Privacy Policy

What lucid.page stores, why, and for how long. The short version: we collect the minimum needed to operate and bill the service — nothing more.

# What we store

• Page content and metadata. The Markdown you publish, plus the page’s slug, title, timestamps, visibility, expiry, and owner (if you have an account). Every update is kept as a revision. Anonymous pages are not tied to any identity.
• Account data (only if you sign in): your Google sign-in identity via Firebase — a Firebase user ID, your email address, and an internal account ID. If you fill in a profile, we also store your display name, bio, and avatar URL.
• API keys. Stored only as a SHA-256 hash plus a short display prefix. We cannot recover a lost key.
• Claim tokens. Anonymous pages come with a one-time lpc_ claim token; we store only its SHA-256 hash.
• Billing state. Payments are processed by Stripe; we never see or store card numbers. We store only your plan status, keyed by account ID.
• Page-view telemetry. When someone reads a page, we record server-side: the page’s slug, the path, the referring site’s hostname, and the reader’s country. No IP addresses, no cookies, no fingerprinting; known bots are skipped. Retained 90 days, then deleted.
• MCP/API telemetry. Which API/MCP methods were called, client name and version, and whether the call was authenticated. No payloads, keys, or IPs. Retained 90 days.
• Site analytics. The lucid.page site and published pages use Simple Analytics, which is cookieless and collects no personal data. The editor and dashboard additionally load a Google Ads tag so we can measure our own campaigns — published pages never do.

# What we never do

We do not sell data, run ads, fingerprint readers, or track people across pages. We do not inject anything into your content. Page content may be scanned by automated systems to detect abuse (phishing, malware); it is never used for advertising or profiling.

# Who processes the data

• Cloudflare — edge hosting and content storage (pages are served from Cloudflare’s network, which keeps its own standard edge logs);
• Bitgate-operated servers — the database behind accounts, pages, and telemetry;
• Stripe — payment processing;
• Google (Firebase) — sign-in for accounts;
• Simple Analytics — site and page analytics (cookieless);
• Google Ads — campaign measurement on the editor and dashboard only.

# Retention

Pages with an expiry are deleted shortly after they lapse; deletion is real deletion. Page-view and API telemetry are deleted after 90 days. Account data is kept until you ask us to delete it. Removed (451) pages stay removed.

# Your rights

You can request access to, correction of, export of, or deletion of your personal data at any time — email bart@bitgate.com from the address on your account. You can delete your pages and revoke API keys yourself from the dashboard at any time.

# Security

All traffic is TLS-encrypted, API keys and claim tokens are stored hashed, and private pages are gated server-side. Report security issues to abuse@bitgate.com.

# Changes

We may update this policy as the service evolves; the “last updated” date above tracks that. Material changes will be called out on this page.