Luvya is a wellbeing app designed to help users create gentle, personalised daily and weekly plans for self-care, sleep, calm, movement, mindfulness, routines, nutrition, confidence, and everyday balance.
1. Who we are
Luvya is operated by Appex s.r.o., a company based in Slovakia/EU.
For privacy questions, contact: hello@appex.sk
2. What personal information we may collect
Account information
- Email address
- Display name
- Authentication provider details (Google, Apple, or email and password). Passwords are handled by Firebase Authentication.
- User ID
- A profile photo, if you choose to upload one
Wellbeing profile and preferences
- Selected wellbeing goals and what brought you to the app
- App approach preference (gentle, balanced, active)
- Time availability and routines, including your description of a typical day
- Interests, likes, dislikes, feedback
- Information about sleep, energy, mood, stress, movement, nutrition, mindfulness, confidence
- Health conditions or physical limitations, if you mention them; diet, allergies, injuries and equipment
- Preferred name, and the city you mostly live in or spend your days, if you give them
- Optional notes about schedule, preferences, limitations
Plan and app usage information
- Generated daily/weekly plans
- Completed, skipped, liked, or disliked activities
- Check-in answers and reflections, including your answers and notes in moments
- Insights articles you save as favourites
- App settings and preferences, including the look you choose (Airy, Warm or Glow), which is saved on your device and in your account
- Your reminder settings: whether reminders are on, the reminder time set when your plan is generated, and when we last sent you one and which text it was
- Your invitation code, and whether you used or shared the benefit of one
Product analytics events
We use Google Analytics for Firebase in release versions of the app to understand how it is used. Events are linked to your user ID and record things like:
- Screens viewed, and the sign-in method used
- Which settings entries are tapped, and which look is in use or was chosen
- Tasks ticked or opened, days opened, and the sections of a check-in used
- Insights articles opened or favourited (with their topic) and filters applied
- Moments answered or skipped
- Whether you allowed reminders, and reminders you opened
- Invitation codes generated, shared or entered, and whether that worked
- Subscription screen actions, such as plan chosen, purchase result, and restore
These events describe what was used, not what you wrote. Your answers, notes and plan text are not part of them. Google Analytics also collects its standard data, such as an app instance identifier, device and app details, and approximate location derived from your connection.
Technical information
- Device type and operating system
- App version
- Crash logs and diagnostics from Firebase Crashlytics, tagged with your user ID
- Approximate region, language, time zone
- On Android, the analytics and advertising-measurement software included in the app (Google Analytics for Firebase and the Meta SDK) has permission to access the device's advertising ID, which you can reset or delete in your Android settings. On iOS, we do not ask for tracking permission and do not use the advertising identifier.
Advertising measurement (Meta, Android only)
We advertise Luvya on Facebook and Instagram. To see which ads lead to installs, release versions of the Android app include the Meta SDK, which sends Meta Platforms a small set of app events:
- The app being installed and opened
- An account being created (with the sign-in method: Google, Apple or email)
- Onboarding being finished, which starts the free trial
- Subscription purchases made through Google Play
With these events Meta receives device and app details (such as device model, operating system, app version, language and time zone), your IP address, and the device's advertising ID unless you have deleted it. They do not contain your name, email address, user ID, answers, notes or plan text. You can reset or delete the advertising ID in your Android settings.
The iOS app does not include the Meta SDK and sends Meta nothing. Our ads on iPhone link to this website; Meta only sees the ad being shown and tapped, as with any Facebook or Instagram ad.
Meta may combine this information with what it already knows about you if you use Facebook or Instagram, under the Meta Privacy Policy.
Stored only on your device
The app keeps a few small settings on your device, such as your chosen look and a flag saying someone has already signed in on this device. That flag only decides whether the sign-in screen opens on "Create your account" or "Welcome back", and it is not sent to us.
Device tokens for reminders
If you turn reminders on and allow notifications, we store your device's push token from Apple or Google in your account, with the platform (iOS or Android) and the date it was last updated. The token is used only to deliver your reminders. It is removed when you sign out on that device, when you delete your account, or when the delivery service tells us it no longer works.
Purchase information
- Payment processed by Apple App Store or Google Play
- No full card details stored
- Basic subscription status information, received from our subscription management provider (RevenueCat), which identifies you by your user ID
- Free trial start and end dates, and whether an invitation code was applied
Abuse prevention and trial-eligibility signals
To keep the free trial fair and to protect the Service against misuse, our servers keep two kinds of pseudonymised record:
- Device records. The app sends a device identifier (Apple's identifier for vendor on iOS, the Android ID on Android, or a random ID generated by the app if those are unavailable). Our server immediately hashes it with a secret key (a peppered SHA-256 hash) and stores only the hash, not the identifier. The hash is stored with the platform, first and last seen dates, a usage count, and the user ID of each account seen on that device.
