Privacy Policy

1. What we store

Only what the app needs to work:

• Account details: your email address, your name, and your password (kept only as a one-way hash by our sign-in provider; we can't read it).
• Your planner data: tasks, goals, events, notes, focus sessions, mock and sectional scores, categories and settings. It is stored as one document linked to your account.
• Plan details: your plan, when it ends, and whether you've seen the welcome message. If you pay, a payment record: date, amount, months bought, and any note we add (never card or bank details; those go straight to our payment processor, Razorpay).
• Reminder settings: if you turn on background notifications, your browser's push address, which is what lets us send you reminders.
• Live focus-timer state, so the timer stays in sync between your devices.
• Google connection, only if you choose it: see "Google Calendar and Google Tasks" below.
• Security records: sign-in and session times managed by our sign-in provider, and a log of actions our admin takes on accounts (for example "extended plan"), which can include your email.

2. What our admin console can see

To run the service we can see, per account: email, name, plan and dates, when you were last active, and counts (for example how many tasks you have and finished this week). The console never displays your task contents. Like any operator of a database, our team technically has the ability to read stored data; we only do so to fix a problem you ask us to look into, to investigate abuse or a security issue, or when the law requires.

3. What we don't do

• We don't show ads or sell, rent or trade your data, ever.
• We don't use your content to train AI models or build advertising profiles.
• We don't use analytics or advertising cookies. The app stores your sign-in session and your own data in your browser's local storage so it works and works offline.

4. Who else handles data (our service providers)

We use a few providers to run the app. They process data only on our behalf:

• Supabase: database, sign-in and file storage (including the nightly backup).
• Netlify: our web host, which serves the app's files.
• Cloudflare Turnstile: a privacy-friendly bot check on the sign-in and sign-up forms. It sees your browser and network details to tell people from bots.
• Sentry: error reports when the app crashes. Reports contain technical details (error message, browser type, the page address without any query or sign-in tokens). We strip out account details and never send task contents, and we ask Sentry not to store IP addresses.
• NVIDIA (AI assistant): only if you use the AI assistant. When you ask it something, we send NVIDIA's AI service your question and a copy of your planner data (tasks and notes, events, goals, quick thoughts, weekly notes, mock scores and syllabus) so it can answer. We never send your password, sign-in details or Google connection. We don't keep your questions or the answers on our servers, and we ask the provider not to use them to train models. If you don't want this, don't use the assistant.
• Have I Been Pwned: when you choose a password we check whether it appeared in a known breach. Only the first 5 characters of a hash of the password leave your device; the password itself never does.
• Google Fonts: the app loads its display font from Google, which sees your IP address when it does.
• Email delivery: confirmation and password-reset emails go through Brevo.
• Razorpay: processes your payment (UPI, card or net banking) under its own terms and privacy policy and sends you the receipt. We receive only the payment id, amount and status.
• WhatsApp (Meta): if you message us for support, that conversation happens in WhatsApp under WhatsApp's own terms.

5. Google Calendar and Google Tasks

If you connect Google, the app asks for access to your Google Calendar and Google Tasks (the calendar and tasks scopes). We use it only to sync in both directions: your app events and tasks appear in Google Calendar and Google Tasks, and changes you make there come back into the app.

We keep a Google refresh token on our servers (in a table no browser or app user can read) so syncing works in the background. We never share Google data with anyone, never use it for advertising, and never use it to train AI or machine-learning models. No human reads it except to fix a problem you ask us to look at, for security, or when the law requires.

Life Organiser's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements.

You can disconnect at any time in Settings, or at myaccount.google.com/permissions. Disconnecting or deleting your account revokes our access and deletes the stored token. Events and tasks already copied into your own Google account stay there, since they're yours.

6. How long we keep it

• Your account and planner data: until you delete your account. A free-trial account that is never used after the trial ends is deleted automatically once it has been inactive for 30 days; we email you a week before and again afterwards.
• Backups: we take a nightly backup and keep the last 14. Deleted accounts disappear from backups within 14 days.
• Payment records: kept for our accounting and tax records even after an account is deleted; they are no longer linked to a sign-in.
• One set of 14 days per email: when you delete your account we keep a one-way hash of your email address (not the address itself) so the same address can't claim another 14 days.
• The admin action log: kept for security, and may still mention your email after deletion.

7. Your choices and rights

You can do all of this yourself, or email us and we'll help:

• See and export your data: Settings → Export data (a JSON file).
• Correct it: edit it in the app, or change your name and password in Settings.
• Delete it: Settings → Delete account. It removes your sign-in, planner data, reminders and Google connection at once. It can't be undone.
• Turn off reminders or disconnect Google whenever you like.

If you live in India, you have rights under the Digital Personal Data Protection Act, 2023, including access, correction, erasure and grievance redressal. If you live in the EU/UK, you have similar rights under the GDPR. Email us and we'll respond within 30 days.

8. Security

Data is encrypted in transit. Access rules in the database stop one user from reading another's data, and your account can't change its own plan. No system is perfectly secure; if something goes wrong that affects you, we'll tell you promptly.

9. Children

Life Organiser isn't aimed at children under 13 and we don't knowingly collect their data. If you think a child has signed up, email us and we'll delete the account.

10. Changes to this policy

If we change this policy in a way that matters, we'll tell you in the app or by email. The date at the top shows when it last changed.

11. Contact and grievances

Life Organiser, Aurangabad, Maharashtra 431001, India. Email: help.lifeorganiser@gmail.com.