Privacy policy

In short

Everything is stored on your device first. An account is optional.
Let It Go text and voice recordings are never sent anywhere.
No ads in the app and no data selling; what you write is not processed by AI. Ad measurement happens only if you allow it, and only for install, trial and purchase.
You can export your data from the app and delete all of it whenever you like.

1. Data controller

The data controller for your personal data is Levori. For anything about this policy or your data, write to destek@levori.app.

2. On your device first

Levori is local-first. Your Resets, breathing sessions, check-ins, Inner Compass answers, intentions, affirmations, rituals and app preferences are written to a database on your phone first.

If you use Levori without an account, these records stay only on your device and are not sent to Levori’s server. Reminder notifications are scheduled on your device too; no record is kept on the server to send them.

3. Never sent anywhere

Let It Go text. What you write is burned on screen; it is not stored even on your device and is not part of the export.
What you write in your own words during a Reset. The text you type at the “What’s most on your mind?” step is not saved.
Voice journal and voice notes. Your recordings stay only on your device; they are never uploaded, listened to or analysed. That is why they are not backed up even if you have an account.
What you listen to in soundscapes. The sounds ship inside the app; what you play and for how long is not sent.

4. What the server keeps if you create an account

An account is optional. You can create one with a one-time code sent to your email, with Sign in with Apple or with Google. With an account, a backup of the following records is synced to Levori’s server so you can pick up where you left off on a new phone.

Account details: your email address, your display name if you gave one, your language and time zone, your sign-in method (email, Apple or Google) and the account identifier that method gives you.
Reset sessions: time and duration, the need and tags you chose, your fullness rating before and after, the direction you chose.
Breathing sessions: which technique you used and when.
Check-ins: the mood you chose, your energy level and your optional note.
Your Inner Compass answers.
Your intentions and steps, the affirmations you wrote, your rituals and your app preferences.
Session records: only a hash of the session token, its validity dates and the technical description of the app that opened the session (user agent).
Security log: the type and time of events such as sign-in, sign-out and account deletion, with a keyed hash of the IP address. The IP address itself is not stored.
Sign-in codes: your email address and only a hash of the one-time code; a code is valid for 10 minutes.
Subscription status: the product, status and period end received from RevenueCat.

Check-ins and fullness ratings can say something about how you feel. They are sent to the server only if you create an account and only as a backup; they are never used for diagnosis, profiling or advertising.

5. Processed even without an account

Subscription validation. Purchases are made through the App Store or Google Play. RevenueCat validates the purchase information from the store under an anonymous identifier created by the app and passes the subscription status (product, status, period end) to our server. Without an account this record is not linked to you; when you create an account, the RevenueCat identifier is linked to your Levori account identifier. Your email address is not sent to RevenueCat.
Technical connections. The app connects to Levori’s server to check the app version and to Expo’s update server to receive updates. These requests carry technical information such as the app version and platform and, because of how the internet works, your IP address. Your personal records are not included.
Ad measurement — only if you allow it. To measure which ad brought you to Levori, Meta’s and Google’s (Firebase Analytics) measurement tools are used. If you allow it, your advertising identifier (on iOS only with app tracking permission), device and app information and install, trial and purchase events are sent to these networks; trial and purchase events are sent through RevenueCat. If you don’t allow it, these tools are never started; on iOS only Apple’s measurement that is not linked to you (SKAdNetwork) may work. Your mood, Resets, check-ins and writing are never sent to these networks. You can withdraw at any time in Settings → Ad measurement (on iOS also in iOS Settings → Privacy → Tracking).

6. Purposes and legal bases

Your data is collected electronically and automatically from what you enter in the app and from the sign-in or subscription providers you choose, and it is processed only for the purposes below.

