Privacy & GDPR

What Lucerna does to keep user data safe — and the two rules your integration must follow.

The two rules

1. userId is your app's id (u_42), never an email.
2. No personal data in traits. Traits are targeting rules — they travel with your rule set in plain text. plan: "pro", beta: "true", domain: "acme.com" are fine. Emails, names and phone numbers are not.

Email and name belong in People: pass them to identify({ email, name }) and they're kept as separate fields, stored encrypted at rest, and only ever shown masked (s•••@acme.com).

What leaves the device

@lucerna-dev/identity talks to exactly one endpoint: on every change it upserts the person to People, authenticated by the apiKey you pass to createIdentity(). Adopting the package is the decision to transmit — there is no second, hidden wire, and anonymous visitors are excluded unless you set syncAnonymous. Storing the id on the device is separately opt-in and consent-gated (see persisting).

One key, many doors

Access is a property of the key, not of a product. Besides the scaffolded per-product keys, you can create your own key and grant it exactly what it needs:

curl -X POST https://api.uselucerna.app/v1/workspaces/{id}/keys \
  -H "Content-Type: application/json" \
  -d '{"name": "CI deploy", "environment": "production", "scopes": ["people:identify", "gates:events"]}'

The key (ck_key_…) works on every endpoint its grants cover and nothing else — a key without people:erase gets a 403 from the erasure endpoint no matter what else it can do. The full secret is shown once, at creation; revoke and re-mint to rotate.

The publishable browser key is deliberately write-only: it can create and update people, but the API never echoes stored profile data back to it — so shipping it in your bundle can't leak anything.

Deleting a user’s data (erasure)

One call erases a person everywhere — their People profile and their Gates experiment exposure records:

curl -X POST https://api.uselucerna.app/sdk/v1/people/erase \
  -H "Authorization: Bearer ck_srv_people_prod_…" \
  -H "Content-Type: application/json" \
  -d '{"appUserId": "u_42"}'

You can also erase by email ({"email": "s@acme.com"}) — matching runs on a keyed hash, nothing is decrypted. The call is idempotent: erasing someone unknown deletes 0 rows and returns ok.

Use your People server key for this endpoint.