1. Who we are
"Luculent", "we" and "us" mean Luculent. Luculent is a standalone brand with no parent brand. Contact: privacy@luculent.app.
This policy covers the Luculent desktop app (Windows and Linux), the luculent CLI and luculentd connector, the web app, the website, the Luculent API, and the Luculent Browser Driver for AI Agents.
2. Local-first by default
Luculent runs on your computer. SOPs, checks, step state and the local audit trail are stored in a local SQLite database on your device. Local checks do not send data to Luculent by default when you are signed out; nothing leaves your machine except content-free usage telemetry you can preview and limit in Settings > Privacy.
The Luculent agent, built into the program, runs on the AI model you connect (your own provider account, or a free model through OpenRouter if you choose it). Requests from the Luculent agent go from your device to that provider under your account and that provider's terms. Luculent does not host a model for the Luculent agent, does not hold your model key on its servers, and does not see those requests. The Luculent agent can run fully locally with a local model.
3. Data we process
| Flow | What | When | Where it goes | Retention |
|---|---|---|---|---|
| Local storage | SOPs, checks, step state, local audit trail, settings | Always | Your device only (SQLite) | Until you delete it |
| Agent model requests | Your prompts and the context the agent sends | When you use the agent | Your chosen model provider (or OpenRouter), directly from your device | Provider's terms; Luculent stores none of it |
| Account and sign-in | Email address, name, sign-in provider ID (email link, Google or GitHub) | When you create an account | WorkOS (authentication) | Life of the account, plus a short period afterward as needed for security and records |
| Cloud sync (paid plans, optional) | SOPs, SOP groups, device records, pairing records, change feed, remote command audit trail, push tokens | When you turn on sync | Neon Postgres, isolated per tenant by row level security | Life of account; decision events and telemetry 1 year on cloud plans |
| Billing | Plan, seats, Stripe customer and subscription IDs; card details are entered on Stripe and never reach us | When you start a paid plan or a trial converts | Stripe | As required for tax and accounting |
| Tier A: Operational telemetry | Token counts, model id, provider, route, request type, estimated cost, sync health, errors (Essential); latency TTFT/total, retries, performance (Full). Account-linked (tenant and user id) for billing and the Usage page. | When signed in; can be restricted to Essential only | Cloudflare Workers Analytics Engine (raw), Neon Postgres (rollups) | Analytics Engine raw 3 months; rollups 24 months |
| Tier B: Product insights | Feature usage, connector setup, SOP review decisions, enforcement verdicts. Strictly content-free; rotating install id (no user id). Individual plans only; on outside EU/EEA/UK, opt-in in EU/EEA/UK; never from org workspaces. | When enabled on individual plans | Neon Postgres (region-pinned, US or EU) | Raw events at most 30 days; aggregates (k >= 50) rebuilt each run |
| Website analytics | Cookieless page views, referrers, and allowlisted UTM parameters (site.landing). No cookies, no local storage, no visitor ID, not linked to any account. | When visiting luculent.app or luculent.dev | Cloudflare Web Analytics, Luculent ingest | Cloudflare default, ingest rollups 24 months |
| Waitlist | Email, signup source, UTM tags, consent version, bot-check verdict | When you join the waitlist | Neon Postgres | Until launch, and for a reasonable period afterward, or until you ask us to delete it |
| Contact form | Name, email, message | When you send the form | Checked by Cloudflare Turnstile; current build does not store the message (it logs only message length) | Not stored, unless a later inbox integration is added, in which case we will update this policy |
| Bot protection | Turnstile token and verdict | Waitlist and contact forms | Cloudflare Turnstile | Cloudflare's terms |
| Hosting and logs | IP address, user agent, request path. Coarse country derived, IP discarded immediately. | Every web request | Cloudflare (website, web app, API) | Only as long as needed for security and operations |
| Crash reports (opt-in) | Error type, stack trace, app version, OS; scrubbed (see section 5) | Only if you turn on crash reports | Sentry | Only as long as needed to fix the error |
| Push notifications | Web push subscription (endpoint and keys) or mobile push token | When you allow notifications | Neon Postgres; delivery through the browser or OS push service | Until you revoke or sign out |
| Memory integration (optional) | Notes and recall data you choose to store | Only if you connect Hindsight | Your local Hindsight instance, or Hindsight Cloud under your own account | Your Hindsight settings |
| Transactional email | Email address, message type | Sign-in links, invites, waitlist and beta notices | Our email provider (planned: Resend) | As needed to deliver the message and handle bounces |
| Browser Driver navigation metadata (optional) | Structural navigation metadata only. See section 13. | When enabled, as described in section 13 | Luculent servers | Raw events at most 30 days; de-identified aggregates up to 24 months |
We do not sell personal data. We do not use your SOP content, prompts or code for advertising. We do not run advertising trackers or third-party ad cookies on the website.
4. Why we process it (legal bases)
- To provide the service you asked for: account, sync, billing, support, operational token telemetry, and the Browser Driver features you use.
- Your consent: product insights, crash reports, notifications, waitlist, and Browser Driver navigation metadata (required as an opt-in in the EU, EEA and UK).
- Legitimate interests: security, abuse prevention (Turnstile, rate limits), keeping the service running.
- Legal obligations: tax and accounting records.
5. Crash report scrubbing and privacy controls
Crash reports are off by default in the desktop app and CLI. Before a report leaves your device we remove: any line mentioning an SOP or a prompt, API keys and bearer tokens, email addresses, and your home folder path. The desktop app sends reports only when crash reports are turned on in its privacy settings.
