Privacy Policy

To do its job, Lucid Train reads files, runs commands, and builds context from the repository you point it at. All of this happens on your machine. When you use a cloud model, the relevant prompt and code context are sent from your machine directly to your chosen model provider (e.g. OpenRouter and the underlying vendor, or a self-hosted endpoint). Their handling of that data is governed by their own privacy policies. When you use local models via Ollama, no data leaves your device.

Signing in is needed only to license the desktop app; the command-line tool does not require an account. When you sign in with Google, we store your account email, name, and profile picture to identify your account, and an identifier for each machine you activate so we can enforce the three-device limit. That identifier is a hash, not your hardware serial. We do not host models and do not proxy your prompts, so no prompt, code, or model output reaches our servers at all. Payments are handled by Dodo Payments, and we do not store your card details.

API keys you enter are written to your local Lucid Train configuration directory or the OS keychain, and used only to authenticate requests to the corresponding provider. We neither receive nor store your keys.

On startup the Software may make a single network request to check whether a newer version is available. This request does not include any personal data or usage information beyond what is inherent to an HTTP request (such as your IP address, as seen by the package registry). You can disable it entirely by setting LUCID_NO_UPDATE_CHECK=1, or point it elsewhere with LUCID_UPDATE_URL.

This site is hosted on Vercel. Vercel may process standard server logs (including IP addresses) as a data processor; see Vercel's privacy documentation. We do not use third-party analytics, and we do not set tracking cookies.

Download buttons pass through /dl on this site before forwarding to the CDN, so we can count how many people download each build. That request records the platform and version, the referring page, the browser user-agent string, a timestamp, and any utm_ parameters or campaign token present in the link. It does not set a cookie, and nothing is added to or embedded in the file you download. The installer is byte-identical to the one linked from the published checksum.

If you arrived from an email we sent, the link carried an opaque token in the c parameter. It is a random identifier that maps to your entry in our outreach list; it is not your email address, and your address never appears in a URL. While you are on the site the token is held in sessionStorage so a later download click can be connected to the visit. It is scoped to that one browser tab and is discarded when the tab closes. Removing ?c= from the address bar, or opening the site directly, leaves nothing to record.

If we emailed you without prior contact, we obtained your business address from a public source, most often a page your employer publishes and indexed by Hunter.io, and the specific source is named in the footer of the message. We rely on legitimate interests (GDPR Art. 6(1)(f)) for business-to-business outreach. Every message carries a one-click unsubscribe, and opting out removes you permanently and immediately. You can also write to the address below to ask what we hold, correct it, or have it deleted.

None of the above applies to the desktop app or the CLI. Neither reports usage, prompts, code, file names, or analytics of any kind, and neither carries a campaign token. Website measurement and product telemetry are separate questions, and the answer to the second one remains none.

The Software is not directed to children under 13 and we do not knowingly collect their data.

We may update this policy; material changes will be reflected by a new effective date.

Privacy questions: arnab@lucidtrain.com.