- Trial records. When a free trial is granted, we store a peppered SHA-256 hash of your normalised email address (or of your user ID if your account has no email), along with the trial's dates. This record contains no email, name or user ID in readable form.
Trial records decide whether a free trial can be granted. Device records are currently used to monitor for duplicate accounts and misuse. These records are held on our servers only, are not shown in the app or to other users, and are not used for advertising or personalisation of content.
3. Sensitive wellbeing information
Some information you choose to provide may relate to your health, mood, lifestyle, stress, sleep, body, fertility, sex wellbeing, mental wellbeing, or physical activity. Where it is part of your plan inputs, it is sent to our AI provider as described in section 5.
Luvya is not a medical device and does not provide medical advice, diagnosis, treatment, or therapy.
4. How we use your personal information
- Create and personalise wellbeing plans
- Adapt suggestions to goals and preferences
- Provide reflections and insights
- Save progress and settings
- Understand how the app is used and improve app experience
- Find and fix crashes and plan-generation problems
- Respond to support requests, and occasionally show you a message from us in the app
- Manage subscriptions, free trials, and invitation codes
- Measure the results of our advertising for Luvya (see section 8)
- Protect against misuse and fraud, including detecting duplicate accounts and free-trial abuse
- Comply with legal obligations
We do not sell your personal information. The app does not show ads.
5. AI-generated content and personalisation
Luvya uses the Google Gemini API to write weekly plans, to turn check-ins into priorities that carry over from week to week, and to write short reflections. Our servers send it, as relevant to the task:
- your goals, approach, energy and stress descriptions, typical day and free time;
- anything you wrote about health conditions or limitations; diet, allergies, injuries and equipment;
- favourite and avoided activities, and your preferred name, city and time zone if you gave them;
- check-in answers and notes, reflections from moments, and accumulated priorities and constraints;
- the current plan and a summary of which tasks you completed.
These requests do not contain your email address, user ID, device identifiers or payment details. Please avoid writing details you would not want processed this way into free-text notes. Google's handling of this data is governed by the Gemini API terms.
The requests and raw responses for plan generation are stored in your account, where they can be used to check plans and debug problems. Operational logs on our servers can also include your user ID and the text of a generated plan.
A plan's direction (simplify, hold steady, or progress gently) is calculated by our own code from your completed tasks and your requested pace. The Insights article library is built with Gemini too, but without any personal data.
AI-generated suggestions are for general wellbeing support only. They may not always be accurate or suitable for your personal situation.
6. Where we get your personal information from
Information collected directly when users create accounts, complete onboarding, select goals, use check-ins, enter notes, or contact support.
Technical, authentication, purchase, or diagnostic information may come from service providers including Apple, Google, Firebase, analytics, and payment platforms.
7. Legal bases for processing
For EU/EEA/UK residents:
- Performance of contract — to provide core features
- Consent — for optional information
- Legitimate interests — to maintain and improve the app, to keep it secure, to prevent fraud and abuse of free trials (including the hashed abuse-prevention signals described in section 2), and to measure the results of our advertising (on Android, see section 2).
- Legal obligation — compliance with laws
Users can withdraw consent by changing or removing the information in the app where that is possible ("Update your preferences" on the Me tab), by deleting their account, or by contacting the company.
8. Who we share your information with
Service providers that help us run Luvya:
| Provider | What for | What they handle |
|---|---|---|
| Google Firebase (Authentication, Cloud Firestore, Cloud Storage, Cloud Functions, Hosting) | Sign-in, database, file storage, server logic, website | Account data, wellbeing and plan data, profile photo, server logs |
| Google Gemini API | AI-generated plans, priorities and reflections | The plan inputs and check-in data listed in section 5 |
| Google Analytics for Firebase | Product analytics | Usage events, user ID, the look in use, device and app details |
| Firebase Crashlytics | Crash reporting | Crash reports, device and app details, user ID |
| Google Ads | Measuring our app-install campaigns: our analytics property is linked to Google Ads, and installs and in-app purchases are imported as conversions | Analytics conversion events |
| Meta Platforms (Meta SDK, Android app only) | Measuring our Facebook and Instagram app-install ads | The app events listed in section 2, device and app details, IP address, and the advertising ID |
| Firebase Cloud Messaging, Apple Push Notification service | Delivering reminders, if you turn them on | The device token and the reminder text. The text is a general message and contains nothing from your plan. |
| Google Sign-In, Sign in with Apple | Optional sign-in | Your sign-in with that provider, which gives us your email and name details |
| RevenueCat | Subscription management | User ID, purchase and subscription status |
| Apple App Store, Google Play | App distribution and payments | Purchases, under their own terms and privacy policies |
| Google (Gmail) | Support email | What you write to us. Emails started in the app come pre-filled with your user ID, app version, device, operating system and time zone, which you can edit before sending. |
We do not share your personal information with other users. If you share an invitation code, that is your choice, and the person using it receives a benefit without seeing your details. We store which account a code belongs to, so that the benefit can be credited.
