Anyone can promise privacy. Lucent is built so that violating it would require effort — the architecture simply has nowhere for your data to go.
Nothing leaves the device until you export it or give a model a reason to look. That is the short version — the full policy follows below, and the code agrees with it.
Your notes live in a SQLCipher-encrypted database; attachments are encrypted individually. The hot paths — PBKDF2 key derivation and AES-256-GCM — run in Rust through JNI, with identical Kotlin fallbacks so the app is never held hostage by a native library. Someone holding your unlocked phone is one thing; someone holding your files gets nothing but noise.
This is a real brute-force policy, not a polite request: escalating cooldowns, a persisted counter that survives reboots, an optional security question, an optional self-destruct — and fingerprint on Android, Windows Hello on desktop, politely out of office for the whole cooldown. Guess wrong too many times and the app genuinely stops negotiating.
Backups are a single .lcb file carrying notes, tasks, history, chats, attachments and settings across devices — previewed before a single item is changed, armed to run automatically, and password-protectable. A backup nobody can read is a keepsake rather than a backup, so this one is read on the way out and again on the way in.
Share-sheet integration: off. Diagnostics: off, and kept locally when on. The assistant services you connect are entirely your choice. Cloud mirroring is a module you configure yourself, over WebDAV — your server, your rules. There is no "enabled by default, buried three menus deep" anywhere in this app.
Cloud models see exactly what you put in front of them — nothing is synced, indexed or "improved" in the background. Prefer the full hermit mode? Run a .gguf locally and the network can stay off entirely. The one deliberate exception to encryption is exporting to Markdown, Word, PDF or Excel — a file you can open anywhere else, which is rather the point.
Lucent is a notes-and-tasks application for Android and Windows. This policy describes what the app stores, what it sends off your device, and how you control both. It describes Lucent as it is built in this repository.
The rest of this document explains each of those statements in detail, including the limits.
Lucent is developed by Jessica Martinez. Questions about this policy, or about the app's handling of data, can be sent to yuan47578@gmail.com.
Lucent is free software released under the MIT Licence. The developer operates no service that collects or stores user data, and the application has no server component.
Everything you create in Lucent lives in the application's own private storage on the device. That storage area is not readable by other ordinary applications, and it is removed when you uninstall the app or clear its data.
The material stored includes:
The database is encrypted with SQLCipher. On Android the app uses Room over SQLCipher; on Windows it uses SQLite through the bundled JDBC driver configured with the SQLCipher cipher and the same kind of 256-bit key. Notes, tasks, conversations, history and settings are all inside that database.
Attachments are encrypted separately. Each file is written in an authenticated AES-256-GCM container, in 64 KiB chunks, before it reaches the disk. The filename on disk is a random identifier rather than the name you see in the app.
Backups are always encrypted as well; see section 6.
The database key and the attachment key are random 256-bit values generated on your device. They are not derived from anything you type and they are not written to disk in plain text. On Android they are wrapped by a key held in the Android Keystore, which is hardware-backed where the device provides it, with a machine-local fallback when the Keystore is unavailable. A recovery copy of each key is kept so that a Keystore problem does not destroy your data.
API keys, WebDAV passwords, the backup password and your app-lock credentials are stored through the same encrypted-secret path, not as plain text. Your app-lock password and security answer are never stored at all: only a salted hash is kept, and the password itself cannot be recovered from it.
Encryption here protects data at rest: a copy of the database, an attachment file or a backup that is taken off the device cannot be read without the key. It does not protect against someone who is using your unlocked device with your operating-system account, and it does not protect data while the app is open, because decrypted content necessarily exists in the device's memory while it is being displayed or edited.
Lucent does not pretend about this. If the encryption library cannot be loaded, or a database cannot be encrypted or unlocked, the app records the fact and reports it rather than claiming success; Settings provides an encryption check that verifies values are sealed and open correctly. If a database cannot be decrypted with the stored key, Lucent sets it aside rather than deleting it and tells you so, so that you can restore from a backup.
Home-screen widgets on Android display note titles or task titles on your launcher. Anything a widget shows is visible to whoever can see that screen. The widgets are optional and can be removed.
By default, nothing does. Lucent does not require a network connection for notes, tasks, reminders, history, attachments, local search or the on-device assistant.
