Lucy is designed so that your recordings stay on your device — unless you turn on iCloud sync, which copies them to your own private iCloud account. This policy explains exactly what that means, what data (if any) is involved, and your rights.
1. What data Lucy collects
Xymex does not collect or store any of your content on its servers. All audio recordings, transcripts, and notes are stored on your device, in your device’s local app storage (sandboxed to Lucy) — and, only if you turn on iCloud sync, also in your own private iCloud account (see “Optional iCloud sync” below).
Lucy does not require an account. Lucy uses no advertising networks and no advertising or marketing analytics: it does not build a profile of you, does not track you across apps or websites, and does not measure your usage for any commercial purpose. The only usage information it records is described in the next section — anonymous counts of what the app did, so that we can find where it fails.
To be explicit: no audio, no transcript, no summary, and no session metadata is ever sent to Xymex or to any third-party service. The only place your content can go off your device is your own private iCloud account, and only if you turn on iCloud sync.
Optional iCloud sync
iCloud sync is off by default. If you turn it on in Lucy’s Settings, Lucy uses Apple’s CloudKit to copy your sessions into the private database of your own iCloud account, so they appear on your other devices signed in to the same Apple ID. You choose what is included: transcripts only, or transcripts and audio.
This data is stored by Apple in your iCloud account, under Apple’s iCloud terms and privacy policy. It is in your account, not ours: Xymex cannot access it. Turning sync off stops further syncing from that device. Copies already stored in iCloud stay there until you delete them — delete the sessions in Lucy while sync is on, or delete Lucy’s data from your iCloud storage settings.
The one exception: crash, performance and usage diagnostics
Lucy sends anonymous crash, performance and usage diagnostics to Sentry (Functional Software, Inc.), acting as our data processor, so that we can find and fix bugs and see where the app lets people down. This is the only data that leaves your device.
- What is sent: the type of crash and the sequence of code that led to it; the app version, device model and OS version; timing measurements for slow operations; and anonymous usage events — for example that a recording was started, that a transcription finished or failed and why (as a category such as “low disk space”), which on-device model was downloaded, which export format was used, or that a purchase was completed. Every value is a fixed category or a coarse range (such as “2–10 minutes”); free text is never sent.
- What is never sent: your audio, transcripts, summaries, meeting or session names, speaker names, or the contents of any file. File paths inside your documents are redacted before sending, and interface labels — which in this app contain transcript text — are discarded entirely.
- Not linked to you: reports carry no account, e-mail, device identifier or user ID; we create no install identifier, and IP address storage is disabled on both of our Sentry projects (iOS and macOS). Where a coarse country-level region is inferred at the moment a report arrives, we never use it to identify anyone and never combine it with other data. We hold nothing that lets us tie a report back to a person or a device.
- Only from App Store and TestFlight builds, capped: at most 300 usage events are recorded per launch; development builds send nothing.
- It cannot be turned off: these diagnostics are the single exception to Lucy’s on-device rule, and they are what makes it possible to fix bugs that would otherwise be invisible. Settings › Privacy & Data › Crash reports describes exactly what is sent.
The App Store privacy label for Lucy reads Diagnostics — Crash Data, Performance Data and Other Diagnostic Data; Usage Data — Product Interaction; all Not Linked to You, and states that this data is not used for tracking. That label is cross-checked by Apple against actual app behavior.
2. How AI model downloads work
To provide transcription features, Lucy downloads AI model files from Argmax’s distribution network (hosted on huggingface.co) on first launch. The download size is approximately 600 MB to 1.6 GB depending on which models you select.
This download is a one-way file transfer to your device. No audio, no transcript, no personal information, and no usage data is transmitted to Argmax, HuggingFace, or any other party during or after this download. Your device makes an outbound HTTPS request to a content delivery network (CDN) to fetch the model file — the same mechanism used by every app that fetches an image or file from the internet. The CDN delivers the file. No user data travels in the other direction.
After the model is downloaded, all transcription processing runs locally. No further network requests related to transcription are made.
3. Microphone access
Lucy requests microphone access (the NSMicrophoneUsageDescription permission) to record audio sessions. Microphone access is only used when you actively start a recording inside the app. The iOS system recording indicator (the orange dot in the status bar) is always visible when Lucy is recording — this is enforced at the operating system level and cannot be suppressed.
Audio is processed entirely on your device. It is never sent to Xymex or to any third party; it leaves your device only if you turn on iCloud sync with audio included, which copies it to your own private iCloud account. When you delete a session, the audio file is deleted from your device’s local storage.
4. Data retention and deletion
All data — recordings, transcripts, and notes — is stored locally on your device in Lucy’s sandboxed app storage (plus a copy in your private iCloud account if you turn on iCloud sync). You can delete any session at any time from the app’s session library. The delete action is immediate and permanent; there is no server-side backup to recover from.
Deleting the Lucy app from your device removes all data Lucy stores on that device, including recordings, transcripts, and preferences. Copies synced to iCloud are not removed by deleting the app; delete them from your iCloud storage settings. Lucy has no access to your data once the app is deleted.
Downloaded AI model files are stored in Lucy’s local storage. You can delete downloaded models from Lucy’s Settings screen to free up storage space. Models can be re-downloaded at any time over Wi-Fi.
5. At-rest encryption for locked sessions
Lucy includes an optional session-lock feature. When you lock a session, the transcript and audio file are envelope-encrypted at rest using a key held by your device’s Secure Enclave. Opening a locked session requires Face ID, Touch ID or your device passcode on that device.
What this means in practice:
- A locked session’s transcript and audio cannot be read without Face ID, Touch ID or your device passcode on the device that locked it.
- The encryption key never leaves the Secure Enclave and is never transmitted to Xymex or any third party.
- There is no recovery path. If that device’s key becomes unusable — for example after certain Face ID, Touch ID or passcode changes, or if the session is moved to another device — a locked session cannot be decrypted. Keep unlocked backups of any session you cannot afford to lose.
- Unlocked sessions are stored in sandboxed local app storage as described in Section 4. Encryption is an additional layer you opt into per session — it is not applied by default.
This feature is entirely local. No key material, no encrypted data, and no metadata about locked sessions is ever transmitted off your device.
6. Third-party open-source libraries
Lucy is built using the following open-source libraries. None of these libraries transmit data off your device when used inside Lucy:
- WhisperKit by Argmax, Inc. (Apache 2.0 license) — on-device speech transcription. github.com/argmaxinc/WhisperKit
- FluidAudio (open-source) — on-device speaker diarization (voice attribution). All processing is local.
- MLX Swift by Apple (Apache 2.0 license) — on-device machine learning inference framework for Apple Silicon. No data leaves the device.
Apart from the Sentry diagnostics described in section 1 — and Apple’s own iCloud, used only if you turn on sync — Lucy does not integrate advertising SDKs, analytics platforms, or any other service that collects or transmits user data.
7. Children’s privacy
Lucy is a professional tool designed for adults. It is not directed at children under 13 (or under 16 in the European Economic Area). We do not knowingly collect personal data from children. Because Lucy collects no personal data, this risk is structurally absent — but we state it explicitly for completeness.
8. Contact and policy updates
For privacy questions or data deletion requests (though Lucy has no server-side data to delete), contact us at:
We will notify users of any material changes to this policy via an in-app notice in the next app update. This policy was last updated on October 4, 2026.