Draft: this text will be legally reviewed before launch.
In short
Your dream journal stays on your iPhone. If you want, the app backs it up in your own iCloud space, encrypted so that neither we nor Apple can read it. An account is optional and contains only what sign-in needs. We show no ads, sell no data and use no tracking, neither in the app nor on this website.
Controller
Simpdi Media LLC
8 The Green, Ste R
Dover, Delaware 19901
United States
Email: support@finallylucid.app
Representative in the EU
Our representative in the European Union under Art. 27 GDPR is:
Simpdi Ltd.
Tassou Papadopoulou Ave. 173
8025 Paphos
Cyprus
Email: support@finallylucid.app
You can also contact our representative with any question about data protection.
What this policy covers
The Finally Lucid app for iPhone and this website, finallylucid.app.
What stays on your iPhone
The app stores your journal and your practice on your iPhone. We don't receive this data. It includes journal entries with text, title, tags, clarity, nightmare marker and voice recordings, your practice nights with technique, alarm and how quickly you fell back asleep, your progress in the program and settings such as your bedtime. The data is kept in the app's protected storage and is part of your iPhone backup if you use backups via iCloud or your computer. Apple's privacy policy applies to iCloud.
iCloud backup
When iCloud backup is on, Finally Lucid backs up entries, practice nights and settings at most once a day in your private iCloud space at Apple. The contents are encrypted on your iPhone, and the keys are kept in your iCloud Keychain. We have no access, and Apple can't read the contents either. Voice recordings and your account are not included. You can turn off the backup at any time in the settings.
Voice recordings
When you speak a dream, Finally Lucid records it and converts it into text with the speech recognition of iOS. Recognition runs only on your iPhone. Recording and text stay there until you delete them.
Face ID
For the lock, the app uses the face recognition of iOS. The app receives no biometric data, only the information whether unlocking worked.
Notifications and alarms
Reminders and alarms are scheduled on your iPhone. No data is sent to us.
Export and import
You create exported files yourself and decide yourself where to share them.
Account (optional)
You don't need an account. You can sign in with Apple, with Google or with email and password. We then store your email address, your name if you enter it or Apple or Google sends it, how you signed in, a user ID, and when you created the account and last signed in. We use this data only to provide your account (Art. 6(1)(b) GDPR). Without it we can't create an account, but you can use the whole app without one. Your dream entries stay on your iPhone even with an account.
Sign in with Apple
We receive from Apple an identifier that is valid only for this app and, if you choose, your name and email address, also as a hidden address. Apple's privacy policy applies to the sign-in itself.
Sign in with Google
Sign-in runs through a secure Google page. We never see your Google password. We receive an identifier, your name and your email address, but no access to other Google services. Google's privacy policy applies to the sign-in itself.
Account with email and password
We store your email address and an irreversible check value (hash) of your password, never the password itself. When you set a password, Supabase checks whether it appears in known data leaks. Only a short part of a check value leaves the server for this, never the password.
We send emails only about your account: to confirm your address, to reset your password and to tell you about changes such as a new password. A sending service delivers them on our behalf. We send no advertising and don't measure whether you open emails or tap links.
Secure sign-in
When you sign in, Supabase processes your IP address and technical details about the app and your device. We use them to secure sign-in, manage sessions and limit abuse, such as too many attempts from one address (Art. 6(1)(f) GDPR).
Account provider
We manage accounts with Supabase (Supabase Pte. Ltd., 65 Chulia Street #38-02/03, OCBC Centre, Singapore 049513). The account data is stored on servers in Frankfurt am Main, Germany. We have concluded a data processing agreement with Supabase. It contains the EU Standard Contractual Clauses for the case that data is processed outside the EU. Supabase lists the service providers it uses itself in its list of subprocessors.
Purchases
Purchases and subscriptions run through the App Store, and Apple handles payment. We don't receive any payment data. The app only learns from Apple whether a purchase is valid. Purchases are not linked to your account. We see sales only as totals in App Store Connect, without names.
Crash reports and statistics from Apple
If you allowed sharing analytics with app developers in your iPhone settings, Apple provides us with crash reports and aggregated figures, such as how many devices use the app. They don't tell us who you are.
This website
The website is hosted by Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA. Cloudflare delivers the pages and protects them against attacks. We have a data processing agreement with Cloudflare.
When you visit a page, Cloudflare processes technically necessary data: your IP address, the time, the address you requested, browser and operating system. Without this data the site can't be delivered securely (Art. 6(1)(f) GDPR). We ourselves receive no logs with IP addresses, only aggregated figures such as the number of visits.
Cloudflare also processes data in the US. Cloudflare is certified under the EU-U.S. Data Privacy Framework. For certified companies, the European Commission has found an adequate level of data protection (Art. 45 GDPR).
The website sets no cookies and uses no analytics tools. Fonts, images and scripts come from this website itself, not from third parties. Only if Cloudflare considers a request an attack can it show a security check and set a technically necessary cookie for it.
When you write to us
When you email us, we use your address and your message to reply (Art. 6(1)(b) and (f) GDPR). Our mailbox is hosted by an email provider that receives and stores messages on our behalf. We delete the message once the request is settled and no retention obligation applies.
Who receives data
We don't sell data and don't pass it on for advertising. Data goes only to the service providers named in this policy, who work on our behalf, and, if you use them, to Apple and Google as sign-in services. We disclose data to authorities only if a law requires us to.
Countries outside the EU
Simpdi Media LLC and Cloudflare are based in the US, Supabase in Singapore. The account data is stored on servers in Frankfurt. When data from the EU reaches a country outside the EU, we rely on an adequacy decision of the European Commission, such as the one on the EU-U.S. Data Privacy Framework, or on the EU Standard Contractual Clauses (Art. 45 and 46 GDPR).
How long we keep data
We keep data only as long as we need it:
- Journal, practice nights and settings: on your iPhone until you delete them in the app or remove the app
- iCloud backup: in your iCloud space until you delete it there
- Account: until you delete it, in the app or by email
- Emails to us: until the request is settled, unless a law requires us to keep them longer
- Security logs: only as long as needed for security and troubleshooting
Your rights
You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and objection (Art. 21). To use them, email support@finallylucid.app. You can also delete your account yourself in the app.
Your right to object
Where we process data based on our legitimate interest (Art. 6(1)(f) GDPR), you can object at any time on grounds relating to your particular situation (Art. 21 GDPR). We then stop processing this data, unless we have compelling grounds that override your interests or need it to establish, exercise or defend legal claims.
Complaints
You can lodge a complaint with a data protection supervisory authority, for example the one in your country (Art. 77 GDPR).
If you live in the US
We don't sell or share your personal information, including as defined by the privacy laws of California and other US states. You can request access or deletion by email in the same way.
Children
Finally Lucid is meant for people aged 16 and over. We don't knowingly collect data from children under 16.
No automated decisions
We make no decisions based solely on automated processing and don't create profiles (Art. 22 GDPR).
Changes
We update this policy when the app, the website or the law changes. The date below shows the current version.
Last updated: 4 November 2026