Authorised people at Appex s.r.o. can access account data where that is needed to provide support, fix problems, or protect the Service.
9. International transfers
Our main database (Cloud Firestore) is in a European multi-region and our Cloud Functions run in an EU region. Some service providers, including those listed in section 8, may process information outside the user's country and outside the EEA, including in the United States. Appropriate safeguards like data processing agreements are used.
10. How long we keep your information
Information retained only as long as needed to provide services, maintain accounts, comply with legal obligations, and improve security.
Account data and wellbeing content are kept while your account exists. When you delete your account:
| Data | What happens |
|---|---|
| Your Luvya account data (profile, plans, check-ins, progress, settings) | Removed from your active account. |
| Uploaded files, such as a profile photo | Deleted. |
| Device tokens for reminders | Deleted, and not copied to the archive described below. |
| RevenueCat customer record | We request deletion at RevenueCat. Your purchase history with Apple or Google remains with them, and a subscription is not cancelled: you need to cancel it in the store yourself. |
| Archive copy of your account data | A copy is first written to a restricted, server-only archive (without the raw AI requests and responses), so that a deletion made by mistake can be reversed. A fixed automatic deletion period does not currently apply to this archive. Email us and we will delete it. |
| Sign-in record (Firebase Authentication) | Kept, including your email address and sign-in provider, so that the same login keeps the same user ID. Email us and we will delete it. |
| Device records | Kept separately, including your user ID, and deleted automatically 18 months after the device was last seen. |
| Trial records | Kept separately and deleted automatically 3 years after the identity was last seen. Deleting them with the account would remove the very record that prevents repeated trials. |
| Invitation code record | The link between a code and your user ID, and any record of it on an account that used your code, is not removed by account deletion. |
| Analytics, advertising-measurement events (Meta, Android), crash data and server logs | Not removed by account deletion. They are kept for the retention periods configured in those services. |
| Support emails | Kept in our mailbox as long as needed to deal with your request and any follow-up. |
We may keep certain records where we are required to by law.
11. How we protect your information
We use reasonable technical and organisational measures to protect personal information against unauthorised access, loss, misuse, alteration, or disclosure. For example, database rules limit each signed-in account to its own data, and trial and device records can only be accessed by our servers.
12. Your data protection rights
Users may have rights to:
- Access personal information
- Correct inaccurate data
- Request deletion
- Restrict processing
- Withdraw consent
- Receive data in portable format
- Lodge complaints with authorities
Responses provided within the period required by law, typically one month.
Where you ask us to delete the hashed abuse-prevention and trial-eligibility signals described in section 2, we may retain them for the periods set out in section 10, because we have compelling legitimate grounds for keeping them — deleting them on request would remove the only record that prevents repeated free trials and duplicate accounts. Trial records contain no readable identifier. Device records contain your user ID. Neither is linked to your wellbeing content.
13. Children's privacy
Luvya is not intended for anyone under the age of 16, or under a higher minimum age where local law requires one. This matches the minimum age in our Terms of Use. We do not knowingly collect personal information from anyone below that age, and we will delete such information if we become aware of it.
14. Notifications
The app can send you reminders as push notifications, only if you agree. It asks after you first tick off a task, and you can change your mind at any time in Account settings or in your device settings.
Reminders are rare: at most one a week, at a time chosen when your plan is generated, based on when you told us you have free time, between 9:00 and 20:00 in your time zone. If you have not opened the app for a while they may say so, more rarely still, and they stop after 90 days until you come back. The text on your lock screen is general and does not show the contents of your plan. To decide when to send a reminder we use your time zone, your reminder time, when you last opened the app, whether you have ticked off a task that day, and whether your trial or subscription is active.
15. Marketing communications
We will not send you marketing emails unless you have agreed to receive them or where permitted by law.
16. Changes to this Privacy Policy
Updates may be provided through the app, email, or other methods. Latest version available on the website.
17. How to complain
Contact: hello@appex.sk
For EU/EEA residents, contact the Office for Personal Data Protection of the Slovak Republic: https://dataprotection.gov.sk
18. Contact
Email: hello@appex.sk
19. This website
The public pages of this website set no cookies, run no analytics, and load no fonts or scripts from third parties. Firebase Hosting, which serves the site, processes technical request data such as IP addresses in order to deliver the pages.