Privacy Policy

This Privacy Policy explains what personal information Lifvara collects, why, who else handles it, how long it is kept, and the choices and rights you have. If something is unclear, write to us at remote.dev.codes@gmail.com.

In short:

• You put information into Lifvara to keep your own records. We use it to run Lifvara for you.
• Lifvara is free at launch. It shows no advertising, does not sell your personal information, and does not share it for advertising.
• A small number of service providers process information so Lifvara can work: hosting, the database, image storage and email delivery (section 9).
• Friends is optional. Being friends shares only your name, @handle and photo. Anything else reaches other people only when you share it (section 11).
• You can download your data and delete your account yourself, at any time, in Settings › Data & privacy.
• Some copies outlive deletion for a limited time: backups, provider logs, security records and safety reports (section 15).
• Images you add to notes and pages can be opened by anyone who has their direct storage link (section 11). Don't add images you need to keep strictly private.
• Lifvara is run by one person. We can't promise a reply at any particular hour, and we say below what we do when something is urgent (sections 2 and 11).

1. Who we are

Lifvara is a personal productivity web app for habits, goals, time tracking, calendar, notes and pages, nutrition and money records, with Friends, a feature for keeping goals with other people. It was previously called Lifestack, and you may still see that name in some places while the change is finished.

Quenori is a brand name under which Lifvara is published. Neither Lifvara nor Quenori is a company. Lifvara is operated by an individual, Akshay Sunil Shinde, based in Mumbai, Maharashtra, India ("Lifvara", "we", "us"). Lifvara is not run by a company.

Postal address for correspondence and legal notices: 406, Golden Park, Kalyan, Thane, Maharashtra – 421301, India

We decide why and how your personal information is used in Lifvara. Under India's Digital Personal Data Protection Act, 2023 that makes us the Data Fiduciary; under the EU and UK General Data Protection Regulation, where they apply, the controller.

2. How to contact us

For questions about this policy, requests about your information, and complaints: remote.dev.codes@gmail.com.

Grievance Officer: Akshay Sunil Shinde. The operator personally answers questions about how your information is used and handles complaints and grievances. Write to remote.dev.codes@gmail.com, or by post to the address below, and say what the complaint is about, where the content is (a link if there is one), and how to reach you.

If it's urgent, put URGENT in the subject. That means content showing you or someone you act for naked or in a sexual act, an image altered to look like that, someone impersonating you, or an order from a court or an authorised government officer. We act on these first and as fast as we can.

Please write from the email address on your Lifvara account, or include your @handle, so we can find your account. We will never ask for your password.

Postal address for correspondence and legal notices: 406, Golden Park, Kalyan, Thane, Maharashtra – 421301, India

3. What this policy covers

This policy covers personal information processed through Lifvara: the website, the signed-in app, published pages (addresses starting /p/) and the emails Lifvara sends. It does not cover Google's or GitHub's own services when you use them to sign in, or other websites you reach from Lifvara.

4. Who can use Lifvara

You must be at least 18 years old to create or use a Lifvara account. When you sign up, and whenever we ask you to agree to updated terms, you confirm that you are 18 or older. We rely on that confirmation: we don't ask for your date of birth or verify your age with documents.

Lifvara is not designed for or directed at children. If we learn that an account belongs to someone under 18, we will suspend it and, unless the law requires us to keep something, delete it and its data (see section 16). If you believe someone under 18 is using Lifvara, write to us.

5. Information you give us

Your account

• Name, email address and @handle (your username). Your email address is used to sign you in and for account emails.
• Password, if you set one. We store only a one-way hash of it; nobody, including us, can read your password back.
• Phone number, only if you add one to your profile. Lifvara does not currently use it for anything: not for sign-in, verification or messages.
• Profile photo, if you upload one (JPEG, PNG, WebP or GIF, up to 5 MB).
• Your agreement to the Terms and this policy: which versions you agreed to, when, how (sign-up by email, Google or GitHub, or the agreement step later), and that you confirmed you are 18 or older. We don't record your IP address or device with it.

Things you record

Everything you choose to enter, including:

• Habits and goals: habits, their schedules, and the days you check them off.
• Time and calendar: timers, time entries, categories, and calendar entries with their descriptions. The calendar shows your own time entries; it does not connect to an external calendar.
• Notes and pages: page titles, content, icons and structure, images you add, and "classic notes" (an older notes feature) with their images and version history.
• Nutrition and fitness: foods, meals and nutrition targets and, only if you add them, your age, sex, height, weight, target weight, goal, activity level, training frequency and dietary preference. Lifvara uses these only to estimate nutrition targets for you.
• Money: accounts and balances, expenses, earnings and income plans, subscriptions, loans and repayments, credit cards and their transactions, investments and holdings, transfers and categories, and transactions imported from bank statements (including the original description text, references, the file name and a fingerprint of the file, not the file itself).

