Privacy Policy

At a Glance

This summary is for convenience only and does not replace the full Policy below.

• What we collect: profile and goal information you give us, financial account data you choose to connect through Plaid, your interactions with our AI features, payment status information from Stripe, and, when active on our website, basic visitor analytics.
• What we do not do: we do not collect your bank account or routing numbers, we do not use your financial data to train AI models, we do not use analytics or advertising trackers inside the app, and we do not sell your personal information.
• Your control: you can disconnect any linked account, export your transaction history, and delete your account and associated data from within the app; deleted data is removed from our systems within hours, not months.

1. Information We Collect

1.1 Information You Provide

• Account information: your name, email address, and password (or your Google or Apple sign-in identifier if you use those options).
• Profile and onboarding information: information you enter during onboarding and in your profile, including your date of birth, household size, income type, housing status, target savings rate, financial knowledge level, and financial goals.
• Content you create: manually added assets or accounts, custom categories, goals, notes and tags on transactions, and the messages you send to our AI features (see Section 1.5).
• Communications: information you provide when you contact our support team by email.

1.2 Financial Information Connected Through Plaid

To provide our core features, we use Plaid Inc. ("Plaid") to let you securely connect your financial accounts. You enter your bank credentials directly with Plaid, never with Lucid, and we never see, receive, or store your bank login credentials.

Through Plaid we receive the following from the accounts you choose to link:

• Account information: account type, account name, the last four digits of the account number (masked), and the name of your financial institution.
• Balances: current and available balances.
• Transactions: amounts, dates, merchant names, categories, and descriptions, including identified recurring transactions and bills.
• Liabilities: credit card balances, interest rates, loan balances, and payment due dates.
• Investments (Pro plan only): holdings, positions, and investment transactions.

We do not request or receive your full bank account or routing numbers, and we do not request or receive bank-side identity information (such as the name, address, phone, or email held by your bank).

Connecting a financial account is always your choice. By completing the Plaid Link connection flow, you consent to Lucid's collection and processing of the financial account data described above. You may withdraw that consent at any time by disconnecting the account (Section 6).

Plaid collects and processes your information as described in the Plaid End User Privacy Policy. We encourage you to review it.

We store the financial data above in our secured database to provide the Service.

1.3 Payment Information

Payments for Lucid subscriptions and Lifetime Access are processed by Stripe, Inc. Stripe handles your payment card details directly; we never receive or store your card number, billing address, or payment credentials.

• Basic and Pro subscriptions: we receive subscription identifiers and status information from Stripe (such as your plan, renewal period, and whether your subscription is active) to activate and manage your plan. Your email address is provided to Stripe to create your customer record.
• Lifetime Access purchases (made through our website): we receive the purchaser's email address and purchase status from Stripe, which we use to match your purchase to your Lucid account.

If we offer billing through Apple In-App Purchase or Google Play Billing in the future, those payments would be processed by Apple or Google under their terms, and we would receive transaction identifiers and subscription status from them; we will update this Policy if that occurs.

1.4 Information Collected Automatically

We collect very little automatically. Within the mobile app, we record account timestamps such as your most recent login. We do not use analytics, crash-reporting, or advertising SDKs inside the app; we do not collect your device's advertising identifier (IDFA) or present app-tracking prompts; and we do not collect push-notification tokens.

Our application code does not collect or store IP addresses. Google Cloud, our hosting provider, records IP addresses transiently in its infrastructure and security logs as part of operating the platform; these logs are retained by Google for up to 30 days (longer for certain required audit logs) and are not used by Lucid to identify or profile you.

1.5 AI Feature Interactions

The Service includes AI-powered features: the AI Chat assistant (including contextual entry points throughout the app), insights, weekly and monthly recaps, budget generation, and AI-assisted planning tools. These features are powered by third-party AI providers (see Section 4).

When you use AI features, the following information is processed and, as applicable, transmitted to our AI providers to generate a response:

• the messages you type;
• profile context, such as your first name, age, household size, income type, housing status, target savings rate, and financial knowledge level;
• a summary of your financial picture, such as your total linked account balances and month-to-date spending;
• your recent transactions (for example, when generating insights about your spending);
• the content of the screen or card you launched the AI from (for example, your Financial Health Score and its components, or an account's name and balance); and
• recent conversation turns and relevant snippets of your past AI interactions, so the assistant has context.

Your email address and account credentials are never included in AI requests. See Section 4 for how our AI providers handle this information.

1.6 Company Access (Employer-Sponsored Plans)

For employer-sponsored plans, your employer may upload a roster or add employees individually using each employee's name and email address. Your employer may then provide you with a company join code, which you enter when signing up to associate your Lucid account with the sponsoring company.

Your employer cannot see your individual financial information, activation status, or app activity, ever. Your employer can see and manage only the roster information it provided, consisting of employee names and email addresses, including adding, deactivating, or removing an employee's eligibility for a sponsored seat. Your employer has no access to whether an individual employee has signed up, activated a seat, signed in, or used the app, and no access to any employee's linked accounts, balances, transactions, individual scores, AI conversations, or other activity within the app.

Lucid may provide your employer with aggregated and anonymized, team-level information, including overall participation and usage rates, Financial Health Score averages, Retirement Readiness Index averages, and changes in those team averages over time. These reports do not identify an individual employee, reveal whether a particular employee has signed up or used the app, display any employee's individual score, or disclose the financial information underlying those averages.

1.7 Information We Collect from Our Website

When you visit trylucidfinance.com, we use privacy-friendly analytics to understand how visitors interact with our website, including pages viewed, clicks, and general session activity, along with limited technical information such as browser type and device type. We use Vercel Analytics (provided by Vercel Inc.), which measures aggregate traffic without cookies and without identifying you individually, and PostHog (provided by PostHog Inc.) for product analytics, which we configure without advertising cookies. These providers process this information on our behalf as service providers and do not use it for their own advertising.

We do not run advertising cookies or advertising pixels on the Site, and we do not share your information with any advertising network. When you arrive from one of our marketing links, we may capture standard campaign parameters (UTM tags) and pass them into our checkout so we can measure which of our own efforts led to a purchase; this is first-party attribution, not advertising targeting. We never use your financial account data for analytics or advertising.

For more detail, see our Cookie Policy.

1.8 Categories of Personal Information

The table below summarizes the information described above using the categories defined by the California Consumer Privacy Act. We collect each category directly from you, from Plaid at your direction, or automatically (website only), and we retain each category as described in Section 6.

We collect sensitive personal information only with your consent and use it only to provide the Service you request. We do not use it to infer characteristics about you for advertising, and not for any purpose requiring a right to limit under California law.

We do not collect biometric information, health information, precise geolocation, government identification numbers, or education information.

2. How We Use Your Information

We use the information we collect to:

• provide and operate the Service, including net worth, cash-flow, spending, liabilities, and planning views;
• calculate your Financial Health Score and Retirement Readiness Index, which are generated by deterministic, rule-based logic and not by machine-learning models trained on your data;
• power the AI features described in Sections 1.5 and 4;
• process your purchases and manage your subscriptions and access entitlements;
• administer employer-sponsored plans, manage roster eligibility, associate employees with sponsoring companies through join codes, and produce the aggregated and anonymized reporting described in Section 1.6;
• respond to your support requests and send you transactional messages about your account;
• send you marketing communications you have signed up for, which you can opt out of at any time (Section 11);
• understand how visitors use our website and measure our own marketing;
• maintain the security, integrity, and proper functioning of the Service; and
• comply with legal obligations and enforce our Terms of Service.

We do not use your personal information for automated decision-making that produces legal or similarly significant effects. We use aggregated and anonymized information for the team-level employer reporting described in Section 1.6, maintain that information in deidentified form, and do not attempt to reidentify it.

3. How We Share Your Information

We do not sell your personal information, and we do not share your personal information for cross-context behavioral advertising. We do not run advertising cookies or advertising pixels, and we never share your financial data with any advertising network.

