LYLU – Legal Information

Privacy Policy

This Privacy Policy applies to the mobile application “LYLU – AI Diary & Mood Tracker” (hereafter the “Application”) provided by Emil Herzberg (hereafter the “Service Provider,” “we,” “us,” or “our”).

The Application is offered as a freemium service and is intended for use “AS IS”.

By using the Application, you agree to the collection and use of information in accordance with this Privacy Policy.

Effective date: 2025-11-21

1. Information We Collect

We collect different types of information in order to provide and improve the Application.

1.1 Account Information

When you create an account, we collect:

- Username
- Email address
- Password (stored in encrypted form)
- your age or year of birth, or an age confirmation (e.g. that you are at least 13 years old)

This data is used to authenticate you, manage your account, verify that you meet the minimum age requirements for using the Application, and handle your free or Pro subscription.


1.2 User-Generated Content (Diary Entries)

When you use the Application, we process:

Audio recordings that you create within the app

Text transcriptions of your audio recordings

Any text diary entries you write directly (if applicable)

This content may contain personal and sensitive information, depending on what you choose to record or write.

1.3 AI Analysis Data (Sentiment & Metrics)

To provide mood and emotion tracking features, we generate and store:

Sentiment scores and labels associated with each diary entry

Aggregated statistics (for example, daily or weekly average sentiment scores, number of entries per day, quota usage, etc.)

These data are used to power graphs, trends, and insights displayed in the Application.

1.4 Subscription & Payment Information

We do not store your credit card or bank details.

All purchases and subscriptions (e.g. Pro version) are processed through the Apple App Store or Google Play Store.

We use RevenueCat to manage:

Purchase receipts

Subscription status (e.g. active / expired)

An internal anonymous or app-specific User ID

We do not share your diary entries or audio content with RevenueCat.

1.5 Usage & Device Information (Automatically Collected)

When you use the Application, we may automatically collect certain information such as:

Device type and operating system

Approximate time spent in the app

Basic app interaction events (e.g., feature usage, screens viewed)

IP address and general non-precise network information (for security and diagnostics)

Approximate region information, such as a country or region code (for example "DE" or "US") and whether you are in a region where specific privacy rules apply (for example EEA/UK/Switzerland). 

This is derived from your device settings (such as system locale and time zone) and/or information provided by our advertising and consent partners. We do not use GPS or other precise location signals for this.

We do not collect precise geolocation (GPS) data.

This information is used for troubleshooting, security, applying the correct regional privacy and advertising rules, and to understand how the Application is used so we can improve it.

1.6 Consent Records, Region & Advertising Preferences

When you interact with our consent and settings interfaces, we keep records of your choices so we can demonstrate compliance with data protection laws, respect your preferences over time, and configure how ads are shown in the free version of the Application.

This may include:

- Whether and when you agreed to our Privacy Policy and Terms and Conditions (e.g. privacyPolicyConsent, termsAndConditionsConsent)
- The date and time of your consent or change of preferences
- The IP address at the time of consent
- The method or context of consent (for example "registration_checkbox" or "settings_toggle")
- Whether you have consented to personalised ads (personalizedAdsConsent) and when you changed this setting
- Your stored region classification, such as a two-letter country/region code (userRegion) and a flag indicating whether you are treated as being in the EEA/UK/Switzerland for consent purposes (isEURegion)

We process this information to:
- apply the correct regional consent rules (for example, where EEA/UK/Swiss law requires opt-in for personalised advertising),
- provide or disable personalised advertising in line with your choices,
- and keep an audit trail showing when and how your consent was obtained or withdrawn.


2. How We Use Your Information

We use the information we collect for the following purposes:

Provide core functionality:
To allow you to record audios, transcribe them, generate sentiment scores, and view graphs and statistics in the Application.

Account management:
To create and maintain your user account, authenticate your login, and manage your settings.

Subscription & billing:
To verify and manage your Pro subscription status and entitlements (via RevenueCat and app stores).

Analytics and improvement:
To understand how the Application is being used, fix bugs, and improve performance and user experience.

Communication:
To contact you with important information, required notices, and occasionally with service-related or promotional messages.
You may opt out of marketing communications at any time by following the unsubscribe link in such emails or contacting us.

Security and fraud prevention:
To protect the Application, our users, and our infrastructure against abuse, unauthorized access, and other harmful activity.

3. Use of Artificial Intelligence (OpenAI)

To provide transcription and sentiment analysis, we use the OpenAI API.

