Privacy Policy

1. Who we are and what this policy covers

"Luc", "we", "us", and "our" refer to the operator of the applicable Luc service. Luc Universe is an independent project currently operated by Luc Xu. This policy does not assert that Luc is a registered company, licensed entity, or holder of any security certification.

This policy applies to personal information processed through the following services when they are made available by Luc:

• The Luc Universe official website at lucxu.com.
• Luc Resume at resume.lucxu.com, including its resume editor, PDF export, and optional AI features.
• Luc Arcana at arcana.lucxu.com and its currently published reading and calculation tools.
• Other Luc websites or services that expressly link to this policy.

A product may provide a supplemental privacy notice for data or practices unique to that product. The supplemental notice controls where it expressly says so; otherwise this policy applies. Some integrations described below are conditional. A description does not mean that every product currently offers that feature. The features and data flows actually enabled in a product at the time you use it determine what applies.

2. Information we collect

The categories below describe information that may be processed depending on the service and feature you use. We try to collect information that is reasonably necessary for the service rather than every field a provider could make available.

Account and identity information.

• An internal user ID, provider subject ID, display name, first or last name where supplied, email address, avatar, and email-verification status.
• Optional organization, role, permission, and session identifiers when an authentication provider supplies them.
• Authentication sessions, security cookies, and audit or support records needed to establish and protect an account.
• Authentication and account preferences connected to a service.

User content and service activity.

• Information you enter, upload, import, generate, save, or request a product to process, such as resume fields, work and education history, project details, contact details, job-description snapshots, prompts, messages, and generated output.
• Birth date, time, location, names, questions, readings, and other inputs used by Luc Arcana where the relevant tool requests them.
• Feature usage, settings, error information, rate-limit information, and records of actions needed to operate, debug, secure, or support the service.
• Messages you send to support and information about complaints, disputes, refund requests, or account recovery.

Subscription and transaction information.

• Plan, product, price, entitlement, credit, order, payment, refund, and subscription status.
• Customer and subscription identifiers issued by a payment provider, current billing-period information, and the records reasonably needed for accounting, tax, fraud prevention, and dispute handling.
• An email address or name associated with a billing profile where a payment provider or billing system requires it.

Technical and security information.

• IP address, request time, requested URL or API route, response status, browser and device information, approximate network location, and security signals.
• Hosting, error, and rate-limit records created by Cloudflare or another infrastructure provider used for the applicable service.
• Browser storage values needed for language, theme, editor state, and other clearly described local features.

3. Authentication and third-party sign-in

Where a Luc service offers sign-in, Luc may use WorkOS AuthKit as its authentication service and may support Google, LinkedIn, or passwordless email sign-in through WorkOS Magic Auth. Availability depends on the product and its production configuration. The authentication provider creates and verifies the sign-in session. Luc receives the identity fields needed to recognize the account and provide the requested service.

Google sign-in currently uses only basic profile and email permissions. Depending on the account and consent, Luc may receive a Google account identifier, name, email address, profile image, and whether the email is verified. Luc does not request or receive Gmail content, Google Drive files, Google Calendar data, Google contacts, or your Google password.

If LinkedIn sign-in is enabled, Luc may receive basic identity information such as a LinkedIn identifier, name, email address, profile image, and account-linked information made available through the basic sign-in flow. Luc does not claim to obtain a complete LinkedIn career history unless a separate product expressly requests and discloses that additional permission.

Magic Auth, when enabled, may process your email address and verification or sign-in codes through WorkOS to provide passwordless authentication. Authentication providers may process information under their own privacy policies, terms, security controls, and account settings.

4. Luc Resume data, browser storage, and AI processing

The current Luc Resume implementation is browser-first. Resume documents, versions, application-status notes, target job-description snapshots, editor preferences, and AI conversation history are stored in your current browser's local storage for the resume site. They are not automatically uploaded to a Luc resume database and are not synchronized across devices. If a future account feature is introduced, its synchronization behavior will be disclosed before it is enabled.

Resume content may include your name, email address, telephone number, location, website, photograph, employment and education history, skills, projects, and any custom information you choose to add. Do not add sensitive information that the product does not need.

Clearing browser data, using private browsing, changing browsers, changing devices, or allowing browser storage to be deleted can remove locally stored resumes, versions, preferences, and conversations. Luc Resume provides a local JSON backup feature. You are responsible for keeping any backup safe and for checking that it contains the information you expect. A backup can itself contain personal information.

When you choose an AI import, rewrite, translation, version-generation, or resume-chat feature, relevant resume content is sent over HTTPS to the Luc Resume API and then sent to the model provider selected for that request. Depending on the feature, this may include personal details, work history, education, projects, skills, custom sections, job descriptions, prompts, prior messages, and the text the feature needs to produce a result. The default server-funded provider is DeepSeek. A user-configured BYOK request may instead go to OpenAI, Google Gemini, Anthropic Claude, or DeepSeek. Model providers process requests under their own terms, privacy policies, retention settings, and account controls.