We share information only with service providers that help us operate the Service, and only as needed:

For employer-sponsored plans, sponsoring employers can access and manage the roster information they provided and receive only the aggregated and anonymized reporting described in Section 1.6. We do not disclose whether an individual employee has signed up, activated a seat, signed in, or used the app, and we do not disclose any employee's individual financial information, scores, AI conversations, or app activity.

We may also disclose information if required by law, to protect the rights, safety, or property of Lucid or others, to enforce our Terms, or in connection with a merger, acquisition, financing, or sale of assets, in which case we will require the recipient to honor this Policy.

We do not permit our service providers to use your personal information for their own purposes except as described in this Policy.

4. AI Features and Transparency

The Service's AI features are powered by third-party AI providers:

• Anthropic, PBC: large language models (Claude) generate AI Chat responses, insights, recaps, and budgets from the inputs described in Section 1.5. We use Anthropic's standard commercial API terms: Anthropic does not use data submitted through its commercial API to train its models, and may retain API inputs and outputs for a limited period for trust-and-safety purposes before deletion, as described in those terms.
• Google Vertex AI: converts the text of your AI interactions into numerical representations ("embeddings") that are stored in your account's private AI memory, so the assistant can recall relevant context from your past interactions. These embeddings are stored in our database, not Google's, and are deleted when you delete your account.

We do not use your personal or financial information to train, fine-tune, or improve any AI or machine-learning model, and we do not permit our AI providers to do so. Your Financial Health Score and Retirement Readiness Index are produced by fixed, rule-based calculations rather than by machine learning.

AI features provide educational information only, not financial, investment, tax, or legal advice. AI outputs may contain errors. See our Financial & AI Disclaimer for important limitations.

5. Financial Privacy (Gramm-Leach-Bliley Act)

To the extent Lucid is a "financial institution" under the federal Gramm-Leach-Bliley Act ("GLBA"), the nonpublic personal information we collect (such as the financial account data described in Section 1.2) is subject to GLBA's privacy and safeguarding requirements, and this Policy serves as our privacy notice.

• What we collect: the categories of nonpublic personal information described in Sections 1.1, 1.2, and 1.3.
• What we disclose: we do not disclose nonpublic personal information to nonaffiliated third parties for their own marketing or other independent use, and we have no affiliates with which we share it. We disclose it only to service providers that process it on our behalf under contractual confidentiality obligations (Section 3), and as permitted by law.
• Opt-out: because we do not share nonpublic personal information with nonaffiliated third parties outside the exceptions permitted by GLBA, no opt-out right is required, because there is nothing to opt out of.
• Safeguards: we maintain the administrative, technical, and physical safeguards described in Section 9.

6. Data Retention and Deletion

We retain your information for as long as your account is active and as needed to provide the Service, resolve disputes, and comply with legal obligations (for example, records of purchases are retained as required by tax law).

• Account deletion: You can delete your account from within the app. When you do, your data is deleted from our database immediately and our access to your connected financial accounts at Plaid is revoked. We do not maintain long-term backups of user data; any residual copies within our database infrastructure expire within approximately 24 hours of deletion.
• Disconnecting an account: You can disconnect any single linked account at any time, which removes that account's associated data and revokes our Plaid access for it.
• Exporting your data: You can export your transaction history as a CSV file from within the app. For a copy of other information in your account, contact us as described in Section 7.
• Employer-sponsored plans: If your employer's sponsorship ends, we notify you by email and your account remains active for a 30-day grace period, during which you can export your data and add a personal email address and password so you can keep signing in. If you take no action, your account converts to the Free plan at the end of the grace period. It is not deleted because your employer's sponsorship ended, and you can delete it yourself at any time.
• Billing records: Purchase and billing records held by our payment processor (Stripe) are retained under Stripe's terms and applicable tax and recordkeeping requirements, separately from the data in our database. These records do not include your card number, which we never receive.
• Marketing email addresses are retained until you unsubscribe or ask us to delete them. Website analytics data is retained by our analytics providers per their standard retention schedules.