3.1 Data Sent to OpenAI

When you request transcription or sentiment analysis:

Your audio file and/or its text transcription are sent securely to OpenAI’s servers.

The data is used solely for:

Converting speech to text (transcription)

Generating sentiment or related text analysis

3.2 Data Retention by OpenAI

According to OpenAI’s current API policies, data sent via the API:

Is not used to train OpenAI’s models or improve their public services by default

May be retained for a limited period (typically up to 30 days) for abuse and misuse monitoring, after which it is deleted, unless longer retention is legally required

For the most up-to-date information, please refer to OpenAI’s official documentation and privacy policy.

OpenAI Privacy Policy:
https://openai.com/policies/privacy-policy

3.3 No Medical or Psychological Advice

The sentiment analysis and any scores, labels, or graphs displayed in the Application are:

Automatically generated by AI

Intended only for informational and self-reflection purposes

They must not be considered or used as:

Medical advice

Psychological counseling

A diagnosis or treatment recommendation

If you have concerns about your mental health or well-being, you should contact a qualified professional.

4. Third-Party Service Providers

We may share certain information with trusted third-party service providers to operate and improve the Application. These providers are only authorized to use your information as necessary to provide services to us.

4.1 OpenAI (AI & Transcription)

Purpose: Speech-to-text transcription and sentiment / text analysis

Data shared: Audio and/or text from your diary entries as needed for the requested AI features

Key points:

Data is used only to provide the requested AI processing

API data is not used to train OpenAI’s public models

Data may be retained by OpenAI for a limited period for abuse monitoring

Privacy Policy: https://openai.com/policies/privacy-policy

4.2 RevenueCat (Subscription Management)

Purpose: Managing in-app purchases and subscription status

Data shared:

Anonymous or app-specific User ID

Purchase receipts and subscription details

We do not share your diary content or audio files with RevenueCat.

Privacy Policy: https://www.revenuecat.com/privacy

4.3 Google AdMob and Google User Messaging Platform (UMP) (Advertising in Free Version)

Purpose:
To display in-app advertisements in the free version of the Application and to manage user consent for advertising in regions where this is legally required.

Where used:
- Ads are shown only in the free version of the Application. The Pro version is ad-free.
- We use the Google Mobile Ads SDK (AdMob) to load and display ads.
- We use Google’s User Messaging Platform (UMP) SDK to determine whether consent is required (for example for users in the EEA/UK/Switzerland) and, where necessary, to show a consent form.

Data processed by Google:
When ads and consent forms are displayed, Google may automatically collect and process information such as:

- IP address and general location information (for example to determine whether you are in a region where consent is required)
- Device identifiers (such as the device’s advertising ID, e.g. GAID or IDFA)
- Information about how you interact with the app and with ads (for example ad impressions, taps, or views)
- Technical and diagnostic data (for example app performance and crash information)

Google uses this data to provide and measure advertising services, manage consent, prevent fraud and abuse, and comply with its own legal obligations. For more information on how Google processes data in the context of ads and the UMP SDK, please consult Google’s own privacy and terms.

Personalised vs non-personalised ads:
In regions where consent is required (for example the EEA/UK/Switzerland), we rely on your consent to show personalised ads. If you do not consent to personalised advertising, we will either show only non-personalised ads (which are not based on your profile) or no ads at all, depending on your settings and location.

On iOS devices, we also use Apple’s App Tracking Transparency (ATT) framework (via the expo-tracking-transparency library) to request your permission before accessing your device’s advertising identifier for tracking across apps and websites. If you decline this permission, we will not use the device’s IDFA for cross-app tracking, and only limited, non-personalised ads may be shown.

We do not share the content of your diary entries (audio or text) with Google AdMob or UMP.

4.4 Other Disclosures

We may disclose user information:

As required by law (e.g., to comply with a subpoena or similar legal process)

When we believe in good faith that disclosure is necessary to:

Protect our rights, property, or safety

Protect your safety or the safety of others

Investigate fraud, abuse, or security issues

Respond to a government request

In connection with a business transfer, such as a merger, acquisition, or sale of assets, where user data may be transferred as part of that transaction, subject to this Privacy Policy.

We do not sell your personal data.

5. Legal Bases for Processing (EEA/UK Users)

If you are located in the European Economic Area (EEA), the United Kingdom, or Switzerland, our legal bases for processing your personal data include:

Contractual necessity:
To provide you with the Application and its core features (account, diary, transcription and analysis, subscription management).