BYOK credentials are entered by the user. They may be kept for the current browser session and, if the user selects "remember," in local browser storage. They are sent to the Luc Resume API with the relevant request so the request can be forwarded to the chosen provider. They are not included in Luc Resume's JSON backup. Avoid using an API key that you are not authorized and prepared to manage this way.

AI conversation history is kept in browser storage for up to 30 days after its last message, subject to message-count and storage-size caps. The browser applies these limits when its storage is read or updated. Storage can remain until the browser next performs that cleanup, and you can clear it earlier through browser controls or the product's local-data tools.

5. Luc Arcana and browser-based calculations

The currently reviewed Luc Arcana implementation performs its published calculations and deterministic readings in the browser. Birth details, chart state, tarot selections, and reading state are ordinarily retained only in the current page session. Optional language and appearance preferences may be saved in browser storage. The current public implementation does not use a Luc account, billing service, AI provider, or Luc backend for those calculations.

Luc Arcana presents traditional and cultural material for exploration and entertainment. If a future version enables accounts, AI-personalized interpretation, saved reports, payments, or server-side processing, the applicable notice will be updated before that use is introduced.

6. Payments and billing

No payment flow is currently enabled on the Luc Universe main site or the reviewed Luc Resume and Luc Arcana implementations. If a paid product is later offered, payment card information is intended to be entered directly into a third-party payment interface such as Stripe rather than collected by Luc.

For a paid service, Luc may process the following billing information as needed:

• Your application user ID and billing contact details.
• Payment-provider customer ID and identifier, subscription ID, product, plan, price, currency, quantity, and subscription status.
• Order, payment, refund, credit, entitlement, billing-period, tax, and transaction-status information.
• Records needed to investigate fraud, chargebacks, accounting discrepancies, or legal obligations.

Luc's reviewed billing data model does not contain full payment-card numbers, card verification values, or card PINs. Stripe or another payment provider handles payment details under its own privacy policy and security controls. Do not send card numbers, security codes, or other payment credentials through support email.

7. Cookies and similar browser storage

Luc uses browser storage and similar technologies for functionality and security. These may include language and theme choices, resume drafts and versions, conversation limits, editor preferences, authentication session cookies set by WorkOS, payment-flow cookies set by Stripe, and infrastructure or security cookies set by Cloudflare. Some of these records are necessary for the requested service and may remain for the period set by the relevant feature or provider.

The reviewed implementations do not include advertising cookies, cross-site behavioral advertising pixels, or third-party marketing trackers. If non-essential tracking is introduced, Luc will provide any notice or consent control required by applicable law before using it.

8. How we use information

We may use personal information to:

• Provide, operate, maintain, personalize, and improve the service you request.
• Authenticate users, maintain sessions, prevent account takeover, and manage account access.
• Validate entitlements, process subscriptions, maintain credits, provide billing support, and handle payment or refund matters.
• Detect, investigate, and prevent abuse, fraud, spam, malicious automation, security incidents, illegal activity, and chargebacks.
• Troubleshoot failures, measure reliability, enforce usage limits, and protect the integrity of the service.
• Respond to support requests, complaints, legal claims, and requests for access, correction, or deletion.
• Comply with legal, tax, accounting, regulatory, and law-enforcement obligations.
• Improve products, features, content, and user experience where permitted by law or with any consent that is required.
• Send service-related notices about material changes, security issues, transactions, or terms.

Where data-protection law requires a legal basis, we generally rely on performance of a contract or steps requested before entering a contract, compliance with legal obligations, our legitimate interests in safely operating and improving the service, and consent where consent is required or where we choose to rely on it. Legitimate interests are assessed against your rights and expectations. You may object where applicable.

We do not sell personal information. We do not use Google user data for personalized advertising, creditworthiness decisions, or training a generalized advertising model.

9. Third parties and sharing

We share information only as reasonably necessary for the purposes in this policy, with service providers acting for Luc or as otherwise described here. The reviewed products may involve the following providers when the corresponding feature is enabled:

• WorkOS AuthKit for authentication, hosted sign-in, session management, and passwordless Magic Auth.
• Google or LinkedIn when you choose that identity provider; those providers also process the sign-in interaction under their own policies.
• DeepSeek for the default server-funded resume AI features, or OpenAI, Google Gemini, Anthropic Claude, or DeepSeek when selected through BYOK.
• Stripe or another disclosed payment provider for checkout, subscriptions, invoices, refunds, and payment security.
• Cloudflare for website hosting, content delivery, network security, and, for Luc Resume, server routes that connect browser requests to AI providers.

