTPS); the session cookie is encrypted and cannot be read by scripts; passwords exist only as salted hashes, and authenticator keys only encrypted; sign-in sessions, email links and installation IDs are stored only as hashes, and device identifiers only as salted hashes; and access to our admin tools is limited by role and recorded in an audit log.

9.Children

Luciai Studio is a tool for software developers and is not directed at children. You must be at least 16 years old to create an account.

10.Changes to this policy

We update this policy when what we do changes; the date at the top shows the current version. If a change affects you significantly, we tell you by email before it takes effect. The privacy page in our docs explains the same facts in a shorter, practical form.