Privacy Policy
1. Who we are
This Privacy Policy explains how Life GPS (hereinafter "the App", "we", "us", "our") collects, uses, and protects your personal data.
Controller (data controller under GDPR Article 4):
- Legal entity: WAADSU s.r.o., a limited liability company incorporated under the laws of the Czech Republic
- Registered address: Hlávkova 619, 535 01 Přelouč, Czech Republic
- Contact email: privacy@lifegpsos.com
- Support: support@lifegpsos.com
Data Protection Officer (DPO): The founder acts as the point of contact for data-protection matters at privacy@lifegpsos.com. Under GDPR Article 37, appointment of a separate DPO is not required at our current scale (fewer than 250 employees, no large-scale systematic monitoring, no large-scale processing of special-category data). We will appoint an independent DPO before the App exceeds ~50,000 active users in the EU/EEA or begins processing special-category health data at scale.
2. What data we collect
We collect the minimum needed to guide you day to day rather than guess. A navigator needs enough context to know where you are and where you are trying to go. The same is true here.
We use the information you give Life GPS to provide and adapt the service to you. We also collect limited usage and technical information needed to understand whether the product is working properly and where it needs improvement.
We do not sell personal data, and we do not use this information to sell advertising.
2.1 Data you provide directly
| Category | Examples | Legal basis (GDPR Art. 6) |
|---|---|---|
| Account identifiers | Sign in with Apple (optional); anonymous device use is default | Contract (6(1)(b)) |
| Profile | First name, age | Contract |
| Life balance data | Life balance settings and chosen proportions across areas of life | Contract — core service |
| Quiz answers | Sphere-specific responses (~90 items) | Contract — core service |
| Desires & pains | Free-text entries describing goals and obstacles per sphere | Contract — core service |
| Tasks & programs | Tasks, daily check-ins, 21-day program progress, notes, reflections | Contract — core service |
| Social graph (if used) | Contacts you invite, supportive connections | Consent (6(1)(a)) — explicit opt-in per invite |
2.2 Data collected automatically
| Category | What | Legal basis |
|---|---|---|
| Usage and technical data | Basic information about how the app is used, such as screens viewed and setup progress, together with device, operating system and app-version information | Legitimate interest — to operate, maintain and improve the product, understand where people encounter problems, and diagnose technical issues |
| Error tracking (Sentry) | Technical details of an error, device information, app version and a record of preceding actions that does not identify you | Legitimate interest — fix crashes |
| Sign-in information (Supabase) | Last sign-in timestamp, IP (30-day retention), provider | Legitimate interest — security |
2.3 Data from third parties
- Apple Sign In — Apple ID email (or anonymized relay if you chose "Hide My Email"), when you choose to sign in
3. How we use your data
- Provide the core service — calculate balance, track sphere progress, generate 21-day programs, manage tasks.
- Answer permitted public questions — with consent, the submitted question, interface language and limited relevant public conversation context can be processed by external AI. The saved personal model, profile and address book are not attached.
- Improve the product — aggregated analytics inform roadmap when analytics is enabled.
- Communicate — support email; optional product updates.
- Security — detect suspicious logins, protect account integrity.
- Legal compliance — respond to lawful requests when required.
We do NOT:
- Sell your data to advertisers or data brokers.
- Use your data to train foundation AI models without consent (see Section 5).
- Share desires / pains / reflections with any third party other than strictly necessary processors (Supabase, OpenAI for permitted public questions).
4. Third-party services (sub-processors)
| Service | Role | Data accessed | Location |
|---|---|---|---|
| Supabase | Online services, data storage and sign-in | Account + profile (when signed in) | EU (Frankfurt) |
| Apple (Sign in with Apple) | Sign-in provider (optional) | Email / relay email | USA |
| PostHog | Product analytics, if enabled | Usage events | EU or USA (configurable) |
| Sentry | Error tracking (no personally identifying information), if enabled | Technical details of an error and device information | EU (Frankfurt — de.sentry.io) |
| OpenAI (through our server) | Answers to permitted public questions | Public question + interface language + limited relevant public conversation context | USA |
Data transfers outside EU/EEA: Standard Contractual Clauses (SCC) approved by the European Commission, or EU-US Data Privacy Framework where applicable.
