Privacy policy

Last updated: 14 November 2026. App: Lundy ("the app").

Summary

What you log stays on your phone. The app has no account. What you log, plan and write in your journal is stored on your phone, encrypted, and never sent to us. There is no analytics, no advertising, no tracking and no sale of data. One thing can leave your phone, and only if your version of the app has it and you say yes: your chats with Lundy, the AI companion. Not every version has the chat: if Settings shows no "Chat with Lundy", yours does not, and nothing you log leaves your phone. Where it is offered and you say yes, what you write in the chat and a short summary of your numbers go through our relay to Claude, an AI made by Anthropic, which writes the replies. Anthropic deletes such messages from its systems within 30 days, with exceptions (section 4). You can stop at any time and delete your talks in Settings. Apart from that, we receive only what you choose to send us yourself (for example a support email) or what visits to our website leave behind. You can export a copy of everything or delete everything at any time. The app is for adults (18+).

1. Who is responsible

Daniel Schmid, sole trader, Switzerland. Contact: tuveto@proton.me.

For the data inside the app, we decide nothing and cannot see it: it lives on your phone and we have no way to read it. The exception is what you send when you chat with Lundy (section 4). For what you send us and for our website (sections 6 and 7), we are the responsible party ("controller").

2. What the app stores, and where

On your phone only, in a database encrypted with SQLCipher, apart from one photo you may add (the last item below). The key is made once on your phone and kept in the phone's secure storage.

• your log (use, cravings, notes, and what you add such as mood or place);
• your plan, your own texts and your tricky-day plans;
• your products and prices, and your settings (for example reminder times and the last calm sound you used);
• your progress in the app (days won, badges, the state of the sea);
• a record of your subscription (its status and end date), as Apple reports it;
• the date you confirmed that you are 18 or older (no age and no date of birth);
• if you add one, a photo as a reminder of your reasons: kept as a file in the app's own folder on your phone, not inside the encrypted database.

This is health-related information, so we treat it as sensitive. The encryption is part of the installed app from the App Store. In test versions that run inside other apps or in a web browser, the database is not encrypted.

3. What never happens

• No account, no sign-in, no email or phone number asked for.
• No server of ours stores your data. Without your yes to the chat with Lundy, the app contacts no server by itself, apart from Apple's App Store, which it asks for the prices and for your plan. With it, the relay (section 4) passes your message on and keeps no conversation (section 4: it runs on Cloudflare, which carries the messages in transit).
• No analytics, no crash reports, no advertising network, no tracker, no third-party code that collects data.
• No sale or sharing of your data, and none used for advertising.

4. What leaves your phone, only if you choose it

Chatting with Lundy (the AI companion). The chat with Lundy is written by an AI, not a person and not a doctor. It is optional: the rest of the app works the same without it. This section applies only to a version of the app that offers the chat (it then has "Chat with Lundy" in Settings); a version without it sends nothing at all.