Money and body details can be sensitive. Lifvara doesn't require any of them; it stores what you choose to enter. Please don't put full card numbers, passwords or government identity numbers in free-text fields.

Friends

Friends is an optional feature for keeping goals with other people. If you use it, Lifvara stores:

• your @handle and whether people can find you by it;
• friend requests, friendships and people you block;
• a one-way code of your invite link, never the link itself;
• groups you create or join, and invitations to them;
• shared goals, your check-ins and their notes, and encouragement and comments you give;
• which of your habits you link to a goal;
• messages you send in direct and group conversations, including progress snapshots you choose to send;
• which of your pages you share with a group;
• reports you make: your reason, anything you write, and up to 500 characters of what you reported.

Section 11 says who sees each of these.

Information stored in an earlier version of Friends stays in your account, is included in your data download where it's yours, and is deleted with your account.

If you write to us

If you email us, for example to ask a question or report a published page, we keep your email address and what you wrote in our mailbox for as long as we need them to deal with it. Anyone can do this, with or without an account.

6. Information collected automatically

• Security records. Lifvara records security events such as sign-ins, refused sign-in attempts, password resets, account connections, data downloads and account deletions. Each record holds the type of event, a reason code, the sign-in provider and a one-way code derived from your account, never your email address, IP address, password or any token. They are kept for one year (section 15).
• Limits on repeated attempts. To slow down password guessing and abuse, Lifvara keeps short-lived counters keyed by a one-way code of your email or IP address, not the address itself.
• Hosting request logs. Every request to Lifvara is handled by our host, Vercel, which processes your IP address, browser details, the address requested and the time. For some requests the address includes words you typed, for example a page search.
• Usage analytics. Lifvara uses Vercel Web Analytics to count page views. Lifvara sends it the page's path only: no query string, and with the ids of your notes, pages, groups and conversations replaced by a placeholder. Vercel Web Analytics does not use cookies.
• Time zone. Your browser's time zone is stored in a cookie so days are shown in your local time.

Lifvara does not use your location, contacts, camera or microphone, and uses no third-party advertising or tracking scripts.

7. Information from Google and GitHub

If you sign up or sign in with Google or GitHub, we receive your account id with that provider, your email address and whether the provider has verified it, your name, and the address of your profile photo. We ask only for basic profile access (openid email profile for Google; read:user user:email for GitHub). We don't receive your Google or GitHub password, and we don't store their access tokens.

If your profile photo comes from Google or GitHub, it is loaded from their servers, so they receive a request (including the viewer's IP address) whenever someone's browser shows it.

8. How and why we use your information

We don't send marketing email. We don't use your information for advertising, and we don't use your content to train AI models.

Legal bases

• India (Digital Personal Data Protection Act, 2023): you give us your information yourself so that you can use Lifvara, and you agree to the Terms and confirm you've read this policy when you sign up. We use it for that purpose. Some processing, such as keeping security records and complying with the law, relies on the legitimate uses the Act allows. You can stop at any time by deleting the information or your account (section 16); that doesn't affect what was done before.
• Where the GDPR or UK GDPR applies: performance of a contract (running your account and the features you use); legitimate interests (security, preventing abuse, counting page views, handling reports); and legal obligation (where the law requires us to keep or disclose information).
• Body details. Age, sex, height and weight can count as health information. We save them only if you tick the box in Your details that agrees to their use for estimating your nutrition targets. That tick is your explicit consent where the law requires it. You withdraw it by clearing those details, which you can do at any time; your other records aren't affected. Details saved before that box was added stay until you change or clear them, and the next time you save them you're asked to tick it.

9. Service providers

These providers process personal information on our behalf, to provide their service to Lifvara.

PDF statement import (not currently available)

Lifvara contains a PDF bank-statement import that would use Google's Gemini API to read transactions from a statement. It is not available today: it is switched off because no Gemini credentials are configured, and no statement or text is sent to any AI service. Before it is ever switched on, we will update this policy and tell you. If it is switched on, it would work like this: the PDF is read on our server in memory and never saved; card numbers, labelled account numbers and Indian PAN numbers are masked (best effort; other details on the statement are sent as printed); the text is sent once to Google's Gemini API, which returns the transactions it finds; and nothing is saved until you review and confirm each transaction. CSV and Excel imports never use an AI service. Nothing else you write in Lifvara is sent to an AI service.

