LughPrivacy
What Lugh keeps, why, who helps us run it, and how to delete it.
Last updated: 1 October 2026 (beta version of this page).
The short version
- Lugh reads the travel confirmations you choose to forward to Your Lugh Address. It doesn't read your mailbox.
- We use your data only to run Lugh for you. We don't sell it, we don't show ads, and we don't track you across other apps or websites.
- You can delete your account and everything in it from the app at any time: Profile → Delete account.
What Lugh keeps
| What | Why |
|---|---|
| Account: your sign-in email address, a password (stored only as a secure hash by our database provider) and Your Lugh Address | To sign you in and to know which forwarded emails are yours |
| Forwarded emails: the sender address, subject, date and text of each email you forward to Lugh (attachments are not kept), and whether Lugh could read it | So Lugh can find the bookings in it, show what happened to each forward, and read it again if needed |
| Trips and bookings: what Lugh found or you entered, such as type, supplier, booking reference, dates and times, places, flight numbers and airports, and your corrections | To build your trips, timeline and map |
| Map positions and time zones for the places in your bookings | To draw your journey and show local times. Lugh does not use your phone's location |
| Notification details (if you turn notifications on): a push address for each phone, its platform (iPhone or Android), its time zone, and a record of which notifications were sent | To send you the alerts you asked for, and never the same one twice |
| Usage counters: how many paid place look-ups your account used each day | To keep Lugh's costs under control |
Lugh does not use advertising identifiers, analytics or tracking tools.
How Lugh uses AI
To find the bookings in a forwarded email, Lugh sends the email's sender, subject, date and text (up to about 8,000 characters) to the OpenAI API. Lugh is usually right, but not always; when it isn't sure it marks the booking Needs checking. Anything you correct stays the way you set it.
OpenAI states that data sent through its API is not used to train its models unless the customer opts in (Lugh hasn't), and that API abuse-monitoring logs are kept for up to 30 days unless the law requires longer. Lugh doesn't ask OpenAI to store its requests.
Who helps us run Lugh
| Service | What it does for Lugh | What it receives |
|---|---|---|
| Supabase | Database, sign-in and server functions | Everything in "What Lugh keeps" |
| Postmark | Receives the emails you forward and passes them to Lugh | The forwarded emails. Postmark keeps message content for 45 days by default |
| OpenAI | Reads forwarded emails to find bookings | Sender, subject, date and email text (see above) |
| Geoapify | Finds map positions for places | Place names and addresses only (for example "Hotel Artemide, Rome, Italy"), sent from our server. Never your name, email or account |
| Expo, with Apple and Google push services | Delivers notifications | Your phone's push address and the notification text, for example "Booking added" and the supplier or trip name |
Maps in the app are drawn by Apple Maps on iPhone and iPad. Map data © OpenStreetMap contributors.
How long we keep it
- Your account, forwarded emails, trips and bookings: until you delete them or delete your account.
- Delivery checks for notifications: about 3 days.
- Place positions are shared between all travellers as plain place names with no link to any account, so the same hotel isn't looked up twice. These are not personal data and are kept.
- Service providers keep their own copies for the periods described above or in their policies.
Deleting your account
In the app: Profile → Delete account…, type DELETE and confirm. Lugh deletes your sign-in, Your Lugh Address, forwarded emails, trips, bookings, devices and notification records in one step. If anything fails, nothing is deleted and the app tells you. Copies held by the providers above expire under their own policies (for example, Postmark after 45 days).
If you can't use the app, email support@getlugh.com from your sign-in address and ask us to delete your account.
Your rights
You can ask for a copy of your data, ask us to correct or delete it, or object to how we use it. Email support@getlugh.com. You may also complain to your local data protection authority.
Children
Lugh is for people organising their own travel and isn't directed at children.
Changes
If this policy changes, we'll update this page and its date. Big changes will also be announced in the app.