LughPrivacy
What Lugh keeps, why, who helps us run it, and how to delete it.
Last updated: 6 November 2026.
Lugh is provided by Sheldon Fernandez, an independent developer. Contact: [email protected].
The short version
- Lugh reads the travel confirmations you choose to forward to Your Lugh Address. It doesn't read your mailbox.
- We use your data only to run Lugh for you. We don't sell it, we don't show ads, and we don't track you across other apps or websites.
- You can delete your account and everything in it from the app at any time: Profile → Delete account.
What Lugh keeps
| What | Why |
|---|---|
| Account: your sign-in email address, a password (stored only as a secure hash by our database provider) and Your Lugh Address | To sign you in and to know which forwarded emails are yours |
| Forwarded emails: the sender address, subject, date and text of each email you forward to Lugh (attachments are not kept), and whether Lugh could read it | So Lugh can find the bookings in it, show what happened to each forward, and read it again if needed |
| Trips and bookings: what Lugh found or you entered, such as type, supplier, booking reference, dates and times, places, flight numbers and airports, and your corrections | To build your trips, timeline and map |
| Home airport (if you set one in Profile): a three-letter airport code. Lugh may suggest one from your flights, but only you set it | So a flight home joins the trip it ends, and no trip is named after home. You can remove it in Profile at any time |
| Map positions and time zones for the places in your bookings | To draw your journey and show local times. Lugh does not use your phone's location |
| Notification details (if you turn notifications on): a push address for each phone, its platform (iPhone or Android), its time zone, and a record of which notifications were sent | To send you the alerts you asked for, and never the same one twice |
| Usage counters: how many paid place look-ups your account used each day | To keep Lugh's costs under control |
Lugh does not use advertising identifiers, analytics or tracking tools.
How Lugh uses AI
To find the bookings in a forwarded email, Lugh sends the email's sender, subject, date and text (up to about 24,000 characters) to the OpenAI API. Web links in the email, such as tracking links, are removed first and are never sent. Lugh is usually right, but not always; when it isn't sure it marks the booking Needs checking. Anything you correct stays the way you set it.
OpenAI states that data sent through its API is not used to train its models unless the customer opts in (Lugh hasn't), and that API abuse-monitoring logs are kept for up to 30 days unless the law requires longer. Lugh doesn't ask OpenAI to store its requests.
Who helps us run Lugh
| Service | What it does for Lugh | What it receives |
|---|---|---|
| Supabase | Database, sign-in and server functions | Everything in "What Lugh keeps" |
| Postmark | Receives the emails you forward and passes them to Lugh | The forwarded emails. Postmark keeps message content for 45 days by default |
| OpenAI | Reads forwarded emails to find bookings | Sender, subject, date and email text (see above) |
| Geoapify | Finds map positions for places | Place names and addresses only (for example "Hotel Artemide, Rome, Italy"), sent from our server. Never your name, email or account |
| Expo, with Apple's push service (iPhone, iPad) and Google's Firebase Cloud Messaging (Android) | Delivers notifications | Your device's push address and the notification text, for example "Booking added" and the supplier or trip name. Expo states it does not store notification content after delivery |
| Apple Maps (iPhone, iPad) and Google Maps (Android) | Draws the maps in the app | Map requests go from your device to Apple or Google, which see your device's network address and the area of the map being shown. Lugh does not send them your account or your bookings |
| Cloudflare | Hosts this website and forwards [email protected] | Website visits, and emails you send to support in transit |
Place look-ups use data © OpenStreetMap contributors. Lugh does not use Google Analytics, Firebase Analytics or any other analytics service.
If you write to support or send beta feedback from the app, we receive your email address, what you wrote, and the lines the app adds (Lugh version, your device's system version and model). Nothing about your trips is added.
How long we keep it
- Your account, forwarded emails, trips and bookings: until you delete them or delete your account.
- Delivery checks for notifications: about 3 days.
- Place positions are shared between all travellers as plain place names with no link to any account, so the same hotel isn't looked up twice. These are not personal data and are kept.
- Service providers keep their own copies for the periods described above or in their policies.
- Lugh's database is hosted by Supabase. Any backups it holds are overwritten on its normal schedule after you delete your account.
Deleting your account
In the app: Profile → Delete account…, type DELETE and confirm. Lugh deletes your sign-in, Your Lugh Address, forwarded emails, trips, bookings, devices and notification records in one step. If anything fails, nothing is deleted and the app tells you. Copies held by the providers above expire under their own policies (for example, Postmark after 45 days).
If you can't use the app, see Delete your account.
Your rights
You can ask for a copy of your data, ask us to correct or delete it, or object to how we use it. Email [email protected]. You may also complain to your local data protection authority.
Children
Lugh is for people organising their own travel and isn't directed at children.
Changes
If this policy changes, we'll update this page and its date. If a change matters to how your data is used, we'll also email the address you sign in with.