We may also disclose information to professional advisers, auditors, insurers, or transaction counterparties under confidentiality arrangements; to authorities or other parties when required by law or reasonably necessary to protect rights, safety, users, or the public; in connection with a merger, financing, acquisition, reorganization, or transfer of the relevant service, subject to appropriate safeguards; or with your direction or consent.

The third-party services linked from Luc may have independent privacy practices. This policy does not govern a provider's own website, account, or unrelated processing.

10. Retention and deletion

We retain information for as long as reasonably necessary for the purposes described above, including providing the service, preserving account and security records, resolving disputes, preventing fraud, maintaining transaction and accounting records, and complying with legal obligations. Different data types have different retention needs, so this policy does not invent a single fixed deletion period for all information.

Browser-local resume content and settings remain under your browser's storage controls unless the product or browser removes them. The AI conversation history feature normally prunes conversations after the period described in Section 4, but the browser may retain information until cleanup runs. Authentication, infrastructure, payment, and model providers may apply their own retention periods and configuration.

You may request deletion through the contact channel below. We will assess the request under applicable law and may retain information that we are required or permitted to keep, such as transaction records, fraud-prevention evidence, security logs, or information needed to establish or defend legal claims. Where appropriate, we may delete, de-identify, or aggregate information instead of retaining it in identifiable form.

11. Security

We use reasonable administrative, technical, and organizational measures appropriate to the nature of the service, which may include encrypted network connections, access controls, dependency and credential hygiene, rate limiting, and monitoring by infrastructure providers. WorkOS is used to manage authentication sessions, and card details are intended to be handled directly by a payment provider.

No internet service, browser, device, or storage method can be guaranteed completely secure. We do not promise absolute security or that unauthorized access, loss, or interruption will never occur. You should use a current browser and device, protect your account and API keys, avoid unnecessary sensitive data, and keep local backups secure. If you believe you have identified a security issue, contact us without accessing data that does not belong to you.

Luc has not claimed SOC 2, ISO 27001, GDPR certification, or any other certification in this policy. Any future certification will be identified accurately and separately.

12. International processing

Luc is based in Singapore and may use infrastructure and service providers that operate in Singapore and other countries. Cloudflare distributes and secures content through a global network. Authentication, AI, payment, and support providers may process information in the countries where they or their subprocessors operate. As a result, information may be transferred to or accessed from a country with different data-protection laws than your own.

Where Singapore's Personal Data Protection Act 2012 (PDPA) applies, we aim to handle personal data consistently with its requirements, including purpose limitation, notification, access and correction, protection, retention limitation, and cross-border transfer obligations. Where other laws apply, we use legal mechanisms and safeguards required for the relevant transfer and service. The operator should confirm its PDPA obligations, data protection officer contact, and any country-specific transfer terms before production launch.

13. Your rights and choices

Depending on your location and the circumstances, you may have rights to request access to personal information, obtain a copy, correct inaccurate information, request deletion, restrict or object to certain processing, withdraw consent, or receive portable information. You may also complain to your local data-protection authority. In Singapore, this may include the Personal Data Protection Commission.

You can manage browser-saved resume data through your browser storage settings or Luc Resume's local-data tools. You can manage Google account permissions at myaccount.google.com/permissions and LinkedIn permissions in your LinkedIn account. You can sign out of an authentication session and contact us for account-related requests. A provider's own controls may affect data that the provider processes independently.

We may need to verify your identity and authority before acting on a request. Some rights are subject to exceptions, including the operator's need to retain records for legal, accounting, fraud-prevention, security, or dispute purposes. We will not discriminate against you merely for exercising a legally available right.

14. Children's privacy

The services are not directed to children under 16. If you are under 16, do not create an account or submit personal information to a service that requires an account unless a parent or guardian provides any consent required by applicable law. Users below the age of legal majority should use account and paid features only with appropriate parent or guardian involvement.

If you believe a child has provided personal information in breach of this section, contact us so we can review and take appropriate action.

15. Changes to this policy

We may update this policy when products, providers, data practices, or legal requirements change. The date at the top of the page shows the latest revision. We will publish the revised policy at this URL and provide additional notice where a change is material or where applicable law requires it. Where required, we will obtain consent before applying a materially different use to information collected earlier.

You should review this policy when using a materially changed service. If you do not agree with an updated policy, you may stop using the affected service and use available deletion or account controls; this does not limit rights you have under applicable law.

16. Contact

The current public contact address for Luc is [email protected]. Please include "Privacy Request" or the relevant product name in the subject line. This address is the currently published site contact and should be monitored as the operational privacy contact. Before production launch or materially expanding processing, the operator must confirm that this address remains active and appoint or identify any additional data-protection contact required by law.