Creating your account and verifying your sign-in

Data: Email address, hash of the sign-in code, Apple or Google account identifier
Legal basis: Entering into and performing a contract (KVKK art. 5(2)(c); GDPR art. 6(1)(b))

Backing up your records and syncing between devices

Data: The synced records listed in section 4
Legal basis: Providing the service you ask for by creating an account (KVKK art. 5(2)(c); GDPR art. 6(1)(b))

Validating your subscription

Data: Subscription status, anonymous or account-linked RevenueCat identifier
Legal basis: Performing a contract (KVKK art. 5(2)(c); GDPR art. 6(1)(b))

Keeping your account and the service secure

Data: Security log (IP hash), session records
Legal basis: Legitimate interest, provided it does not harm your fundamental rights and freedoms (KVKK art. 5(2)(f); GDPR art. 6(1)(f))

Measuring how our ads perform (only with your permission)

Data: Advertising identifier, device and app information, install, trial and purchase events
Legal basis: Explicit consent (KVKK art. 5(1) and art. 9 for transfers abroad; GDPR art. 6(1)(a))

Answering your requests and meeting legal obligations

Data: The email you send us and what it contains
Legal basis: Legal obligation and performing a contract (KVKK art. 5(2)(ç) and 5(2)(c); GDPR art. 6(1)(c) and 6(1)(b))

We do not use your records (Resets, check-ins, intentions, your writing) for advertising, marketing profiles or automated decision-making. Summaries such as the weekly reflection are built with simple rules, only on your device.

We do not sell your data. Ad networks receive only what ad measurement needs, and only if you allowed it. To run the service, only the data needed is shared with these service providers:

RevenueCat, Inc. — subscription and purchase validation.
Apple and Google — purchases always go through the store; sign-in verification only if you choose that method.
Email delivery service — processes your email address and the code to deliver your one-time sign-in code.
Meta Platforms Ireland Ltd. — ad measurement; only with your permission.
Google LLC / Google Ireland Ltd. (Firebase Analytics, Google Ads) — ad measurement; only with your permission.
Expo (650 Industries, Inc.) — delivery of app updates; your personal records are not sent.
Infrastructure provider — hosting Levori’s server.
Competent public authorities — only when there is a legal obligation.

Some of these providers are located outside Turkey, for example in the United States. In that case your data is transferred in line with the rules on transfers abroad in article 9 of the KVKK and in the GDPR.

8. How long it is kept

Records on your device: until you delete them or remove the app.
Backed-up records and account details on the server: as long as your account exists. They are deleted immediately when you delete your account.
Session records: valid for at most 60 days; deleted immediately when you delete your account.
Security log: as long as your account exists; entries linked to you are deleted with your account. A single entry showing that a deletion took place (time and IP hash) remains, not linked to you.
Server backups: copies in the encrypted backups kept for disaster recovery are deleted within 30 days at the latest.
Ad measurement data: subject to Meta’s and Google’s own retention rules; nothing new is sent to these networks once you withdraw.
Support emails: for as long as needed to resolve your request and meet legal obligations.

9. Security

All connections between the app and the server are encrypted (HTTPS). Your session tokens are kept on your device in the iOS Keychain or Android Keystore; the server stores only their hashes. Your IP address is written to the security log only as a keyed hash. Every record on the server belongs to your account and can only be reached with your account.

10. Your rights and how to use them

Under article 11 of the KVKK you have the right to:

learn whether your personal data is processed,
request information about it if it is,
learn the purpose of processing and whether it is used for that purpose,
know the third parties it is transferred to in Turkey or abroad,
ask for it to be corrected if it is incomplete or wrong,
ask for it to be deleted or destroyed under the conditions in article 7 of the KVKK,
ask for corrections, deletions and destructions to be notified to the third parties it was transferred to,
object to a result against you that comes solely from automated analysis,
claim compensation if you suffer damage because it was processed unlawfully.

If you live in the European Union, the GDPR also gives you the rights of access, rectification, erasure, restriction of processing, data portability and objection.

How to use them

In the app: under You → Settings → Manage my data you can export your data as a JSON file or delete all of it. Details are on the Account and data deletion page.
By email: write to destek@levori.app, preferably from the email address linked to your account. We may ask for more information to verify your identity.

We answer within 30 days at the latest, free of charge. If you are not satisfied with our answer, you can complain to Turkey’s Personal Data Protection Board; if you live in the European Union, you can also contact the data protection authority in your country.

11. This website

levori.app uses no cookies, runs no visitor analytics and loads no fonts, scripts or images from other sites; everything the pages need comes from this server. That is also why we don’t ask for cookie consent.

12. Changes and contact

When we update this policy we change the date above, and we announce significant changes separately. Questions: destek@levori.app.