Privacy Policy

Who is responsible for your data

[LEGAL NAME], [POSTAL ADDRESS] (“we”, “us”), is responsible for the personal data processed through LifeWorks: its “controller” under the European Union’s General Data Protection Regulation (GDPR) and its “responsible party” under Mexico’s Federal Law on the Protection of Personal Data Held by Private Parties (LFPDPPP). You can reach us about privacy at [CONTACT EMAIL].

What you share in a team account is also available to that account’s members, according to their roles.

Information you give us

• Account details: your name, email address and password (stored only as a one-way hash), your language, time zone, theme and display preferences, and your profile picture if you upload one.
• Signing in with Google or Microsoft: if you choose to, your name, email address, profile picture and account identifier with that provider, and the access tokens that let us connect on your behalf.
• Your calendar: only if you allow it, read-only access to your Google or Microsoft calendar, so the dashboard and Focus can show your upcoming events. We read them when you look at them and keep them for about ten minutes in a cache; we never change your calendar.
• Security: if you turn on two-factor authentication, its secret and your backup codes; and the API tokens you create.
• Teams: the team accounts you create or join, your role in them, and the invitations you send, with the name and email address of each person you invite.
• Weather location: the city you choose for the weather panel, or your device’s location if you ask for it. We store the place’s name and its coordinates rounded to about 1 km.
• Billing: when you subscribe, your plan, subscription and payment history, and your card’s brand, last four digits and expiry date as our payment processor reports them. Your full card details go straight to the processor; we never see or store them.
• Messages: what you tell us when you write to us.

Your content

To do its job, LifeWorks stores what you write and organize in it: your pillars, goals, expected results, projects, actions and habits with their check-ins; your focus sessions; your day plans, journal entries and reflections; your notes, books, courses, media and knowledge labs; your tags, quotes and mantras; and the files and images you upload.

This content is often personal: a journal can reveal things about your health, beliefs or relationships. We process it only to provide the Service to you. We do not analyze it for advertising, sell it, or use it to train artificial intelligence models. Your personal account’s content is visible only to you; what you add to a team account is visible to that team’s members.

Information collected automatically

When you use LifeWorks, our servers record in their logs the technical information needed to deliver and protect the Service: your IP address, your browser and device type, the pages requested, and the date and time. We use no analytics or tracking tools to build a profile of you.

Cookies and browser storage

LifeWorks uses only the cookies it needs to work. It sets no advertising or analytics cookies, so there is nothing to opt into.

• Session: keeps you signed in and protects forms against forgery. It ends when you sign out or close your browser.
• Remember me: if you tick “Remember me”, keeps you signed in between visits.
• Language: remembers the language you picked.

Your browser’s local storage also keeps a few preferences on your device only: the light or dark theme you picked on the public pages, the focus timer’s state, the weather panel’s view and how many items a list shows. They are not sent to us, and you can clear them in your browser’s settings.

How we use your information

We use your information to:

• create and run your account and provide the features you use (to perform our contract with you);
• process your membership payments and keep the records the law requires (contract and legal obligation);
• send you the emails the Service needs: confirming your address, resetting your password, team invitations, receipts and important changes (contract);
• keep LifeWorks secure, prevent abuse and fix problems (our legitimate interest in a safe, working Service);
• answer you when you write to us (contract or legitimate interest);
• comply with the law and with lawful requests from authorities (legal obligation).

Under the LFPDPPP, all of these are primary purposes, necessary for the Service. We do not use your data for secondary purposes such as marketing or advertising; if we ever want to send you news about LifeWorks, we will ask first, and you can withdraw that consent at any time.

Your journal and reflections may contain sensitive personal data. We process them only because you choose to write them, only to show them back to you, and with the same protections as the rest of your content.

Who we share it with

We do not sell or rent your personal data. We share it only with the companies that help us run LifeWorks, and only what each one needs:

• Hosting: [HOSTING PROVIDER] hosts our servers, our database and the files you upload.
• Email: [EMAIL PROVIDER] delivers the emails the Service sends you.
• Payments: [PAYMENT PROCESSOR] processes membership payments and receives your payment details directly.
• Google and Microsoft: if you sign in with them or connect your calendar, we exchange with them the data needed for that.
• Google Fonts: the Service’s typefaces load from Google’s servers, which receive your IP address and browser details when a page loads.
• Gravatar and UI Avatars: until you upload a profile picture, your browser asks Gravatar (Automattic) for one using a hash of your email address; an account without a picture of its own shows its initials, drawn by UI Avatars, which receives the account’s name.
• Unsplash: the dashboard’s daily background photo comes from Unsplash, and your browser loads it from Unsplash’s servers. We send Unsplash only search words, never anything about you.
• Open-Meteo and Photon (komoot): to show the weather and find cities, our servers send them the city you type or your location’s rounded coordinates, never your name or email address.
• BigDataCloud: if you ask the weather panel to use your device’s location, your browser sends its rounded coordinates to BigDataCloud to name the place.
• YouTube: guided meditation videos play in YouTube’s privacy-enhanced mode. Nothing loads from YouTube until you press play; then YouTube receives your IP address and browser details and may set its own cookies.
• Link previews: when you add a link to a video or other embeddable page to your content, our servers ask that site for a preview, sending only the link.

Each of these companies handles the data under its own privacy policy. We may also disclose information when the law requires it; to protect the rights, property or safety of LifeWorks, our members or others; or to a company that takes over the Service, which would remain bound by this policy. We use no analytics, advertising or tracking services.

International transfers

Our providers may process your data in countries other than yours, including the United States, whose data protection laws may differ from those where you live. When we transfer personal data from the European Economic Area, the United Kingdom or Switzerland, we rely on the safeguards the law recognizes, such as the European Commission’s standard contractual clauses or the provider’s certification under the EU–U.S. Data Privacy Framework.

Under the LFPDPPP, sharing data with the providers that process it on our behalf to provide the Service does not require your consent. We will ask for it before any transfer that the law says needs it.

How long we keep it

• We keep your account and your content for as long as your account exists.
• Some things you delete, such as actions and projects, are kept so you can restore them, until you delete them permanently or delete your account.
• When you delete your user account from your profile, we immediately erase it from our database, together with your personal account, the team accounts you own and the content you created, including in other teams.
• Copies in our backups are overwritten within [BACKUP RETENTION PERIOD].
• Server logs are kept for a short time, for security and troubleshooting.
• Billing records are kept for as long as tax and accounting law requires.

Security

We protect your data with encryption in transit (HTTPS), passwords stored only as one-way hashes, optional two-factor authentication, separation between accounts, and access limited to the people who need it. No system is perfectly secure; if a breach affects your personal data, we will notify you and the authorities as the law requires.

Your rights

Depending on where you live, you have rights over your personal data. Under the GDPR (in the European Economic Area, the United Kingdom and Switzerland) you can ask to access, correct or delete your data, to receive a portable copy of it, to restrict or object to its processing, and to withdraw any consent you gave, without affecting what was done before. Under Mexico’s LFPDPPP you have the ARCO rights — access, rectification, cancellation and opposition — and you can revoke your consent or limit the use and disclosure of your data.

You can do much of this yourself: edit your profile, change or delete your content, disconnect Google or Microsoft from your connected accounts, and delete your user account from your profile. For anything else, write to [CONTACT EMAIL] from your account’s email address, saying what you are asking for. We may need to confirm your identity, and we will answer within the time the law sets; under the GDPR, one month.

If you think we have not respected your rights, you can complain to a data protection authority: in the European Union, the one in your country; in Mexico, the authority the LFPDPPP designates.

Children

LifeWorks is not meant for children. You must be at least [MINIMUM AGE] years old to create an account, and we do not knowingly collect data from anyone younger. If you believe a child has given us personal data, write to us and we will delete it.

Changes to this policy

We will update this policy when the Service or the law changes; the “last updated” date at the end says when. If a change is significant, we will tell you by email or in the app before it applies.

Contact

For any question or request about your privacy, write to [CONTACT EMAIL], or by post to [LEGAL NAME], [POSTAL ADDRESS].