10. When we share information

We don't sell your personal information, rent it, or share it with anyone for advertising. We share it only:

• with the service providers in section 9, for the service they provide;
• with the people you choose to share content with (section 11);
• when the law, a court order or a lawful request from a public authority requires it, and then only what is required;
• when the law requires us to report an offence (section 11);
• to protect someone's safety, or to investigate fraud, security incidents or abuse of Lifvara;
• if Lifvara is ever transferred to someone else, in which case we will tell you before your information becomes subject to a different privacy policy, and you can delete your account first.

11. Who can see your information

By default, everything you record is visible only to you.

• Published pages: a page you publish can be read by anyone who has its link, including the images in it, until you unpublish or delete it. Its link is long and hard to guess, and published pages ask search engines not to index them, but anyone who has the link can read and copy the page.
• Shared classic notes: people you shared a classic note with in the past can still see and edit it. Classic notes can no longer be shared with new people.
• Profile photo: stored with our image provider and viewable by anyone who has its address.

Friends

Being someone's friend shares only your name, @handle and profile photo. Friends never shows anyone your notes, pages, time entries, calendar, habits, nutrition or money records unless you share them in one of the ways below. Nobody is ever shown your email address.

More about how this works:

• Your @handle. Your username is your @handle. Nobody can find you by it unless you turn on Let people find me by my handle in Friends › People. It's off by default, including for accounts that existed before this choice was added.

• Invite links. Anyone who opens your invite link can send you a friend request, even if you can't be found by your handle. You're friends only if you accept. Links last 14 days, and you can replace or turn off a link at any time.

• Blocking. If you block someone, they can't find you, ask you anything or message you, and they lose access to what you own. They aren't told. If you're both in a group you stay in it: they no longer see you there, and you see them collapsed.

• What other people do. People you share with can remember, screenshot or copy what they see, and we can't undo that.

• Deleting a message. You can delete a message you sent, for everyone in the conversation. If someone reported it first, the report keeps its copy (section 15).

• Messages are not end-to-end encrypted. They are stored in our database like the rest of your account, so someone with access to that database could read them.

• We don't monitor conversations. We don't scan messages, automatically or by hand. We see message content only:

  1. when someone reports it, and then we see the report: its reason, what the reporter wrote, and up to 500 characters of what was reported, not the rest of the conversation;
  2. when the law or a lawful order requires it;
  3. when it's needed for a specific report of serious harm, or a specific security incident, and the report alone isn't enough;
  4. when you ask us in writing about your own conversation.

  We look at no more than the purpose needs, and record each decision.

Reports, moderation and safety records

• Reporting. You can report people and content inside Friends, and any published page from the link at its foot. Anyone can write to us (section 2). The person reported isn't told who reported them.
• Who reviews reports. The operator, personally. We're told that a report has arrived, without its content, and review it as soon as we reasonably can. There is no moderation team and no automated review.
• What we can do. Dismiss a report, remove content, make a published page private, or suspend or close an account. We keep a record of what we did and why. That record doesn't name the people involved.
• If we remove something, other people see a short note in its place, or the page or shared page stops being available. We keep the original in the report, where nobody but us can read it, for at least 180 days, for any investigation, and as section 15 says. If a report concerns an offence that the law requires us to report, we report it to the appropriate authority.
• Suspended accounts. A suspended account can't sign in, can't be found by its @handle or reached by its invite link, and its published pages stop being public. What it already sent stays where it is unless we remove it.

Images in notes and pages

Images you add to notes and pages are stored with Cloudinary. Lifvara only shows them in the app to people who can see that note or page, but the stored image itself can be opened by anyone who has its direct Cloudinary address. The address is long and hard to guess and Lifvara doesn't hand it to other people, but if it is copied or leaked (for example from a page you published, a link you shared, or browser history), the image can be viewed without signing in. Please don't put images you need to keep strictly private into notes or pages. We will update this section if this changes.

12. International transfers

Lifvara is operated from India and our providers are based in the United States and elsewhere, so your information is processed outside the country you live in, including in India, the United States and Japan, and wherever else those providers or the companies they use operate.

• For people in India, the DPDP Act allows transfers outside India except to countries the Government restricts.
• Where the GDPR or UK GDPR applies: you send your information directly to us in India. For what our providers do with it, we rely on the safeguards in their data processing terms, such as the EU Standard Contractual Clauses, the UK addendum to them, and certification under the EU-US Data Privacy Framework. Write to us for details of the safeguard that applies to a provider.