5. AI features
Apple App Review Guideline 5.1.2(i) disclosure:
Life GPS includes an AI-assisted chat. Guided setup and the personal life model remain local. With your consent, permitted public questions can be answered through external AI:
- The permitted public question, interface language and limited relevant public conversation context are sent to OpenAI through our own server.
- The provider processes data and returns a response.
- Messages are not used to train foundation models under our provider terms / zero-retention where supported.
- Chat history is stored on your device, not as a chat table in Supabase. Deleting the account / resetting the device clears it.
What is not attached: the saved personal model, profile, life map, contacts, health and faith records, goals, pains and guided-setup answers. Follow-up context is limited to the permitted public conversation. Private route conversations are not attached as general chat history.
Right to opt out: decline the in-app consent prompt, or turn off external tools in Privacy. Local path and scripted replies keep working.
You can report any AI reply in the app (long-press → Report) or email support@lifegpsos.com.
6. Data retention
| Data | Retention |
|---|---|
| Active account | Until your account is deleted |
| Deleted account | Hard-deleted within 30 days (backups purged within 90 days) |
| Sign-in records (IP addresses and times) | 30 days |
| Error logs (Sentry) | 90 days |
| Analytics (PostHog) | 12 months; aggregated counts indefinitely |
| AI chat history | On device until you reset / delete account |
| Legal compliance records | 3 years post-account-deletion |
7. Your rights
Under GDPR / CCPA / similar laws:
- Access — email privacy@lifegpsos.com (in-app JSON export — following release)
- Rectification — Edit profile in Settings, or email
- Erasure — Settings → Delete account; processed within 30 days
- Portability — email privacy@lifegpsos.com (same as Access; in-app export — following release)
- Restriction — Email privacy@lifegpsos.com
- Objection — Email privacy@lifegpsos.com (analytics only runs if configured; no Settings toggle yet)
- Withdraw consent — Disable feature in Settings
- Lodge a complaint — With your local data protection authority (EU: edpb.europa.eu)
Response time: within 30 days (extendable to 60 for complex requests).
8. Security
- Encryption in transit: TLS 1.2+
- Encryption at rest: AES-256 (Supabase)
- Access control: only authorized personnel; logged and audited
- Information that keeps you signed in is kept in the device's protected storage
- Access restrictions on individual database records
- Incident response: notify users + supervisory authority within 72 hours per GDPR Art. 33
9. Children
Life GPS is not intended for users under 16 years of age in the EU/EEA, or under 13 in the United States. We do not knowingly collect data from children below these ages. Contact privacy@lifegpsos.com if you believe we have.
10. Cookies and information stored on your device
The mobile app does not use browser cookies. It uses:
- Protected storage on your device — information that keeps you signed in
- Other information on your device — saved profile data, task progress and preferences. Cleared on logout.
11. Changes to this policy
We may update this policy. When we do:
- "Last updated" date changes.
- Notify in-app at least 14 days before material changes take effect.
- Material legal changes may require renewed consent.
12. Contact
| For | Contact |
|---|---|
| Privacy / data rights | privacy@lifegpsos.com |
| Account / product support | support@lifegpsos.com |
| Abuse / AI content reports | support@lifegpsos.com |
| Business / press | hello@lifegpsos.com |
| Legal / DPO | WAADSU s.r.o., privacy@lifegpsos.com |
13. Supplemental jurisdictional notices
13.1 California residents (CCPA / CPRA)
You have the right to know what categories of personal information we collect and to opt out of "sale" or "sharing". We do not sell or share your information. Contact privacy@lifegpsos.com.
13.2 Brazilian users (LGPD)
LGPD rights are substantially similar to GDPR. Contact our Controller above.
13.3 Russian users (152-FZ)
If located in Russia, you have rights under Federal Law No. 152-FZ. Requests via Section 12 contacts. Response within 30 days.
13.4 Other jurisdictions
Local data protection laws apply. We default to the stricter standard.