Specifically, Lucent contains no analytics SDK, no advertising SDK, no crash-reporting service and no tracking identifiers. There is no account system and no device fingerprint that is sent anywhere. Crash Shield, when you turn it on, writes caught errors to a local log file on the device and does not transmit them. Diagnostic logging works the same way: it is off by default, it writes locally, and it is only ever sent anywhere if you export it yourself and choose to share the file.
Because there is no Lucent server, the developer has no way to read your data, and no way to recover it for you.
Each of the following is optional, off by default, and under your control. When one of them is active, data leaves the device directly from the app to the third party you configured; it does not pass through any Lucent service, because none exists.
The assistant in the cloud mode uses an API key that you supply and a provider that you choose. Lucent speaks the request formats of OpenAI-compatible, Anthropic-compatible and Google-compatible endpoints, and any OpenAI-compatible address works, including DeepSeek and self-hosted gateways. You can keep several provider profiles and switch between them.
When you send a message, Lucent makes an HTTPS request from your device to the base URL you configured. That request contains:
Your API key is sent to that provider as the authentication header for the request. It is sent nowhere else. Read the chosen provider's own privacy policy to understand what it does with the text it receives; those terms are between you and that provider, and Lucent has no visibility into or control over them.
The assistant cannot change your data silently. Before it writes anything, it shows you what it intends to do, and that confirmation step is on by default. Tools are optional: the local model has its own tool switch, and the cloud assistant's tool access is a setting you can turn off. Turning off either means the model can chat but cannot read or modify your notes and tasks.
Web search is off by default. When you switch it on and the assistant decides a search is needed, Lucent sends the search query to a public search engine. You choose which one, or leave it on Automatic, which tries them in turn until one answers: Bing, DuckDuckGo, Google, Brave, Mojeek, Yandex, Baidu, Sogou, 360 Search, and the Wikipedia search API. No search API key is used and no account is created. The query text leaves your device; the results come back to the assistant and are included in its answer. The engine that answers sees the query and your IP address. Web search needs the agent mode and, on the local model, the tool switch; Blackout Mode blocks it entirely.
Lucent's semantic search follows whichever assistant you are using, so there is nothing extra to choose. While the local model is the active assistant, indexing stays on the device and is not implemented in the current build, so nothing leaves it. While the cloud model is active, the text being indexed is sent to your configured AI provider's embeddings endpoint to produce each vector, which means note text leaves your device. Switching between the two models switches the behaviour with it.
Cloud backup is off by default. If you turn it on, you supply the address, username and password of a WebDAV-compatible service you already have an account with, such as Nutstore, Nextcloud or Koofr, or any other WebDAV server. Lucent uploads your .lcb backup files to the folder you name on that server, and can list and download them again for a restore. The files are encrypted before they are uploaded; the service stores the encrypted file, and the credentials you enter are sent to that service to authenticate. Automatic cloud upload is a separate switch and is also off by default.
Automatic update checking is off by default. When you turn it on, or when you ask Lucent to check, the app requests the latest release information from the public GitHub releases API for this repository and compares version numbers. The request contains no personal data beyond what any HTTPS request carries, such as your IP address and a user agent naming Lucent. If a newer release exists, Lucent offers it; the installer or APK is downloaded from GitHub only if you choose to update.
Lucent sends nothing out on its own. Two features hand data to other applications, and both are under your control:
If you import a GGUF model, the assistant can run it with llama.cpp directly on the device. In that mode nothing is sent anywhere: there is no account, no API key and no network request involved in generating a reply. The model file stays on your device, and the model is unloaded when you leave the app. Local tools are a separate switch and are off by default. GPU acceleration is optional and can be turned off.
Beyond notes and tasks, the assistant can be given a real toolkit: a workspace folder it may read and write, shell commands, documents, plugins, and connections to outside services. Each of those is a separate switch in Settings → Advanced → Toolkit, and the parts that reach outside your device only do anything when you turn them on and, by default, ask you first.
sub-agents folder on your device, and nothing is sent anywhere.A backup is a single .lcb file that you create. It can contain notes, tasks, version history, notebooks, conversations, attachments, settings and API keys, and optionally imported fonts and local model files. You choose which of those to include, and where the file is written.
Every .lcb file is encrypted. There are two modes:
A password-protected backup can optionally carry a security question and answer so that the password can be recovered later. That option is off by default and it makes the backup only as strong as the weaker of the password and the answer, so choose a question whose answer nobody else knows.