• Your yes comes first. Nothing is sent until you read a plain line that names Claude and Anthropic and tap "Yes, turn it on". Until then the chat stays off and nothing leaves your phone.
• What is sent, for each reply: what you wrote in the chat (the last 40 messages of the talk), a random id for your phone, the language setting of your phone, whether you have the free app or Plus, which kind of talk it is (the first talk in setup, an everyday talk or a talk during a craving), and a short summary made on your phone. The summary holds: the time of day and the weekday; your products, usual amount a day and price; your plan (track, cut down or quit) and its quit or cut-down day; today's cut-down targets; days won, money kept and your currency; what you used today and on each of the last seven days; cravings you rode out and cravings that ended with a use this week; the calming tools that helped, with how often (the top three); your reasons for quitting (up to five, as you wrote them); and how far your sea has come. The places or moments you tag your uses with are not sent. During the first talk in setup it also holds your country, your confirmation that you are 18 or older, and the typical pack price for your country. Your name is not sent: the chat writes a stand-in and the app puts your name in on your phone. If you type your own name, a place or anything else in a message or in a reason, that is sent like the rest of your words.
• Never sent: your full history of events (each use or craving with its date and time), your notes, your journal, your exact location (the app never asks for it), your Apple account, your name as saved in the app, your email address, or your phone's contacts, photos or other apps.
• Why: only to write the reply to you. We do not use it for advertising or tracking.
• Where it goes: through our relay (a small program of ours that adds our key and passes your message on) to Claude, made by Anthropic. The relay runs on Cloudflare, Inc. (Cloudflare Workers), which is our hosting provider and processes your messages and your phone's IP address only in transit, to carry them. The relay writes no message text to any log and keeps no conversation. It keeps a count of how many messages a random id for your phone has sent today, to apply the daily allowance (free: 5 a day, up to 20 during a craving and 40 in the first talk in setup; Plus: 30 a day), and a salted (scrambled) fingerprint of your IP address for a daily limit against abuse; the IP address itself is not stored. The random id is not your name and is not linked to your Apple account. Cloudflare's own terms and privacy policy cover what it does as a company, which you can find on Cloudflare's website.
• How long Anthropic keeps it: Anthropic says it deletes inputs and outputs of its API "within 30 days of receipt or generation", except where a service has longer retention under the developer's control, where Anthropic and the developer agreed otherwise, where it must keep them longer to enforce its Usage Policy, or in compliance with the law (Anthropic privacy centre, https://privacy.claude.com/en/articles/7996866, read 26 October 2026). We have no longer-retention agreement. Anthropic's own privacy policy covers what it does with it.
• Who processes it for us, and where: Anthropic Ireland, Limited (Ireland), part of Anthropic PBC (United States), and Cloudflare, Inc. (101 Townsend St., San Francisco, CA 94107, United States). Both act for us under data processing terms that are part of the terms we accepted with them, and those terms cover how they handle it, including outside Switzerland and the EU.
• Your control. Settings, Chat with Lundy: turn the chat off and the sending stops at once. "Delete my talks" erases the conversation from your phone. Messages Anthropic already holds are deleted by Anthropic on its own schedule above; we cannot delete them sooner. The relay's count for your phone's random id cannot be deleted from the app, but it holds only a scrambled form of the id and the day's counts; "Delete all my data" gives your phone a new random id, so the old count is no longer linked to anything on your phone.
• Please do not write in the chat anything you would not want an AI company's systems to process for up to 30 days, and in an emergency call your local emergency number: the chat will tell you the same.

Other things that leave only if you choose them.

• Export. "Export my data" makes two files (one for reading by machines, one spreadsheet) of everything you saved and hands them to your phone's share menu. You choose where they go. The files are not encrypted: anyone who gets them can read them. The app never sends them anywhere, and deletes its own copy when you leave the screen.
• The milestone share card. A milestone can be turned into a picture. It is made on your phone and goes nowhere by itself: only where you send it with your phone's share menu (to a friend, an app or a file), and then that app's or person's rules apply. We never receive it.
• Apple's rating prompt. From time to time the app may ask Apple's own system to show its "rate this app" box. Apple shows it and handles your answer under Apple's privacy terms; the app learns nothing from your answer and sends nothing.
• Phone numbers. If you tap a helpline number, your phone app opens, and its rules and your carrier's apply.
• Web addresses. The app opens no website by itself. If you tap a source, a helpline's site or a legal link, your phone's browser opens it, and that website sees your IP address as with any visit; its own rules apply.

5. Notifications and purchases

• Daily card. Reminders are created by your phone itself. No server sends them. They are off until you allow them. With the private setting the lock screen shows only the title "Today" and the line "Your card for today".
• Tricky-day reminder. If you set a reminder for a tricky day, your phone shows it at the time you chose, with a short line saying that your plan is ready. It is made on your phone and never leaves it.
• Quit day and milestones. Off until you turn it on in Settings. Your phone then shows a short notice on your quit day and when a health milestone arrives, never at night. The words name no product. They are made on your phone from your own plan and never leave it.
• Purchases. Purchases are handled by Apple through the App Store. Apple sees your purchase under Apple's own privacy terms. We get no card details and, as far as we know, no name or email from a purchase. The app uses Apple's StoreKit 2 and stores only the result on your phone (which plan you have and when it ends). Apple gives us reports of sales and downloads with no names or email addresses: summaries by country, product, device and date, and for subscriptions a random number that Apple makes for each customer, so we cannot tell who you are. The price, trial terms and how to cancel will be shown on the purchase screen before you commit.