Settings > Privacy lets you preview exact queued and sent events in plain language and raw JSON, filter by event type, toggle product insights, choose Full vs Essential operational telemetry, and download all stored events.
6. Subprocessors
| Subprocessor | Purpose | Data |
|---|---|---|
| Cloudflare | Hosting, CDN, Turnstile bot checks, Workers Analytics Engine | Request metadata, Turnstile tokens, Tier A operational time series |
| Neon | Cloud database for sync, waitlist, telemetry rollups | Sync data, waitlist entries, telemetry rollups and regional Tier B staging |
| WorkOS | Sign-in (email, Google, GitHub) | Account identity |
| Stripe | Payments and subscriptions | Billing data |
| Sentry | Opt-in crash reports | Scrubbed error data |
| Hindsight Cloud | Only if you connect it under your own account | Memory data you choose to store |
| Email provider (planned: Resend) | Transactional email | Email address, message |
Model providers you connect for the Luculent agent (and OpenRouter, if you choose it) are not our subprocessors. You contract with them directly.
7. Model training and evaluation on user content
Luculent collects redacted user content (including portions of prompts, documents, and SOP text) to train, fine-tune, and evaluate AI models. This data is stored in the content store for up to 24 months. You may opt-out of content collection for training at any time in Settings > Privacy, and you may request deletion or export of your content. Unredacted personal data and source code are never used for training.
This section does not apply to Browser Driver page content, which stays on your computer and is not used to train Luculent models. Optional Browser Driver navigation metadata, described in section 13, is structural only and contains no page text.
8. Your rights and choices
- Access, correct, export or delete your account data: email privacy@luculent.app or use account settings.
- GDPR and CCPA/CPRA requests, including opting out of data collection: privacy@luculent.app.
- Turn product insights off at any time in Settings > Privacy, or select "Go fully local" for immediate revocation and automated deletion within 30 days.
- Turn Browser Driver navigation metadata off at any time in the extension, as described in section 13.
- Local data stays under your control; uninstalling and deleting the local data folder removes it.
9. Security
Cloud data is isolated per tenant with Postgres row level security. Device tokens are stored only as SHA-256 hashes. Card data is handled by Stripe. We do not claim any security certification.
10. Children
Luculent is not directed at children under 13, and the Browser Driver is not directed at children under 13.
11. International transfers
We use subprocessors that may process data outside your country, including in the United States. If you need details of the transfer mechanism that applies to you, email privacy@luculent.app.
12. Changes
We will post changes here and update the date above. Material changes will be announced in the app, in the extension, or by email before they apply.
13. Luculent Browser Driver for AI Agents
The Luculent Browser Driver for AI Agents is a free Chrome extension that lets AI agents you run and authorise drive tabs in your browser. Agents connect through a relay program that runs on your own computer, and they authenticate with an API key you create. The extension uses Chrome's debugger access (chrome.debugger) so an agent can control a window you have allowed.
What the extension can access. Only pages an agent you authorised is driving, in tabs you granted or in tabs the agent opened itself. That can include the page's content and structure, its URL and title, form fields the agent fills, screenshots it is asked to take, and downloads it is asked to report.
What stays on your computer. Your security settings, the paired relay's identity, tab grants, the killswitch state, side-panel chat history, and a short activity log stay on your device. Page content the agent reads is sent only to the local relay on 127.0.0.1, and from there only to the agent that holds a valid API key you created. Luculent does not receive that page content.
Security controls. You choose what agents may do. By default, password fields are blocked, cookies and site storage are blocked, custom scripts are blocked, and file uploads and login or payment form submits ask you first. A built-in banking and payment block list (plus similar financial hosts) is on by default; agents cannot drive those sites unless you change that preset. Browser-internal pages and other extensions are never in reach. A killswitch stops every agent at once.
Optional navigation metadata, to make the driver better over time. If you leave this on (or, in the EU, EEA and UK, if you opt in), the extension may send Luculent a small amount of structural information about how agents navigate websites. This is how a small team can keep improving the driver's preemptive planner: the agent gets a better sense of how a site is usually laid out, so the next visit can plan a few steps ahead and only confirm or adjust when the page loads.
We collect only:
- the site's registrable domain (eTLD+1)
- path templates with unique IDs stripped
- element role and selector fingerprints
- action sequences
- whether the planned next screen matched what actually appeared
- timings
- whether a step succeeded or failed
- a hashed install id (not your name or account)
We never collect page text, form values, passwords, cookies, query strings, data from sign-in or authentication pages, data from sites on the banking and blocked preset, or anything from Incognito windows.
It is on by default outside the EU, EEA and UK, and you can turn it off at any time in the extension's settings or the consent screen. In the EU, EEA and UK it stays off until you opt in. Turning it off takes effect immediately and deletes any of this metadata that has not yet been uploaded. You can ask us to delete what we already have by emailing privacy@luculent.app.
We keep raw events for at most 30 days, and may keep de-identified aggregates for up to 24 months, only to improve navigation and the preemptive planner. We do not sell this data, and we do not use it for advertising.
Chrome Web Store Limited Use. Information the extension accesses, including information from Google APIs and from pages you browse, is used only to provide and improve the Browser Driver's features. We comply with the Chrome Web Store User Data Policy, including the Limited Use requirements. We do not use that information for advertising, and we do not sell it or use it to determine creditworthiness.