Privacy policy

Who we are

The data controller is Limited Liability Company «Narmafzor» (Narmafzor LLC), EIN (RYaM) 0310028749, TIN 030040794, 95 Firdavsi Street, Office 132, Firdavsi District, Dushanbe, 734000, Republic of Tajikistan. Contact for data questions: info@narmafzor.tj.

We process personal data in accordance with the Law of the Republic of Tajikistan “On Personal Data Protection” and take into account the laws of the countries where our users live, including the EU General Data Protection Regulation (GDPR) where it applies.

“Just on this phone” mode

Tasks, projects, habits, money, journal and settings are stored in a database on your device. We don’t receive or see them.

• Backups are files you save or share yourself; the daily backup is kept on the device.
• Speech recognition is done by your phone’s system (Apple Speech on iOS, Google’s recognition service on Android), which may send audio to its servers under Apple’s or Google’s rules.
• Reminders are created on the device, without our server.

What we process in “With an account” mode

Account

• your email address and, if you give one, your name;
• your password — only as an irreversible argon2id hash; we never store the password itself;
• if you sign in with Apple or Google — your account identifier with that provider and the email address it shares (Apple may share a private relay address).

Your records

Tasks, projects, stages and plans, checklists, accounts, categories, transactions, budgets, recurring payments, debts, goals, habits and check-ins, journal entries and weekly reviews. You enter financial data yourself: LifeAPP doesn’t connect to banks or process payment cards.

You can turn off syncing of personal data in “Settings → Account & sync → Keep personal data in the cloud”. Then only team data reaches the server.

Team data

Projects, accounts and records you move into a team are visible to its members. Members see your name and email address, and each record shows who added and changed it.

Technical data

• a random device identifier the app creates for syncing;
• information about your sign-in sessions;
• web server logs: IP address, time, requested address, app or browser details;
• application logs on the server: method, path, response code and duration — without IP addresses or content;
• the number of voice requests and seconds per day, for daily limits.

Crash reports (in both modes)

When the app crashes, it sends our server a technical report: the error type and message, where in the code it happened (stack trace), and the app and operating system versions. The report isn't linked to an account and holds no device identifier or records of yours. You can turn it off in Settings → Data → Send crash reports.

What we don’t collect

Location, contacts, photos, advertising identifiers, Health data or payment cards.

Paying for plans

• On the website (Alif). You enter your account email, the plan and, optionally, a phone number. You enter your card on the page of the Alif payment service; we never receive or store card details. We send Alif the order number, the amount and your phone number if you gave one, and receive the payment status and transaction number from Alif.
• In the App Store. Apple processes the purchase. We receive transaction details signed by Apple: the transaction ID, the subscription, start and end dates, renewal status and your LifeAPP account ID, which the app passes along with the purchase. We don’t receive payment details or your Apple ID.
• We keep the order history and plan periods to switch plans on, answer payment questions and issue refunds.

Voice capture

• With an account, your voice recording (compressed audio, up to 40 seconds) is sent to our server over HTTPS. The server passes it for recognition to one of our providers — Google (Gemini API) or OpenAI.
• Along with the recording we send the names of your accounts, categories, projects and stages and today’s date, so the sentence is split into the right records.
• We don’t store the audio or the transcript on the server. The result goes back to the app, where you see the records and can undo them.
• We use the providers’ paid APIs, under which the data sent is not used to train their models. Providers may keep requests for a limited time to prevent abuse, under their own terms.
• If the server is unavailable or the daily limit is reached, the phone’s own recognition is used.
• Voice capture is optional: you can do everything with the keyboard.
• Text you share with LifeAPP or paste (a bank SMS, for example) is handled like a voice recording: sent for recognition and not kept on the server.

Purposes and legal bases

• providing the features you choose — sync, teams, voice capture — to perform our contract with you (the terms of use);
• security, abuse prevention and daily limits — our legitimate interest;
• password reset emails and important service messages — performance of the contract;
• complying with the law.

We don’t use data for advertising or profiling, and we don’t sell it.

Who receives data

The server is in the EU. Google and OpenAI may process data in the United States and other countries; we send them only what recognition needs.

How long we keep data

• account data and records — while the account exists; deleted immediately when you delete the account, and from database backups within 14 days;
• web server logs — 14 days;
• crash reports — 90 days after the crash last happened;
• payment history and plan periods — while the account exists; Alif and Apple keep payment records under their own rules and the law;
• sign-in sessions — until you sign out or they expire;
• password reset links — 1 hour;
• data on the device — until you delete it or the app.

Deleting your account and data

Delete your account in the app: “Settings → Account & sync → Delete account”. This removes the account, sign-in methods, sessions, personal data on the server and invites. Teams you owned pass to another member, or are deleted if you were the only member. Records you added to teams stay with the team.

If you can’t access the app, email info@narmafzor.tj from your account’s address. See Account deletion for details.

How we protect data

• all connections to the server are encrypted (HTTPS/TLS);
• passwords are stored only as argon2id hashes;
• short-lived access tokens and single-use refresh tokens; reusing a token revokes every session in that chain;
• server access is restricted, the database isn’t reachable from the internet, and backups are made daily;
• on the device, data lives in the app’s isolated storage; you can turn on a Face ID, Touch ID or fingerprint lock — biometrics never leave your phone’s system and are not available to us.

Your rights

You can access your data, correct it (right in the app), export it (backup or CSV in the app), delete it, withdraw consent and object to processing. Send requests to info@narmafzor.tj — we reply within 30 days. You may also complain to a data protection authority or a court.

Children

LifeAPP is not intended for children under 13, and we don’t knowingly collect their data. If you believe a child has created an account, write to us and we will delete it.

Changes to this policy

We may update this policy. The current version is always published on this page with its date. We’ll announce significant changes in the app.