Privacy policy

Last updated: 26 October 2026. Leveler is operated by Ayoub Jatlaoui in Italy, under the developer name jatlaoui. Contact: support@leveler.pro.

A short guide to your privacy

Your account lets you save your progress across supported devices. Your tasks, habits and journal are private account content, not a public feed. You do not need to use your real name for your Character or upload a photo. Avoid putting information about other people or sensitive details in your notes or pictures. Ask a trusted adult if you need help understanding your choices, and contact us with privacy questions.

Teenagers and age requirements

Leveler is for people aged 16 or older. Do not create an account if you are under 16. We do not ask for a date of birth or identity documents, and do not currently provide age verification or a parental-authorisation service. Additional rules can apply to 16- and 17-year-olds where they live. If a parent or guardian contacts us about a child’s data, we review the request and verify the person’s authority before disclosing information or changing an account. Do not send identity documents, passwords or verification codes by email.

Information you provide

Leveler processes your sign-in email and account identifier, profile details, goals, missions, tasks, habit records, journal text and moods, uploaded images, reward history, and app preferences. Your journal may contain sensitive information you choose to enter.

How information is used

We use this information to authenticate your account, save and display your progress, synchronise supported devices, handle support requests, and protect the service. We do not sell your journal or use it for advertising. The application code does not include advertising or behavioural analytics SDKs.

Service providers

The mobile editions use Supabase for authentication and private cloud saves. The Android edition supports email and Google sign-in. Google handles Google authentication and may provide your Google account identifier, email, name and profile image to Supabase. Resend delivers sign-in emails and receives the email address and message needed for delivery, not your tasks or journal content. These providers may maintain security, delivery, or operational logs. Resend’s documentation describes email/log retention of 30 days on standard plans and a separate backup period; it stores message data in the United States even if email is sent from an EU region. These are provider terms, not a claim that Leveler can erase all provider records on the same schedule. Your mobile progress is associated with your Supabase account. The separate legacy web edition uses ChatGPT sign-in and hosting infrastructure provided by OpenAI and Cloudflare; its accounts and saves are independent of the mobile service.

Legal website and support email

The public legal and support website at leveler.pro is hosted by Netlify. Netlify processes technical request information, such as IP addresses and browser/request details, to deliver and protect the website. The legal website does not include Leveler sign-in, analytics scripts, advertising, cookies, or data-entry forms. Email sent to support@leveler.pro is forwarded by Porkbun to an operator-controlled Google Gmail mailbox. Support correspondence and deletion-request challenges are used to answer your request and verify account ownership; do not email private journal content or sign-in credentials.

Payments

Where Android subscriptions are enabled, Google Play processes payments. Leveler sends purchase tokens and an account-derived identifier to its Supabase verification backend, which checks subscription status with Google and stores encrypted purchase tokens, account associations, plan status, expiry and notification records for verification, restoration and fraud prevention. Leveler does not receive your payment-card number. These purchase operations do not run when purchasing is disabled in the app. Purchases are disabled for the initial closed-testing release. Google manages its own transaction records; deleting a Leveler account does not cancel a Google Play subscription.

On your device and external content

Appearance preferences are saved on your device. The mobile edition stores sign-in credentials and pending changes in protected device storage. Pending changes stay on that device until cloud synchronisation succeeds. Image URLs you enter may contact the image host, which can receive your IP address and request information. Opening external links is subject to the destination's privacy practices.

Retention and deletion

Saved content remains until you remove it or delete your account. Archive and Trash retain content for restoration. Account deletion removes saved content from the active application database. In the separate legacy web edition, a content-free hashed account marker prevents old tabs from recreating a deleted account. Historical copies may remain in encrypted operator-created backups, provider backups and operational logs. Account deletion removes active account data but does not rewrite existing backup archives or remove records independently managed by Google Play. Leveler’s prepared retention system targets a maximum 30-day lifetime for operator-controlled personal-data backups, measured from original capture, not from a later copy. Automatic backup expiry is not active. We have not verified a maximum retention period across all copies, including off-machine copies and historical diagnostic captures. The 30-day target is not an active all-copy deletion guarantee. A limited deletion record containing the account identifier and request/completion times is kept separately from active account data to help prevent deleted data from being restored. Unresolved deletion records are reviewed before recovery. Provider-controlled logs, backups and Google records follow their separate published or contractual procedures. Contact us for the applicable hosting region, retention details, or a privacy request.

Your rights

To delete your account, use Settings → Account & privacy → Delete my account. You can also request access, correction, a copy of your data, or deletion by emailing support@leveler.pro. We verify ownership before acting on account requests. Depending on your location, you may also have rights to object, restrict processing, or complain to a data-protection authority.

Technical information and security

Service providers may process IP addresses and authentication, request, security and delivery logs to operate and protect their services. Leveler uses HTTPS, verified account sessions, account-owner access checks and protected native storage for session credentials and pending changes. These measures reduce risk but cannot guarantee against loss or unauthorised access.

Processing locations

The mobile service uses a Supabase project in West EU (Ireland). This does not mean that all processing takes place there: authentication, email delivery, support and other providers may process information in other countries. Contact us about the safeguards applicable to your location.

Updates

We update this policy when the app's data practices change. Significant changes will be reflected in the app and its store privacy disclosures.