Privacy Policy & Protection

1. Why Privacy Matters & How We Protect Your Thoughts

Many journaling apps keep reflections in readable form on their servers, where a breach or anyone with access to those systems could expose them. Since version 1.4.0, Lugna is engineered so that your entries cannot be read by anyone but you:

• Sealed Directly on Your Phone: Since version 1.4.0, every journal reflection, CBT prompt answer, and mood tag is encrypted on your device before it is synced. Your thoughts never travel across the internet in plain text.
• Only You Hold the Keys: The mathematical keys needed to unlock your journal exist only on your physical iPhone or iPad. Because our servers never receive these keys, we cannot read your entries even if compelled to do so.
• Your Secret 12-Word Recovery Phrase: You receive an offline 12-word safety phrase that allows you to easily restore your encrypted journal whenever you get a new device, without relying on any company or third party.
• Zero Server-Side Access: Even in the theoretical event of a cloud database compromise, an intruder would see only random, scrambled binary data that cannot be read without your private physical device keys or recovery phrase.

Updating from an older version: Lugna 1.4.0 is the first version that locks your journal with a key only you hold. Nothing is lost. When you update and sign in, your existing entries are locked on your device, and the earlier unencrypted copy is removed at that point. Until each of your devices is updated, entries written on that device are still kept in the older, unencrypted format, so if you use more than one device, please update them all. After updating, save the 12-word recovery phrase you are shown: it is the only way to unlock your entries on a new device.

2. Zero Third-Party Tracking & No Advertising

Your mental health journey is deeply personal and is never for sale. In full compliance with our privacy standards and the bundled PrivacyInfo.xcprivacy manifest:

• No Cross-App Tracking: Lugna explicitly declares NSPrivacyTracking = false. We do not track you across other websites, applications, or advertising databases.
• Zero Tracking Domains: The NSPrivacyTrackingDomains array is completely empty. Lugna never connects to advertising networks, audience measurement brokers, or telemetry collectors.
• No Surveillance SDKs: There are zero third-party marketing SDKs, tracking pixels (such as Meta Pixel or TikTok SDK), analytics frameworks (such as Google Analytics or Adjust), or device fingerprinting mechanisms anywhere in Lugna.

3. Declared Data Types & App Store Nutrition Label

The table below reflects our exact App Store Nutrition Label declarations, showing why each data point is used solely to provide your app experience:

4. What Lugna Stores on Your Device

Lugna keeps only what it needs to work, and all of it stays inside the app's own storage on your iPhone or iPad:

• Your settings: your lock preference (Face ID, Touch ID, or PIN), your language (English or Indonesian), and your visual options.
• Your unfinished drafts, so an interrupted entry is still waiting for you when you come back.

Lugna uses only Apple's standard system APIs, declares the required reasons for them in its privacy manifest, and includes no third-party analytics or advertising SDKs.

5. On-Device Screen Lock, Privacy Blur & Draft Safety

• Biometric Screen Lock & PIN: Protect your journal from curious glances with Face ID, Touch ID, or a custom application PIN. In the iOS App Switcher, Lugna automatically blurs your journal screen so no sensitive reflections are ever visible.
• Protection Against Guessing: To prevent unauthorized attempts, progressive delay tiers (30s, 60s, 300s, 900s, and 3600s) automatically activate if the wrong PIN is entered multiple times.
• Never-Lost Draft Protection: Take all the time you need when writing. In-progress reflections are saved continuously to local sandboxed storage. If an app crash, phone call, or low battery occurs, your draft is restored immediately when you reopen the app. Drafts are cleanly erased once saved or discarded.
• 100% Offline Guest Mode: Lugna works completely without an account. You can begin journaling anonymously right away, with all entries remaining exclusively on your physical phone.

6. Account & Data Erasure

In strict adherence to international GDPR/CCPA erasure standards, you can permanently erase your entire account and all associated data at any time directly within the app:

1. Open Lugna and navigate to Account > View Profile > Delete Account.
2. Re-authenticate with your account password or Apple ID to verify account ownership.
3. Confirm your deletion intent on the prompt.

No orphaned records, shadow profiles, or backups of your data are maintained. Once deleted, your data is gone forever.

7. Data Portability & Export

Under international privacy frameworks, you retain complete sovereignty over your data:

• Right of Access & Portability: Export your complete journal history at any moment directly from the app (Account > Export Journals) as either password-protected encrypted backups (.lugnabackup) or open, readable archives (.json) to Files, AirDrop, or personal storage. You can also seamlessly import either backup format back into Lugna at any time (Account > Import Journals) to restore your reflections with full on-device encryption and automatic deduplication.
• Right to Rectification: Edit or correct any past journal reflection, mood check-in, or profile detail whenever desired.
• Right to Erasure: Delete individual journal entries or perform self-serve complete cloud erasure of your entire account footprint.

8. Data Controller Contact & Inquiries

If you have any questions, feedback, or inquiries regarding this Privacy Policy or how Lugna protects your privacy, please contact the team. Lugna is built and maintained by seven developers; inquiries reach the maintainer directly: