Privacy policy

What is stored, and where

Your tracked records are stored on your device. You decide when to export, share or back them up.

On Android and iOS, new attachments are encrypted with a key in the device's secure storage. Older attachments are encrypted in the background. Browser attachments are stored locally without app-level encryption; the Storage page explains which protection is in use.

• Items, events, history, settings, templates and saved views — a local database on the device.
• Photos, receipts and documents — app-private files on Android and iOS, or this browser's local database on the web.
• The local data key — the Android Keystore or the iOS Keychain, where the platform provides one.
• Backups — only where you saved them.
• Events of calendar actions you turn on — the calendar you pick on your phone, which syncs them with its own account like any other event.

When LifeCue uses the network

LifeCue does not automatically upload your tracked records. The following features can share information outside the app.

A webhook action is off unless you turn webhooks on in Settings and configure one on an event. It sends the item name, the event name, the due date and your rendered message to the https address you typed, at the moment the action runs. Attachments are never included, only https is accepted, the request times out after fifteen seconds, and every attempt and its result appear in the action queue.

When you use email or SMS, LifeCue opens your chosen app with the text filled in. It does not send the message; you press Send. Sharing passes the content you select to an app you choose.

Reminders use device notifications. LifeCue does not automatically send reminder emails or text messages.

If you enable online product lookup, scanning can send a barcode to Open Food Facts, Open Beauty Facts or Open Products Facts to suggest a name. No item names, dates or device identifiers are included. These services receive normal connection information, such as your IP address. Lookup never supplies an expiry date.

Sending a suggestion submits your message, optional reply email, app version, platform and language to NeuraTiM so we can read and respond. Your tracked items, photos and reminders are not included.

The browser version may download fonts to display some languages. Font requests contain connection information but do not send your LifeCue records.

Permissions

Each permission is requested at the moment the feature is first used, never at launch, and refusing any of them leaves the rest of the app working. Contacts access is never requested at all: typing an email address does not require reading your address book.

• Notifications — reminders. Asked the first time you save one, after an explanation, and asked once rather than repeatedly. Refused, everything else keeps working and a banner links to Reminder health.
• Exact alarms (Android 12+) — reminders arriving at the minute rather than batched. Refused, reminders still fire, possibly late, and Reminder health says so.
• Camera — taking a photo or scanning a barcode. Refused, the photo library and manual entry remain.
• Photo library — attaching an existing image. Refused, the camera and manual entry remain.
• Biometrics or device credential — the optional app lock. Refused, the lock cannot be turned on, and the setting says why.
• Files — backups, exports and imports, through the system picker only. Refused, that one operation is cancelled.
• Calendar (iOS and Android) — calendar actions you turn on: the event is written into the calendar you pick, moved with its date and removed when it goes. Asked only when you turn one on, and LifeCue reads only the list of calendars and its own events. Refused, the event is not added and the action links to Settings.

Notification content

A lock screen can be read by anyone holding the phone, which is why what a reminder says is a setting rather than a default. Full details name the item and what is due; item name only pairs the name with a generic body; a generic message identifies nothing at all.

Changing it re-plans the alerts that are already scheduled, so the change takes effect immediately rather than only for reminders you create afterwards.

Analytics, advertising and third parties

LifeCue has no advertising, analytics, tracking, attribution, crash-reporting or remote-configuration tools. Optional feedback, lookup and webhook requests are described above.

Deleting your data

Trash holds deleted items for a retention period you choose — 30 days by default — and purges them automatically. Storage shows exactly what attachments are using and reports any file no record points at, without tidying anything away on its own.

Settings → Erase all local data removes every record, every attachment and the local encryption key from the device, and cancels every scheduled notification. It requires typing a word to confirm.

While calendar access is still granted, erasing also removes the events LifeCue added to your calendar. Without it, those events stay in your calendar for you to delete.

Backups you saved elsewhere are not affected. LifeCue cannot reach into a cloud folder to delete a file and does not claim to — delete those yourself.

Backups and encryption

If you choose to encrypt a backup, its contents are protected with AES-256-GCM using a key derived from your passphrase with Argon2id. The manifest stays readable so the restore preview can show its date and item counts. Unencrypted backups are also available and are labelled as such.

Without the passphrase an encrypted backup cannot be opened — not by you, and not by us. The create flow makes you acknowledge that before it will continue, and can generate a transcribable recovery key.

Not a medical, food-safety, legal or regulatory authority

LifeCue is an organiser. A date that has not passed does not mean something is safe, official dates are never silently extended, and “disposed” is a recorded outcome rather than physical or regulatory advice. The history it keeps is a personal activity log in a single-user local database: it is not tamper-proof, it is not notarised, and the app says so on the screen as well as here.

This website

This site exists to describe the app and let you try it. It is separate from the app, and everything below applies to the site only.

• Hosting — the site is served through Cloudflare, which may process standard request data such as IP address, browser user agent and the page requested, for delivery and security purposes. The site sets no analytics or advertising cookies and includes no tracking scripts.
• Language preference - your chosen language is saved in your browser and included in the page address, so shared links can open in that language.
• Donations are optional and do not change the app. The donation section may load Stripe's payment code. Payments are handled by the provider you choose: Stripe, Ko-fi, PayPal or GitHub Sponsors. Card details are entered into that provider's form. NeuraTiM receives payment confirmation and, where needed, the email you provide for receipts or a recurring donation. Each provider's privacy policy applies.
• Try it — that page embeds the web version of the app in a sandboxed frame. Anything you create in it is stored in your browser exactly as described above.
• External links — links to GitHub, neuratim.com and the app downloads lead to services with their own privacy policies.

Changes to this policy

If this policy changes, we update the date above. Any new feature that shares your information will explain what is sent and give you a choice before it is used.

Contact

Questions about this policy, or about anything the app does with your data, go to the same address as everything else:

info@neuratim.com