Privacy Policy

Last updated: 25 April 2026

Levelary (the "Service") is a hobby project provided as a public beta. This policy explains what data the Service collects and what your options are. Questions: [email protected].

1. What we collect

• Account data. The email address you typed and a hashed password. You may use a real email address or a non-personal login identifier that looks like an email address, such as [email protected]. We do not verify email addresses. If the address is not reachable, we cannot help you recover the account or send security/privacy notices.
• Activity data. The skills, categories, activity types, sessions, goals, ledger entries, and optional notes you create inside the Service.
• Operational data. Server logs containing your IP address, request path, response status, and timestamp, retained for up to 30 days for security and abuse prevention.
• Analytics data (only if you consent). See Section 4.

2. What we don't collect

• We don't process payments. The Service is free; no card data, no billing info, no third-party payment processor is involved.
• We don't run advertising pixels or behavioural-tracking trackers other than the analytics described in Section 4.
• We don't sell, rent, or trade your data to anyone.
• We don't read or analyse your session notes for any purpose other than displaying them back to you.

3. Legal bases (GDPR)

If the GDPR (or UK GDPR) applies to you, the legal bases on which we process your personal data are:

• We process account data and activity data to provide the Service to you, based on performance of a contract (Art. 6(1)(b)).
• We process operational logs for security, abuse prevention, debugging, and reliability, based on our legitimate interests (Art. 6(1)(f)).
• We process Google Analytics data only with your consent (Art. 6(1)(a)), which you can withdraw at any time from Settings → Analytics.
• We may process limited data where necessary to comply with legal obligations (Art. 6(1)(c)).

4. Google Analytics

The Service uses Google Analytics 4 (provided by Google LLC) to understand aggregate usage — which pages get visited, which features get used, how often sessions are logged. This helps prioritise what to improve.

Google Analytics is loaded with Consent Mode v2 in default-denied state. That means:

• No analytics cookies are set, and no analytics data is sent to Google, until you explicitly opt in via the consent banner shown on first visit.
• If you opt in, Google Analytics may set first-party cookies (_ga, _ga_<ID>) and process events about your activity in the app. Data is processed by Google in the United States and may be combined with other data Google holds about your browser.
• If you opt out (or never opt in), Google Analytics remains inert. No cookies, no events.
• You can change your choice at any time from Settings → Analytics in the app. Switching off later also instructs Google Analytics to stop dropping cookies on subsequent page loads; existing _ga cookies can be cleared from your browser's cookie settings.

The events we send Google Analytics use internal identifiers only (skill IDs, category IDs, activity counts, durations, anonymised user ID derived from your account UUID). We never send your email, your skill names, your category names, your notes, or your search queries to Google Analytics.

International transfers. Google may process analytics data outside the EU/EEA, including in the United States, according to Google's own terms and privacy documentation.

For Google's own data-handling commitments see Google's privacy policy.

5. Cookies and local storage

• Session cookie — strictly necessary, keeps you signed in. Set on login.
• localStorage — stores your locale, theme, and analytics-consent choice locally on your device. Never leaves your browser.
• Google Analytics cookies — only if you opted in via the banner (see Section 4).

6. Where data lives

Application data is stored in PostgreSQL on infrastructure operated by our hosting provider in the European Union. We use the following processors:

• Hosting / database: Hetzner (Germany).
• Analytics: Google LLC / Google Ireland Ltd. (only if you consent — see Section 4).

7. Sharing

We don't share your personal data with third parties except:

• The processors listed in Section 6, strictly to operate the Service.
• When required by law or to protect the rights, property, or safety of the Service, our users, or the public.

8. Retention and deletion

We retain your data for as long as your account is active. You can delete your account at any time from settings; we erase the associated data within 30 days. Server logs older than 30 days are rotated automatically.

9. Backups

Deleted data may remain in backups for a limited period before those backups are overwritten. Backups are used only for security and disaster recovery, not to restore deleted user accounts except where required for security, legal, or operational reasons.

10. Your rights

Depending on where you live (EEA / UK / California, etc.) you may have rights to:

• Access a copy of your data — exportable from settings.
• Correct inaccurate data, directly inside the app.
• Delete your data, by deleting your account.
• Withdraw analytics consent at any time from Settings → Analytics.
• Object to processing — write to [email protected].
• Lodge a complaint with your local supervisory authority.

11. Sensitive data

The Service is a general-purpose skill tracker. Please do not store sensitive personal data in your skills, activities, notes, or category names — including but not limited to health information, mental-health notes, religious beliefs, political views, sexual orientation, immigration status, financial data, or anything else that would qualify as a "special category" under the GDPR. We have no obligation to detect or remove such content, and storing it on the Service is at your own risk.

The Service is intentionally designed to not infer health or psychological status. We don't analyse note content for sentiment, mood, mental-health signals, or any other inference about you. We don't and won't build features that classify you against psychological, medical, or behavioural-disorder criteria.

12. Age

You must be at least 16 years old to use the Service. If you are in the EEA / UK and under 16, you may use the Service only with verifiable parental or guardian consent — please have a parent or guardian email [email protected] before signing up. We don't knowingly collect data from anyone below the applicable age threshold; if you believe we have, contact us and we'll delete the account.

13. Changes

We may update this policy. Material changes will be posted here and the "Last updated" date refreshed. Because email addresses are unverified (Section 1), we cannot reliably reach all users by email — please check this page periodically.

14. Contact

For privacy questions: [email protected].