Privacy Policy

LVL 99 IRL (formerly "Life RPG") · Last updated 2026-10-31

LVL 99 IRL turns real-life effort into experience points, levels and in-app rewards. This page explains what data the app collects, why, and what control you have over it.

Data controller

LVL 99 IRL is operated by Biznio kontora, MB, a Lithuanian small partnership (company code 307613101, registered at Jazminų g. 8, Karužų k., LT-67401 Lazdijų r., Lithuania, EU). As the controller is EU-based, no separate EU Article 27 representative is required. Contact for any privacy matter: support@lvl99irl.app.

What we collect

• Account info: when you sign in with Google, we receive your name, email address and profile picture from Google; when you sign in with Apple (iPhone app), we receive the email address Apple gives us, which can be a private relay address that hides your real one, and your name if you share it. Used only to identify your account.
• Game data you create: the activities you log, XP, levels, quests, coins, purchases and any notes you attach — the core content of the app, entered by you.
• Money data (optional): Vault totals you choose to enter, used only to compute your Money skill level and purchase gates. Never shared with the AI Game Master unless you explicitly opt in, and then only as a total, never itemized.
• Todoist connection (optional): if you connect Todoist, we receive completed-task titles so they can be turned into XP. You can disconnect at any time. Disconnecting (or deleting your account) removes the link on our side and cancels our access at Todoist too, so Todoist stops sharing your tasks with us. Events that arrive for an account that's no longer linked are discarded.
• A profile photo (optional): if you generate an AI avatar, your photo is sent to our pixel-art image provider (PixelLab) to make the previews you ask for (up to 3 per account, ever) and, for members, once more to draw your older-you Game Master portrait. It is never stored by us — only the generated pixel-art results are saved. PixelLab processes the photo under its own privacy terms to produce that result; we don't control how long its systems retain a request in transit.
• Notes for the Game Master (optional): any free-text note you write for the AI Game Master — including things like training constraints or injuries — is included in what the AI sees when it suggests quests or plans. Don't write anything there you wouldn't want processed by our AI provider (Anthropic).
• Purchases (only if you subscribe or buy lifetime access): payments are taken by Google Play in the Android app, by Apple's App Store in the iPhone app, and by Stripe on the website — we never see or store your card details. On the website, Stripe receives your email address and your payment details on its own payment page, keeps its own payment and tax records under its own privacy policy, and tells our server whether your membership is active, when it renews or ends, and whether it was refunded; we keep your Stripe customer ID (so the "Manage" button can open your billing page) and that status. To know what you bought, we use RevenueCat, a purchase-management service: it receives your internal account ID (a random identifier, not your name or email) and your purchase records from the store, and tells our server whether your membership is active, when it renews or ends, and whether it was refunded. We keep only that status.
• Reminders (optional): if you turn reminders on, we store a push address (a token) for your device so we can reach it. Each notification goes through your device's push service: Google's Firebase Cloud Messaging in the Android app, and your browser maker's push service on the web (Google, Mozilla, Apple or Microsoft). A notification carries only its own text, such as a skill's name. Turning reminders off removes your device's token.
• Emails from the Game Master: a few short emails at most (a welcome, a nudge on day two if nothing is logged yet, a note after your first weekly review, and one if you go quiet for two weeks), each sent once; and, for members, a notice if Google Play couldn't renew your membership, once per payment problem. A member who made an older-you portrait sees it at the top of each email, through a private link that works for 30 days. They go through Resend, an email delivery service, which receives your email address, your first name and the few game details the email mentions (a skill name, a level, your week's XP). Every email has an unsubscribe link, and Settings → Emails switches them off.
• Error reports: if a screen in the app crashes, the app sends us the error message, the technical trace of where in the code it happened, which screen you were on, and your browser or device type, so we can fix it. The message can include text from the request that failed, such as a skill or quest name you typed; never money data. These go only to our own database, not to an outside service, and are deleted after 90 days.
• Basic usage analytics (Google Analytics): to understand which screens get used and where new players get stuck. Only page paths and a few named steps are ever sent (for example "finished onboarding step 2" or "turned reminders on"), with your phone and app version, under a random ID that isn't your account; never your game data, money data, name or email. Google keeps it for up to 2 years. In the app it loads only after you say yes: the tick box on the sign-in screen, a short note we may show once on your second day (and at most a couple of times after, never more than once a week), or Settings. Leaving the box empty or swiping the note away is not a yes, and nothing is sent. On the website it's the "Analytics" choice in the cookie card. You can change your answer any time in Settings → Your data → Basic analytics: turning it off stops sending at once and removes the analytics cookies.
• Ad measurement (Meta Pixel), website only: on our public web pages (not inside the app), if you allow "Ads (Meta)" in the cookie card, a Meta Pixel tells us whether our ads bring people to the site. It's a separate choice from Analytics, off unless you turn it on.
• Our own in-app usage log (only with the same yes): inside the app we also keep a small log of which screens you open and a few actions, such as opening Quick log and closing it without logging, or starting a skill plan and leaving it, so we can see where players get stuck and fix it. Each event is just its name, the screen's address with any ids removed, and the time; never what you logged, your notes, money or anything you typed. It stays in our own database (Supabase), is kept for 180 days, comes with your data export, and is deleted at once if you turn Basic analytics off. We also keep your answer itself on your account (yes, no, not answered or not now; where you gave it; and when and how often we asked), so the app can respect it on every device and never asks more than it should.