Legitimate interests:
To maintain and improve the Application, prevent fraud and abuse, secure our systems, keep records of your consents and preferences, and determine which regional legal requirements apply to you (for example, whether we must ask for consent before showing personalised ads).

Consent:
Where required by law, for example for:
- personalised advertising via Google AdMob,
- certain analytics or marketing activities,
- and, on iOS, allowing third parties to use your device identifier for tracking through Apple’s App Tracking Transparency framework.

You may withdraw your consent at any time in the Application settings (where available) or by contacting us. Withdrawing consent does not affect the lawfulness of processing based on consent before its withdrawal.

Compliance with legal obligations:
We may process certain information (such as billing data, consent and region logs, and security logs) where this is necessary to comply with legal obligations, including accounting, tax, and data protection laws.


6. Data Retention and Deletion
6.1 General Retention

We retain:

Your account information

Your diary entries (audio, text, and associated sentiment scores)

Your aggregated mood statistics and usage metrics

for as long as your account is active and as needed to provide the Application.

This also includes keeping limited records of your consent and region classification (for example, when you accepted this Privacy Policy, Terms and Conditions, and your ad preferences) for as long as necessary to demonstrate compliance with our legal obligations and to handle any disputes.


6.2 Deletion of Individual Entries

If you delete a specific diary entry in the Application:

The associated audio file, transcription, and sentiment analysis data are permanently removed from our active database.

6.3 Account Deletion

You can request deletion of your entire account via:

The in-app settings (if available), or

By contacting us at emil.herzberg.business.1@gmail.com

Upon account deletion:

Your account credentials,

All diary entries (audio and text), and

Associated sentiment and usage data

will be permanently erased from our active systems, except where retention is required by law (e.g., for tax or accounting obligations related to purchases).

6.4 Backups

Residual copies of your data may remain in encrypted backups for a limited period (for example, up to 30 days) before being overwritten as part of our standard backup and disaster-recovery procedures.

Data stored in backups is:

Not used for any active processing

Not accessible through the Application

6.5 Opt-Out by Uninstalling

You can stop further collection of data by uninstalling the Application from your device.
However, uninstalling alone does not automatically delete data already stored on our servers; for that, you must request account deletion (see above).

7. Your Rights

Depending on your location, you may have some or all of the following rights regarding your personal data:

Access: Request a copy of the personal data we hold about you.

Correction: Request correction of inaccurate or incomplete data.

Deletion: Request deletion of your personal data, subject to legal retention obligations.

Restriction: Request a restriction on processing in certain circumstances.

Portability: Request a structured, commonly used, and machine-readable copy of certain data.

Objection: Object to certain types of processing, including direct marketing.

To exercise any of these rights, please contact us at emil.herzberg.business.1@gmail.com
.
We may need to verify your identity before responding to your request.

If you are in the EEA/UK, you also have the right to lodge a complaint with your local data protection authority.

8. Children’s Privacy

The Application is not directed to children under 13 years of age, and we do not knowingly collect personal information from children under 13.

If we become aware that we have collected personal information from a child under 13:

We will promptly delete that information from our servers.

If you are a parent or guardian and believe your child has provided us with personal information, please contact us at emil.herzberg.business.1@gmail.com
 so we can take appropriate action.

9. Security

We are committed to protecting your information and take reasonable measures to safeguard it, including:

Encryption in transit (e.g., HTTPS)

Restricted access to production systems

Technical and organizational measures designed to prevent unauthorized access, disclosure, or modification

However, no method of transmission over the internet or method of electronic storage is completely secure, and we cannot guarantee absolute security.

10. International Data Transfers

Your information may be processed and stored on servers located outside your country, including in countries that may have different data protection laws than your country of residence.

Where required by law, we take appropriate safeguards (such as Standard Contractual Clauses) to ensure that any transfers of personal data are conducted in accordance with applicable data protection rules.

11. Changes to This Privacy Policy

We may update this Privacy Policy from time to time.

Any changes will be posted within the Application and/or on the relevant app store listing.

The “Effective date” at the top of this policy will be updated accordingly.

Your continued use of the Application after any changes to this Privacy Policy will be deemed acceptance of those changes.

12. Contact Us

If you have any questions or concerns about this Privacy Policy or our data practices, please contact us at:

Email: emil.herzberg.business.1@gmail.com