Privacy Policy

Effective date: October 12, 2026

Lifeline keeps the big moments of your life. This policy explains, in plain words, what data the app collects, where it goes, how long it is kept, and what you can do about it. We wrote it to match what the app actually does; where something is not encrypted or is shared with another company, we say so.

1. Who is responsible

Lifeline is made by Konstantin Tikhaev, an individual developer based in Israel ("we", "us"). He is the controller of your personal data.

Contact: founder@theplacewelive.org. We answer privacy questions and requests within 30 days, usually much sooner.

2. The short version

Your memories are stored in your account so you can see them on any of your devices. We don't sell your data and we don't show ads.
You can encrypt any memory with a master password. Then its words (the text, your reflections, the AI's questions and your answers) are encrypted on your phone before they reach our servers, and we can't read them. The title, date, emotions, song, photos, videos and voice notes are not encrypted.
AI features are optional and only for people aged 18 and older. Nothing is sent to the AI until you confirm your age and agree in the app. When you use them, the parts of your memories they need go to Google's Gemini model through our server.
Usage statistics, crash reports and ad measurement with Meta are off until you allow them: the app asks once, and Meta's SDK is not even started before you allow it. You can change your answer in Profile > Privacy > Usage statistics. On iPhone, Meta also needs your "Allow" in Apple's tracking prompt.
You can export all your memories for free and delete your account from inside the app.

3. What we collect, and why

3.1 Your account

Email address and name, from you or from Google or Apple when you sign in with them, to identify your account and to write to you about it (for example the verification code).
A user ID created by Firebase Authentication.
Your profile picture link from Google, if you sign in with Google.
Language and your settings (notifications, sounds, AI switches, display).
Guest mode: you can try Lifeline without an email. A guest account is anonymous and keeps up to 5 memories; like any account, it is saved to our cloud under its anonymous ID. When a guest signs out, the guest account and its memories are deleted, on the phone and in our cloud.

We never receive your Google or Apple password.

3.2 Your memories

Each memory can hold a title, a date, text, your reflections, an emotion with a word of your own and its strength, photos, a video, voice notes, a song from Spotify (its Spotify ID), an ambient sound, and the AI's questions with your answers. We store them to show your timeline, to sync your devices and to bring memories back "On this day".

Memories are saved on your phone first (so the app works offline) and then synced to your account in Google's cloud (Firebase). Photos are re-encoded before upload, which removes their location data (EXIF). Videos and audio are uploaded as they are; if a video file contains location data, it stays in the file.

3.3 Encrypted memories

When you set a master password, you can encrypt any memory ("Encrypt this memory" when you write or edit it):

Its text, reflections and AI questions and answers are encrypted on your device with AES-256-GCM, using a random key. Our servers store that key only wrapped: with a key derived from your password (PBKDF2) and, if you create one in Profile, with your recovery key. We can't unwrap it.
The title, date, emotions (including your own word), the song, photos, videos, voice notes and their names are not encrypted, so the timeline, search and "On this day" can work.
With a recovery key you can set a new password and keep everything. Without the password and the recovery key, encrypted memories can't be opened by anyone, including us.
If you turn on unlocking with Face ID, a fingerprint or your phone's passcode, a key is kept in your phone's secure storage for that. Biometric data never leaves your phone.
Notifications and the home-screen widget never show the title or the words of an encrypted memory.

Memories you don't encrypt are protected in transit (TLS) and at rest on Google's servers, but they are not encrypted with your own key.

3.4 AI features

AI in Lifeline is optional and only for people aged 18 and older. Nothing is sent to the AI until you confirm your age and agree in the app; you can turn AI off at any time in Profile, which also withdraws your consent. Besides the main switch there are switches of their own for questions, for monthly patterns, and for the Life Compass with "What followed similar moments".

When an AI feature runs, our server sends only what that feature needs to Google's Gemini model:

Questions when you save a memory (if "Questions to memories" is on): the title, text, date, emotion and your "impact" and "lesson" reflections of each new memory you don't encrypt.
Questions to a memory: its title, date, text and emotion with your own word for it, and questions you asked to replace; for the second round, your answers to the first; with Premium, the dates, titles, emotions and first lines of up to three earlier memories with the same feeling or words.
Pattern of the month: the dates, titles and emotions of that month's memories, the beginning of their text and your "impact" and "lesson" reflections; with Premium it is also refreshed every week.
Life Compass: the dates, titles, emotions and first lines of your memories.
What followed similar moments: the memory and up to five earlier ones with the same emotion (titles, first lines, short excerpts of reflections).
Voice note to text: the recording of that one note.
Translation of saved AI results, or of the "In the world" news, into your language.

Encrypted memories and memories you asked not to bring back are never sent automatically: not when you save them, not in patterns or the Life Compass, and not as earlier memories next to another one. They are sent only when you yourself ask for questions or for "What followed similar moments" on that memory; an encrypted one only after you confirm it for that memory, and its text is decrypted on your phone for that request only.