Cookies we use

Only these, and only after you say yes to the purpose they serve (in the app: Basic analytics; on the website: the cookie card's Analytics or Ads choice). None are set if you decline or ignore the question, and turning a purpose off removes its cookies.

Google Sign-In and your Google data

Signing in uses Sign in with Google through Supabase Auth. When you sign in, Google shares your name, email address and profile picture with us — nothing else. We use this only to create and identify your account; we don't request access to your Drive, Gmail, Calendar, Contacts or any other Google service or data.

This data is stored with our database provider (Supabase, see "Where your data lives" below), is never sold, and is never shared with third parties for advertising or any purpose unrelated to running your account. LVL 99 IRL's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. You can review or remove LVL 99 IRL's access to your Google account at any time at myaccount.google.com/permissions, and delete everything we hold on our side at lvl99irl.app/delete-account.

Sign in with Apple

In the iPhone app, on Android and on the website you can sign in with Sign in with Apple. Apple shares an identifier for your account and, if you allow it, your name and email address, or a private relay address that forwards to your real one. We use it only to create and identify your account, and never for advertising. Emails we send to a relay address reach you only through Apple's relay. You can stop LVL 99 IRL's access to your Apple ID any time in your Apple ID settings (Sign in with Apple), and delete everything we hold on our side in the app (Settings) or at lvl99irl.app/delete-account. We also keep the sign-in token Apple gives us, only so that deleting your account can tell Apple to end LVL 99 IRL's access to your Apple ID; it goes with the account.

Legal basis for processing (GDPR, for users in the EU/EEA/UK)

• Contract: your account info and the game data you create are processed because they're necessary to provide the app you signed up for — we can't run your skill levels or quest progress without them.
• Consent: the Todoist connection, the AI avatar photo, reminders on your device, opting your money data into the Game Master, and any non-essential analytics/advertising tool are all optional — processed only if and until you turn them on, and withdrawable at any time (disconnecting, deleting the avatar, or turning analytics off in Settings → Your data → Basic analytics).
• Contract and legal obligation: purchase and membership status, needed to give you what you paid for and to keep the financial records the law requires; the payment-problem notice to members is part of that.
• Legitimate interest: basic security logging (e.g. sign-in records), error reports that let us fix crashes, the Game Master's few emails about getting started and coming back (switch them off any time in Settings → Emails or with the link in every email), and aggregate, non-advertising usage analytics, balanced against your right to privacy — you can object at any time, see "Your rights" below.

How your data is used

Your game data is used only to run the app: computing XP, levels, coins and quest progress, and to improve it: new players may see different versions of how the app starts and how the membership is offered, and we compare how each version is used. An AI "Game Master" (built on Claude, by Anthropic) may see a summary of your progress to suggest quests and training plans — it never sees raw logs, never sees money data unless you opt in, and never changes your XP, coins or levels itself. Your account photo, if you add one, is never sent to the AI Game Master.

Where your data lives

Your game data is stored with Supabase, our cloud database and authentication provider, hosted in the EU (Frankfurt). We don't sell your data, and we don't share it with advertisers beyond the anonymized, aggregate analytics described above.

Some processing happens outside the EU/EEA: the AI Game Master's suggestions are generated by Anthropic (Claude), an optional avatar photo is converted by our pixel-art image provider, and membership status is managed by RevenueCat, website payments are taken by Stripe (which processes them in the EU and the US), emails are delivered by Resend, and Android reminders pass through Google's Firebase Cloud Messaging, all US-based. Where that's the case, it's covered by that provider's own safeguards for international transfers (such as the EU-US Data Privacy Framework or standard contractual clauses) — only the minimum data needed for that specific feature is sent, never your full account.

How long we keep it

Your data is kept for as long as your account exists. Deleting your account (in-app or at lvl99irl.app/delete-account) removes your account, your game data and your stored images from our database and storage straight away. A few copies outside it last a while longer, under each provider's own terms: the purchase records Google Play, Apple, Stripe and RevenueCat keep (we keep only your membership status, and it goes with your account), the delivery log Resend keeps of emails sent, our database host's automatic backups until they expire, and what the law requires us to keep (e.g. financial records, if any payment was ever made).

Your rights

You can, at any time:

• Access your data — export everything from Profile → Setup & settings.
• Rectify it — most fields are editable directly in the app; email us for anything that isn't.
• Erase it — delete your account in-app, or at lvl99irl.app/delete-account if you no longer have the app. This is immediate and permanent.
• Restrict or object to processing based on legitimate interest (e.g. opt out of analytics) — email us and we'll action it.
• Port your data — the export above is a portable JSON file.
• Withdraw consent for anything optional (Todoist, avatar, analytics) at any time, without affecting the core app.
• Complain to your local data protection supervisory authority if you believe we've mishandled your data — though we'd appreciate the chance to fix it first, at support@lvl99irl.app.

Children's privacy

This app is not directed at children under 14 (the digital-consent age under Lithuanian and EU law), and we don't knowingly collect data from them.

Changes to this policy

If this policy changes materially, the "last updated" date above will change and, where required, you'll be notified in-app.

Contact

Questions about this policy or your data: support@lvl99irl.app