6. Support emails and feedback (the data we do receive)

• What: your email address, your message, and anything you attach. Please do not send health details, and do not email your exported file unless you want help with it.
• Why: to answer you and fix problems. The legal basis (EU and UK GDPR, Article 6(1)(f)) is our legitimate interest in answering you and keeping the app working.
• How long: We keep it for 12 months after the last message, then delete it.
• Who sees it: we (section 1) and our email provider, Proton AG in Geneva, Switzerland, which stores the mailbox encrypted. We do not sell it or use it for marketing.
• If you ask us to delete it, we do.

7. Website

The website has no cookies, no analytics, no scripts from other companies and no embedded content from elsewhere. It is hosted on Cloudflare Pages by Cloudflare, Inc. (United States). To deliver the pages and protect them from attacks, Cloudflare processes each visitor's IP address; its privacy policy does not say for how long it keeps such records. We do not collect or look at visit logs.

8. Backups of your phone

Your phone's own backup (iCloud, or a computer) normally includes the app's database file, which is encrypted, and the photo of your reasons if you added one. The key is kept in the phone's secure storage (the iOS keychain) and is not marked "this device only". That means:

• restoring an iCloud backup to the same phone brings your data back and readable;
• restoring an iCloud backup to a new phone does not bring the key (Apple restores the keychain from an iCloud backup only to the phone it came from), so the app starts empty there;
• an encrypted computer backup (one with a password) carries the key, also to a new phone; a computer backup made without a password does not include the keychain, so the database in it cannot be read, and the app would start empty after a restore from it.

Changing phones? Export first: on the old phone, Settings, "Export my data"; on the new one, Settings, "Restore from a backup". We do not receive any backup: they belong to you and to Apple, under Apple's terms. Deleting the app's data in the app does not delete earlier backups of your phone or files you exported.

9. Your control and your rights

• Export: Settings, "Export my data".
• The chat with Lundy (in a version that has it): Settings, Chat with Lundy: withdraw your yes, or "Delete my talks".
• Delete everything: Settings, "Delete all data". It removes the database (log, plan, products, texts, settings and purchase records), its key, the photo of your reasons, and any export or restore copy from this phone. It cannot be undone. It cannot delete exported files or earlier phone backups. Uninstalling the app also removes its data from the phone.
• Rights for everyone. Wherever you live, we offer you these rights over the data we hold about you (emails, website): to know what we hold, to get a copy, to correct it, to have it deleted, to object to or restrict its use, to take it elsewhere, to withdraw consent, and not to be treated worse for using these rights. They match the rights in the EU and UK GDPR, the Swiss data protection act (FADP) and US state privacy laws. Write to tuveto@proton.me; we aim to answer within 30 days. For the data in the app, you already hold it and can export or delete it yourself, since we cannot see it.
• Complaints. You may complain to your data protection authority. In Switzerland: the Federal Data Protection and Information Commissioner (FDPIC). In the EU or UK: your national authority or the ICO.
• No sale, no sharing. We do not sell or share personal data (as US state laws define those words).

10. Children

The app is for people 18 and older. You confirm this once with a tap; we do not ask for your age or birth date. We do not knowingly receive data from anyone under 18. If you think a child has written to us, tell us and we will delete it.

11. Changes

If the app changes so that other data is stored or anything else leaves your phone, we will update this policy first and say so in the app. The date at the top shows the latest version. Earlier versions are available on request at the support address.

12. Contact

tuveto@proton.me.