Privacy Policy

Version 1.1 · Effective 2026-08-16

1. Who this policy covers

KLILU is developed and published by LAKASAG. This policy explains what data KLILU processes, where it is stored, and the choices you have.

Contact and support: lakasagdev@gmail.com. Operating location: Montréal, Québec, Canada.

2. Data stored only on this device

KLILU is offline-first: routines, events, projects, tasks, notes, and habit-completion history are stored in a local SQLite database on your device. This data is never transmitted anywhere unless you create an account and enable cloud sync (section 3) or explicitly export a backup file yourself (section 6).

A locally generated device identifier is stored in your device's secure storage (iOS Keychain or Android protected storage) so that, if you use an account, sync mutations can be attributed to this device. This identifier is not an advertising ID and is not shared with advertisers or data brokers.

3. Account creation and cloud synchronization

Creating an account is optional. If you create one, you provide an email address and password, which are processed by our authentication and database provider, Supabase, to create and authenticate your account. We do not receive or store your password ourselves.

If you sign in, the same records described in section 2 are synchronized to a Supabase-hosted database so you can use KLILU across multiple devices. Synchronized data is scoped to your account with database-level access rules, so only requests authenticated as your account can read or write it.

Session credentials (access and refresh tokens) issued after sign-in are stored in your device's secure storage, the same operating-system-protected storage used for the device identifier above.

Sign-in currently uses email and password only. We do not offer, or process data through, any third-party social or OAuth sign-in provider.

Supabase automatically records limited authentication and API security metadata, including authentication event type and time, account identifier, IP address, and user-agent or request metadata. This supports account security, abuse prevention, rate limiting, reliability, and troubleshooting. KLILU does not request device location permission; an IP address may nevertheless indicate an approximate location.

4. Notifications and reminders

Reminders you set are scheduled and delivered by your device's operating system based on data already stored locally. As of this policy version, KLILU does not use a push-notification service and does not collect a push token; reminder scheduling happens entirely on-device.

5. Analytics, advertising, and crash reporting

KLILU does not currently integrate any analytics SDK, advertising SDK, or crash-reporting SDK. If that changes in a future release, this policy will be updated first, with a new version number and effective date, and any consent this requires will be requested through the app.

6. Backup and restore

You can export your data as a JSON backup file at any time from Settings. The file is written to a location you choose through your device's native share sheet or file system; it is not automatically uploaded to us or to any third party. Restoring a backup reads a file you select and merges it into your local database; a backup you did not explicitly export or restore is never read.

7. Payments and subscriptions

KLILU does not process payments, offer subscriptions, or send purchase information to a billing provider in this release. The app will update this policy before any payment processing is introduced.

8. Data retention

Local data on your device is retained until you delete it, clear the app's storage, or uninstall the app. Account-linked cloud content is retained while your account exists and is removed when you delete your account (section 10) or when we are validly required to remove it sooner. Supabase security and service logs may remain for the provider's limited plan-dependent retention period after account deletion; they are not used for advertising or product analytics.

9. Data export

You can export a complete, human-readable copy of your locally stored data at any time using Settings → Export backup, whether or not you have an account. This is the same file format used for restore, described in section 6.

10. Account and data deletion

You can permanently delete your account from Settings → Account → Delete account. This removes your authentication record and your account-linked cloud-synced content from our database. Limited security or service logs may remain for the provider retention described in section 8. Deletion does not remove data stored only on this device; that data remains under your control and can be removed by clearing the app's storage or uninstalling KLILU.

See the Account & Data Deletion page for the full process, including how to request deletion without the app.

11. Security practices

Session tokens and the device identifier are stored using your operating system's protected credential storage (Keychain on iOS and protected storage on Android), not in plain application storage. Requests to our backend are made over HTTPS. Cloud-synced data is scoped per account by database access-control rules that permit only a signed-in account to read or write its own rows. We have not undergone a third-party security audit as of this policy version, and we do not claim data is encrypted at rest beyond what our infrastructure provider, Supabase, independently states about its service.

12. International processing

If you use an account, your account and synchronized data are processed through Supabase infrastructure hosted in Northern Virginia, United States (East US). This means account-linked data may be processed and stored outside Canada and may be subject to the laws of the jurisdiction where it is processed. LAKASAG operates from Montréal, Québec, Canada.

13. Children's privacy

KLILU is not directed at children under 14. We do not knowingly collect data from children under that age. If you believe a child has created an account, contact lakasagdev@gmail.com so it can be removed.

14. Your choices and rights

You can use most of the app without an account and without any data leaving your device. If you have an account, you can export your data, sign out (which stops sync but keeps local data on this device), or delete your account entirely (section 10). Depending on where you live, you may have additional rights over your personal data; contact us to exercise them.

15. Changes to this policy

If we make a material change to this policy, we will update the version number and effective date below and surface the update in the app before it takes effect for account-linked processing.

16. Effective date and version

Version 1.1, effective 2026-08-16.