We use Gemini as a paid service. Under Google's terms for paid services, Google does not use your prompts or the responses to improve its products; it keeps logs for a limited time to detect abuse and for legal reasons. The AI results (questions, patterns, the compass, predictions) are saved in your account so you can see them again. When you delete or encrypt a memory, the questions and predictions about it are removed and it is taken out of other predictions; a monthly pattern or Life Compass that included it stays until it is rebuilt or you delete it.

The app's "What the AI sees" screen describes all of this inside the app.

3.5 Voice

Recorded voice notes are stored with the memory like photos (not encrypted).
Live dictation uses the speech recognition of your phone (Apple or Google). On Android Lifeline asks for recognition on the phone itself where it is available; otherwise, and on iPhone, Apple or Google may process the audio on their servers under their own terms. Lifeline itself doesn't send this audio anywhere.
"To text" sends one recording to Gemini (see 3.4). Our server deletes its temporary copy right after.

3.6 Music and "In the world"

Spotify: when you search for a song, the search text goes through our server to Spotify. We store only the track ID in the memory. If you connect the Spotify app to play songs, that connection is between your phone and Spotify, under Spotify's terms.
"In the world" (Premium): to show the news and songs of a memory's date, your phone asks Wikipedia and the Billboard charts for that date. Only the date is sent; as with any website, those services see your device's IP address.

3.7 Purchases

Payments are handled by Apple (App Store) or Google (Google Play); we never see your card. To unlock Premium, our server checks your purchase with Apple or Google and stores the product, the transaction or purchase token and the expiry date in your account. A record of each used receipt (with your user ID) is kept for 90 days from when the purchase was first used, so the same purchase can't unlock another account.

3.8 Usage statistics and crash reports

If you allow usage statistics (the app asks once; nothing is sent before you answer), the app sends, to understand which features are used and to fix bugs:

Firebase Analytics events (for example: a memory was created, how many words it has, media added, a screen opened, a purchase, AI used), with an app-instance ID and, on Android, your device's advertising ID (on iPhone, Firebase doesn't collect the advertising identifier). Google estimates your country and city from your IP address. Never the content of your memories.
Firebase Crashlytics crash reports and error logs (device model, OS version, app version, what went wrong).

You can change your answer at any time in Profile > Privacy > Usage statistics. The choice applies to the phone you make it on.

3.9 Ad measurement with Meta

We use Meta App Events to see which of our ads lead to installs and purchases. It receives events such as signing up, starting a trial, buying Premium (with the amount and currency) and opening the app (with the app version), together with device information and, where allowed, your device's advertising ID (on iPhone, only if you allow tracking). Never anything you write.

Meta's SDK is started only after you allow usage statistics when the app asks (on iPhone, only after you also allow tracking); before that the app doesn't contact Meta at all. It stops when you turn usage statistics off.
On iPhone it also needs your "Allow" in Apple's tracking prompt (App Tracking Transparency), shown right after. You can change it in iOS Settings > Privacy & Security > Tracking.
On Android you can also reset or delete your advertising ID in Android settings.

3.10 Notifications

"On this day", reminders for a step you planned, and "A look back every few months" are planned on your phone. They show a memory's title (never for an encrypted memory) or a neutral line. "A look back every few months" names neither a memory nor a feeling.
Push messages (for example about your trial, or a reminder if you haven't opened the app for a while; turn the latter off with "Now and then, a nudge to write") need a push token, which we store in your account. They never contain your memories.

3.11 Security checks

Firebase App Check (Google Play Integrity on Android, App Attest on iPhone) confirms that requests come from the real app. Our server also keeps short-lived counters to limit abuse (for example how often a code email can be sent).

3.12 Shared memories

You can invite people to keep a memory together. Sharing is always your choice; nothing is shared until you invite someone or accept an invite.

What the others see: the memory's title and date, the photos and videos everyone adds to it, the music of the person who started it (their Spotify tracks), the discussion, and each member's name and profile photo (from Google, or one you choose in Profile). What they don't see: your text, your emotions, your reflections and the AI's questions and answers. Everyone keeps their own.
When you first invite someone: the photos and videos the memory has at that moment (not its voice notes) are copied into the shared memory, where the others see them.
What we store: the shared memory with its members, the photos, videos and messages people add, and the invites. Shared photos and messages are not encrypted with your master password.
Invites: when you invite someone by email, we send the invite to that address through our email provider, Resend, which receives the address, the memory's title and your name. If the address belongs to a Lifeline account, the invite also appears in that person's app. Otherwise we keep only a scrambled (hashed) form of the address for 7 days, so the invite can find the account if one is made with it. An invite waiting in someone's app stays there for 60 days; invite links work for 7 days.
Reports and blocking: you can report a message or a photo; the report, with the message's text, comes to us by email (through Resend). We review reports and remove content that breaks our rules. You can block a person: their invites no longer reach you and you don't see their messages and photos.
Leaving: you can leave a shared memory at any time; deleting your copy of it leaves it too. Your photos, videos and messages stay for the others unless you choose to remove them. If you delete your account, they are removed. A shared memory is deleted when its last member leaves.