7. Your Privacy Rights

We extend the following rights to all users, regardless of where you live, including rights provided under the California Consumer Privacy Act (CCPA/CPRA), the Utah Consumer Privacy Act, and the comprehensive privacy laws of other U.S. states:

• Access / Know: request confirmation that we process your personal information and a copy of it, including the categories collected, sources, purposes, and third parties with which it is shared.
• Correction: request correction of inaccurate personal information (you can edit most profile information directly in the app).
• Deletion: request deletion of your personal information (available directly in the app via account deletion).
• Portability: obtain your information in a portable format (transaction history is available in-app as CSV).
• Opt out of sale or sharing: we do not sell your personal information, and we do not share it for cross-context behavioral advertising, so there is nothing for you to opt out of. We do not run advertising cookies or pixels. If this ever changes, we will provide the required opt-out controls, including a "Do Not Sell or Share My Personal Information" link and honoring the Global Privacy Control (GPC) signal, before doing so.
• Limit use of sensitive personal information: we already use sensitive information (your financial data) only to provide the Service you request, so no separate limitation request is needed. Connecting an account through Plaid Link is your opt-in consent, which you may revoke at any time by disconnecting the account.
• Non-discrimination: we will never deny you the Service, charge you a different price, or provide a different quality of service for exercising your rights.

How to submit a request: use the in-app tools described above, or email us at support@trylucidfinance.com with the subject line "Privacy Request." We will verify your request by confirming control of the email address associated with your account, and we may ask for additional information where reasonably necessary to protect your account. An authorized agent may submit a request on your behalf with your signed permission; we will still verify your identity directly.

Timing: we will respond within 45 days, extendable once by an additional 45 days where reasonably necessary (we will tell you if we need the extension).

Appeals: if we decline your request, we will explain why, and you may appeal by replying to our decision within 60 days. We will respond to your appeal within 45 days. If you are unsatisfied with the outcome, you may contact your state Attorney General; California residents may contact the California Privacy Protection Agency.

8. Where Your Data Is Stored; International Users

Your information is stored and processed in the United States (our database and processing infrastructure are located in U.S. regions). The Service is intended for residents of the United States. If you access the Service from outside the U.S., you understand that your information will be transferred to and processed in the U.S., where privacy laws may differ from those of your jurisdiction.

9. Security

We use commercially reasonable administrative, technical, and physical safeguards to protect your information, including encryption of data in transit and at rest, strict server-side access controls that deny client access to sensitive records, and an app PIN protected as a salted hash on your device (in Apple Keychain on iOS or Android Keystore on Android) and on our servers, where it is inaccessible to client applications and verification is rate-limited. Because Lucid is read-only, we cannot move or transfer your funds. No method of transmission or storage is completely secure, and we cannot guarantee absolute security. If we become aware of a breach affecting your personal information, we will notify you and regulators as required by applicable law.

10. Children's Privacy

The Service is intended for adults. You must be at least 18 years old to use the Service; by creating an account, you represent that you are at least 18. We do not knowingly collect personal information from anyone under 18 (or under 13 in any circumstance, consistent with the Children's Online Privacy Protection Act). If you believe a minor has provided us information, contact us and we will delete it.

11. Marketing Communications

If you sign up for updates from us, we will send you emails about Lucid news, launches, and features. Every marketing email includes an unsubscribe link, and unsubscribing never affects transactional messages about your account (such as receipts, security notices, or responses to your requests). We do not send marketing text messages.

12. Changes to This Policy

We may update this Policy from time to time. We will revise the "Last Updated" date above, and if we make material changes, such as collecting new categories of information or sharing information in new ways, we will provide prominent notice within the Service or by email before the changes take effect. Material changes will not apply retroactively to information collected under a prior version without your consent. We review this Policy at least annually.

13. Contact Us

If you have questions about this Policy or your information, contact us at:

Lucid, LLC
2277 W 700 S, Suite 3
Springville, UT 84663
support@trylucidfinance.com