Automatic backups, when you enable them, write to a folder you choose, keep a number of copies that you set, and can also upload to your configured WebDAV folder. The backup file itself is the same encrypted container in every case. Where your backup files live, and how many copies exist, is entirely your decision; so is deleting them.
Lucent's privileged shell integration is optional, off by default, and requires software and permission outside Lucent.
On Android, the app can use Shizuku to run privileged operations when you have installed Shizuku, started its service and granted Lucent permission in the system. This exists to carry out actions you explicitly ask for that ordinary applications cannot perform on their own, such as installing an app update you downloaded. Lucent cannot start Shizuku, cannot grant itself the permission, and does nothing through this path unless you have enabled the integration and granted the permission. You can revoke it at any time in Shizuku or in Android's settings, and turn the integration off in Lucent. Verification of what the privileged identity actually is can be seen in the app, which shows the uid it obtained.
Lucent also declares the ordinary Android permissions it needs, each for a stated purpose; see section 8.
| Permission | Why Lucent asks for it |
|---|---|
Network access (Android INTERNET) | Sending a message to the assistant provider you configured, web search when you enable it, WebDAV backup when you enable it, and update checks when you enable them. Nothing is sent without one of those being active. |
Notifications (Android POST_NOTIFICATIONS) | Showing task reminders, and progress for a download, backup or generation you started. |
Exact alarms (Android SCHEDULE_EXACT_ALARM) | Firing task reminders at the time you set rather than approximately. |
Run at startup (Android RECEIVE_BOOT_COMPLETED) | Re-registering your reminders after the device restarts, so a reminder set for tomorrow survives a reboot. |
Foreground service (Android FOREGROUND_SERVICE, FOREGROUND_SERVICE_DATA_SYNC) | Keeping a backup, download or model generation running when the app is not in the foreground, instead of being killed halfway. |
Biometric unlock (Android USE_BIOMETRIC; Windows Hello on Windows) | Letting you unlock the app with a fingerprint or face instead of typing the app-lock password. Optional, off by default, and only used for the local unlock. |
Vibration (Android VIBRATE) | Typing haptics and tactile feedback. |
Install packages (Android REQUEST_INSTALL_PACKAGES) | Installing an update that you chose to download, using the system installer. |
Shizuku service permission (Android moe.shizuku.manager.permission.API_V23) | The optional privileged integration described in section 7. Declared only so that Shizuku can be used at all; it has no effect unless you install Shizuku and grant it. |
All-files access (Android MANAGE_EXTERNAL_STORAGE) | Optional, off unless you grant it, and used only so that the workspace folder you choose can be read and written as ordinary files. Without it Lucent keeps the workspace inside its own storage. |
Location (Android ACCESS_COARSE_LOCATION, ACCESS_FINE_LOCATION) | Only read when the assistant calls its location tool, which itself only happens when device control is enabled and you have granted the permission. Lucent never tracks you in the background. |
Lucent does not ask for broad access to your files or your storage unless you turn the agent toolkit on and point it at a workspace folder, in which case all-files access is what lets that one folder be read and written as ordinary files; you can decline it and keep the workspace inside Lucent's own storage instead. Elsewhere, files and folders are chosen by you through the system's own document picker, and Lucent only receives the specific item you selected. Fonts and model files are the same: you pick them, and they are copied into the app's own storage.
Privacy in Lucent is a set of switches, all of them in your hands, all of them in Settings. The main ones:
Lucent keeps your data on your device until you delete it. Notes and tasks that you delete go to the trash first and are removed permanently after 30 days, unless you empty the trash or delete all data sooner. Version history is kept only while the corresponding history setting is on, and is removed with the note or task it belongs to.
To delete everything:
Three things are outside Lucent's reach, and the app cannot delete them for you:
If you want those gone too, delete the files and use the provider's own deletion controls.
Lucent is a general-purpose notes and tasks application. It is not directed at children, it has no account system, no advertising and no social features, and the developer collects no personal information from anyone, including children. The app's data stays on the device of the person using it.
If a future version of Lucent changes how data is handled, this policy will be updated and the date at the top will change. Substantive changes, meaning ones that affect what leaves your device, will be described in the release notes for the version that introduces them. The version of this policy that applies to you is the one shipped with the version of Lucent you are running, and its history is visible in the repository's commit history.
Questions, corrections and concerns about privacy in Lucent can be sent to yuan47578@gmail.com.
Developer: Jessica Martinez
Copyright © 2026-2027 Jessica Martinez.