4. Who receives data

We don't sell or rent your data.

Service providers that process data for us, bound by data-processing terms that require the same or equal protection of your data as this policy:

Google (Firebase and Google Cloud): sign-in, database, file storage, server functions, push messages, analytics, crash reports, App Check.
Google (Gemini API): AI features, only after your consent.
Resend: sends our emails (for example your verification code and the invites you send); receives your email address and, for an invite, the invitee's address, the memory's title and your name; reports of shared content reach us through it.

Companies that receive data under their own terms, when you use the feature that needs them:

Meta Platforms: ad measurement, as described in 3.9.
Spotify: song search and playback.
Apple and Google: sign-in with Apple or Google, payments, and the platform services of your phone (dictation, notifications).
Wikipedia (Wikimedia Foundation) and Billboard: the date of a memory, for "In the world".

We may disclose data if the law requires it, to protect the safety of a person, or as part of a transfer of the app to a new owner (we would tell you first).

5. Where data is stored

Our database, files and server functions are on Google Cloud in the United States. Google's analytics and AI services and our other providers may process data in other countries. If you live outside the United States, your data is transferred there. Our providers use the European Commission's standard contractual clauses or equivalent safeguards for such transfers; write to us for a copy of the safeguards that apply.

6. How long we keep data

Your account and memories: until you delete them or your account.
Deleted memories: removed from our database and file storage right away, with the questions and predictions about them. Recovery copies and backups are deleted within 40 days.
Photos, videos and voice notes you take out of a memory: deleted from file storage within 30 days; their copies in a shared memory stay there for the others (see 3.12).
After you delete your account: your profile, memories, files, AI results and service records are deleted right away. Recovery copies and backups are deleted within 40 days; our server logs expire within 30 days; used-receipt records no later than 90 days after the purchase was first used.
Analytics and crash reports: kept by Google for the period set in our Firebase settings (crash reports about 90 days; analytics events no longer than 14 months).
AI request logs at Google: for a limited time, under Google's terms for the Gemini API.
Emails we sent and data at Meta: under Resend's and Meta's own retention rules.

7. Your choices and rights

Export: Profile > My data > Whole archive gives you one ZIP with every memory as text, your photos, videos and voice notes, for free. Encrypted memories are included after you enter your password; inside the ZIP they are not encrypted, so keep the file safe. For a copy of anything else we hold (for example AI results or your settings), write to us.
Correct: edit any memory or your profile at any time.
Delete: delete any memory, or your whole account in Profile > Delete Account. You can also write to us from your account's email address and we will delete it for you. Deleting the account doesn't cancel a subscription: cancel it in the App Store or Google Play.
Withdraw consent: turn AI off in Profile; turn usage statistics off; change tracking in iOS Settings; turn notifications off in the app or your phone's settings. You can also withdraw your consent to keeping your memories, given when you start using Lifeline, at any time by deleting your account or writing to us; because Lifeline can't work without keeping your memories, we then delete your account and memories.

Depending on where you live (for example under the GDPR in the EU and UK, the CCPA in California, or Israel's Privacy Protection Law), you have the right to access your data, correct it, delete it, receive it in a portable format, restrict or object to its processing, and withdraw consent. To use any of these rights, write to founder@theplacewelive.org. You can also complain to your data protection authority.

Legal bases (EU/UK): we keep and sync your memories to provide the service you asked for (contract) and, because memories can reveal sensitive details such as about your health, on your explicit consent, given when you start using Lifeline. AI features, usage statistics, crash reports and ad measurement are based on your consent, which you can withdraw at any time. Security and abuse prevention are based on our legitimate interest in keeping the service safe.

California: we don't sell personal information. Sharing events with Meta for ad measurement may count as "sharing" under the CCPA; it happens only if you allow usage statistics, and turning them off opts you out.

8. Children

You must be at least 16 years old to use Lifeline. If you are 13 to 15, you may use it only with the permission of a parent or guardian, who also gives the consent to keeping your memories for you; you confirm this when you start using the app. AI features are only for people aged 18 and older, because our AI provider's terms require it: the app asks you to confirm your age before AI is used. If we learn that someone under 16 uses Lifeline without a parent's or guardian's permission, we will delete the account; if we learn that someone under 18 uses AI, we will turn AI off.

9. Security

Data travels over encrypted connections (TLS) and is encrypted at rest on Google's servers. Access to your data is limited to your account by our security rules; our server code reads it only to run the features you use. Encrypted memories add encryption with your own key. No system is perfectly secure; if a breach affects your personal data, we will tell you and the authorities as the law requires.

10. Our website

When you visit our website, Firebase Hosting (Google) keeps standard server logs (IP address, browser, the page requested) for security. The site loads nothing from other services: its fonts, scripts and images come from our own site. It sets no cookies, has no analytics, no accounts and no forms.

11. Changes

When we change this policy, we will update the date above and show the new version in the app. If a change is significant, we will tell you in the app before it takes effect.