13. How we protect your information

• Connections use HTTPS. Passwords are stored as one-way hashes. Email links are single-use and time-limited, and only a hash of each is stored.
• Sign-in, sign-up, password reset, image uploads, data download and account deletion are limited against repeated attempts.
• Every request for your information is checked on our server against your account; hiding a button is never the only protection.
• Our logs record codes, not the content of your records. Security records identify accounts only by a one-way code.
• Only the operator has access to the production database and the providers' dashboards. Our providers can reach what they host, as their own terms allow.

No system is perfectly secure, and we can't promise that your information will never be accessed without authorisation. Lifvara doesn't currently offer two-factor authentication, so please use a strong password you don't use anywhere else.

If a personal data breach affects you, we will tell you and the authorities as the law that applies requires.

14. Cookies and similar technologies

Lifvara uses only cookies it needs to work, plus two preference cookies. It uses no advertising or cross-site tracking cookies, so it doesn't show a cookie banner. Some names below keep the earlier product name; that changes nothing about what they do.

15. How long we keep information

We may keep information longer when the law requires it, or for as long as needed to deal with a legal claim or a security investigation.

16. Deleting your information and your account

You can delete individual records, pages and images at any time. Section 15 says how long an image stays in storage after you remove it.

To delete your account, go to Settings › Data & privacy › Delete account. You confirm with your email address and password, or, if you sign in only with Google or GitHub, by having signed in within the last 10 minutes. Deletion is immediate and can't be undone, so download your data first if you want a copy. You can delete your account even if you haven't agreed to updated terms.

When you delete your account:

• Straight away, in one step, your account and everything you recorded are removed from our database, and you're signed out everywhere.
• Straight after, Lifvara removes your images from Cloudinary, with automatic retries (section 15).
• Things shared with other people: classic notes you own are deleted for everyone you shared them with. In Friends, goals you own are deleted, including other members' check-ins on them; your direct conversations are deleted for both people, including the other person's messages; your group messages are deleted; pages you shared stop being shared; and groups you own pass to the longest-standing member.
• What remains for a time: reports, security records (which don't name your account), copies in backups and provider logs until they expire, and image copies in Cloudinary's delivery network (section 15).

17. Downloading your data

Settings › Data & privacy › Download your data gives you one JSON file with everything in your account: profile, sign-in methods (not passwords), agreement records, habits, time, pages, nutrition, money, classic notes and any Friends data. You can download it even if you haven't agreed to updated terms.

Its limits: images are included as links, not as files (download them while signed in); it leaves out your password hash and security tokens, whether anyone blocked or reported you, other people's content (such as messages they sent you), and security records, which aren't linked to your account in a way we can look up.

18. Your rights

Depending on where you live, you may have the right to:

• access your personal information and how it is used: use the download (section 17) or write to us;
• correct or update it: most of it you can edit directly; your email address can't yet be changed in the app, so write to us;
• erase it: delete records, or your whole account (section 16);
• withdraw consent: delete the information or your account;
• nominate someone to exercise your rights if you die or become unable to (India);
• object to or restrict processing, and data portability (where the GDPR or UK GDPR applies);
• complain to us, and to a data protection authority (section 19).

To make a request you can't complete in the app, write to remote.dev.codes@gmail.com from your account's email address. We may ask you to confirm the request from that address so we know it's you. We will respond within the time the law that applies to you allows, and tell you if we need more time and why.

We don't sell personal information or share it for cross-context behavioural advertising, as those terms are used in California law, and we don't use sensitive personal information to infer characteristics about you.

19. Complaints

If you're unhappy with how we handled your information, please write first to the Grievance Officer at remote.dev.codes@gmail.com (section 2). We will look into it, tell you how it is going, and tell you the outcome. Where UK data protection law applies, we acknowledge a complaint within 30 days of receiving it.

You can also complain to a data protection authority:

• India: the Data Protection Board of India, once it accepts complaints. Under the DPDP Act you must first use our grievance process.
• EU/EEA: the data protection authority where you live or work, or where you think the problem happened.
• UK: the Information Commissioner's Office (ico.org.uk).

20. Free service and future paid features

Lifvara is free at launch and collects no payment information. If we introduce paid features, we will update this policy before collecting any payment information and name the payment provider, and paid features will be optional.

21. Changes to this policy

When we change this policy, we publish the new version here with a new version and date. If a change materially affects how we use your information, we will tell you in the app before it applies to you and ask you to agree again before you continue using your account; you can still download your data or delete your account instead. Where we reasonably can, we will publish a material change at least 14 days before it takes effect.

22. Contact

Lifvara is operated by Akshay Sunil Shinde, an individual based in Mumbai, Maharashtra, India.

• Email: remote.dev.codes@gmail.com
• Postal address for correspondence and legal notices: 406, Golden Park, Kalyan, Thane, Maharashtra – 421301, India