Privacy Policy

Your privacy matters to us. This Privacy Policy explains what information Life Map ("Life Map," "we," or "us") collects when you use the Life Map service ("Service"), how we use it, and the choices and rights you have.

1. Information We Collect

• Account information: your name, email address, and profile picture, received from Google or Facebook when you sign in with those providers, or from your email address when you sign in with a magic link.
• Profile information you provide: your preferred name, date of birth, gender (optional), username, bio, and account visibility settings.
• Timeline content: the entries you create — titles, text, dates, and locations (including map coordinates) — and your life maps.
• Media: photos, videos, and audio files you upload.
• Billing information: if you subscribe to Plus, payments are processed by Stripe. We store your Stripe customer and subscription identifiers and status — never your full card number.
• Technical information: your IP address (used for rate limiting and abuse prevention), browser and device information, and error reports.
• Cookies: a strictly necessary session cookie keeps you signed in (see Section 6).

2. How We Use Your Information

• To provide and operate your personal timeline;
• To store and serve your uploaded media to you and to viewers you authorize;
• To send essential service emails, such as magic-link sign-in links;
• To secure the Service — authentication, rate limiting, and abuse prevention;
• To monitor errors and improve reliability (error reports are scrubbed of personal information before they reach our error monitoring provider);
• To respond to support requests and legal obligations.

We do not sell your personal information, and we do not use your content for advertising.

3. Legal Bases (GDPR)

Where the EU General Data Protection Regulation applies, we process personal data on the following legal bases: performance of our contract with you (operating your timeline), legitimate interests (security, error monitoring, and service improvement), compliance with legal obligations, and — where required — your consent.

4. Media Storage & Public Links

Important: media you upload is stored with our cloud storage provider (Cloudflare R2) and served through long, random, unguessable public URLs, similar to photo services like Instagram. Anyone who obtains a media URL can view the file. This design is deliberate — it allows fast global delivery of your photos and videos. By uploading media you acknowledge and accept this trade-off, and you should not share media URLs outside the Service. When you delete media or your account, we remove the related database records and delete the underlying files from storage on a best-effort basis, after which the links stop working.

5. Cookies

The Service uses a strictly necessary session cookie (set by our authentication provider, NextAuth) to keep you signed in. We do not use advertising or third-party analytics cookies, so no cookie-consent banner is required. Your browser settings allow you to block or delete cookies, which may prevent you from staying signed in.

6. Sharing & Disclosure

We do not sell your personal information. We share information only:

• With viewers you authorize: when you make your timeline visible to followers or the public, or share a link, those viewers can see your entries and media. Public timelines can be viewed by anyone with the link, without signing in.
• With service providers: the subprocessors listed in Section 7, who process data on our behalf under their own privacy commitments.
• As required by law: to comply with legal process, or to protect the rights, safety, or property of Life Map, our users, or the public.

7. Third-Party Services

Each provider has its own privacy policy. Where your data is processed outside your home country, transfers rely on the providers' standard contractual clauses and similar safeguards.

8. Data Retention

• Account data and content are kept for as long as your account exists.
• Deleted content: when you delete entries or media, we remove the records from our database and delete the underlying files from storage on a best-effort basis. Deleting your account removes all of your data in the same way.
• Notifications are automatically deleted 90 days after they are created.
• Sign-in tokens expire after 24 hours.
• Billing data is retained by Stripe according to Stripe's retention policies.
• Backups: our database provider maintains backup snapshots for disaster recovery; deleted data may persist in those snapshots for a limited period before being overwritten.

9. Data Security & Breach Notification

We implement appropriate technical and organizational measures — including encryption in transit, access controls, rate limiting, and authentication on all account data — to protect your information. No method of transmission or storage is 100% secure, and we cannot guarantee absolute security. In the event of a data breach that poses a risk to your rights, we will notify you and, where required, the relevant authorities without undue delay.

10. Your Rights

Depending on where you live, you may have the right to:

• Access a copy of the personal data we hold about you;
• Correct inaccurate or incomplete data;
• Delete your data (in the app: Settings → Delete account);
• Export your data in a portable format (in the app: Settings → Download your data);
• Restrict or object to certain processing;
• Withdraw consent where processing is based on consent.

California residents (CCPA/CPRA): you have the right to know what personal information we collect, to request deletion of your personal information, and to opt out of the "sale" or "sharing" of personal information for cross-context behavioral advertising — we do not sell or share personal information for advertising, and we do not discriminate against you for exercising these rights.

To exercise any right, email support@lifem.app. We will verify your identity and respond within the timeframes required by law (typically within 30 days).

11. Children's Privacy

The Service is not directed to children under 13 (or under 16 in jurisdictions that require a higher age of consent). We do not knowingly collect personal information from children under the applicable age. If you believe a child has provided us with personal information, contact us at support@lifem.app and we will delete it.

12. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by email and/or through the Service, and the "Last updated" date above will be revised.

13. Contact

Questions about this policy or your data? Contact us at support@lifem.app or via our contact page.