Privacy Policy
In short:
We collect only what we need to run LifePusher: your account details, the habits and goals you create, and your payment status. Health-related details you choose to write in your habits or goals are sensitive and we handle them with extra care. We do not sell your personal data. Payments are handled by Stripe, and free-tier users see ads from Google AdMob. You can access, export, correct, and delete your data at any time. LifePusher is for users aged 16 and over.
1. Who we are
The controller of your personal data is:
Przemysław Rogala
Jednoosobowa działalność gospodarcza (sole proprietorship)
00-851 Warszawa, Poland
NIP (Polish tax ID): 5272944686
EU VAT number: PL5272944686
Contact: contact@mindrebel.pl
We have not appointed a Data Protection Officer. Privacy questions and requests go to the contact address above.
This policy explains how we handle personal data when you use the LifePusher mobile app, the LifePusher web app, and our related services (together, the "Service").
2. Personal data we collect
| Category | Examples | Where it comes from |
|---|---|---|
| Account data | Email address, display nickname, sign-in provider and provider user ID, account creation date | You, or your Google, Apple, or Facebook account when you sign in |
| Habit and goal data | Titles, descriptions, schedules, reminders, status history, completion records, stake settings | You |
| Sensitive habit content | Any text you write that reveals your health, for example a habit to stop drinking alcohol or smoking | You |
| Social data | Friend connections, friend invitations, nominated friend for a Blast Text, messages sent between users | You and the users you connect with |
| Payment data | Stripe customer ID, subscription status, purchase history, gem transactions. We do not store full card numbers. | You and Stripe |
| Device and technical data | Device type, operating system, app version, language, IP address, crash logs, push notification token | Your device and our servers |
| Advertising data | Advertising identifier and ad interaction data, for users who see ads | Your device, via Google AdMob |
| Support data | Emails and messages you send to us | You |
3. Sensitive information in your habits and goals
Some habits and goals may reveal information about your health, such as substance use, medication, mental health, or eating patterns. Under GDPR Article 9, this is a special category of personal data.
- We process this information only to provide the features you use: reminders, progress tracking, and stake consequences.
- Before you first save a habit or goal that may reveal health information, we ask for your explicit consent. The consent screen explains what we store and why.
- We keep a record of your consent: the date and time you gave it, and the version of the consent text you saw. We keep this record so we can show that you consented.
- You can withdraw your consent at any time by deleting your habits and goals and your account. Deleting your account removes the consent record along with your other data, subject to the backup period in section 13.
- We do not use this information for advertising or sell it to anyone.
- You do not have to include health details in your habit names. You can use a general label instead.
4. Why we process your data and our legal basis
| Purpose | Legal basis (GDPR) |
|---|---|
| Creating and running your account, storing your habits and goals, sending reminders, applying stake consequences | Performance of a contract (Art. 6(1)(b)) |
| Processing sensitive habit content | Your explicit consent (Art. 6(1)(a) and Art. 9(2)(a)) |
| Processing payments, managing Premium subscriptions and gem purchases | Performance of a contract (Art. 6(1)(b)) |
| Keeping invoices and accounting records required by Polish tax and accounting law | Legal obligation (Art. 6(1)(c)) |
| Showing ads to free-tier users, including personalised ads where you consent | Your consent (Art. 6(1)(a)), or legitimate interest for non-personalised ads (Art. 6(1)(f)) |
| Sending service emails, such as account and security notices | Performance of a contract (Art. 6(1)(b)) or legitimate interest (Art. 6(1)(f)) |
| Sending marketing emails, if you choose to receive them | Your consent (Art. 6(1)(a)) |
| Security, fraud prevention, crash diagnosis, and protecting the Service | Legitimate interest (Art. 6(1)(f)) |
| Defending legal claims | Legitimate interest (Art. 6(1)(f)) and, where needed, legal obligation (Art. 6(1)(c)) |
You can withdraw consent at any time. Withdrawal does not affect processing done before you withdrew.
5. Sign-in options
You can create an account with Google, Apple, or Facebook. We receive the information the provider shares with us, usually your name, email address, and a provider user ID. We verify sign-in tokens on our servers. Each provider processes your data under its own privacy policy.
- Sign in with Apple may give us a private relay email address. Messages sent to that address are forwarded to you.
- Facebook Login is provided by Meta Platforms Ireland Limited (for EEA users).
6. Friends and Blast Text
LifePusher lets you connect with a friend and nominate them to receive a message if you miss a commitment (a "Blast Text"). When this happens:
- The friend receives an in-app message showing your nickname, the habit or goal title, and the message you wrote.
- We only deliver the message to a friend who has accepted your friend invitation. We check the friendship again at delivery time.
- We store a copy of the delivered message so it remains available to the recipient. Editing or removing the stake later does not change a message already delivered.
If you nominate someone else, please make sure they have agreed to be part of LifePusher. Do not add people who have not agreed to connect.
7. Payments
Payments for Premium subscriptions and gem purchases are processed by Stripe, Inc. and its affiliates. We receive from Stripe the information needed to manage your subscription and purchases, such as status, amount, date, and a customer reference. We do not receive or store your full card number. Stripe processes card data under its own privacy policy and acts as a controller for some of its processing.
8. Advertising (free tier)
Free-tier users see advertisements served by Google AdMob, provided by Google Ireland Limited (for EEA users) and Google LLC.
- Consent: In the EEA, UK, and Switzerland, we show a consent prompt before personalised ads are served. If you decline, you will still see ads, but they will not be personalised. Where we use a consent management platform, we follow the IAB Transparency and Consent Framework.
- iOS: On iPhone and iPad, we ask for your permission through Apple's App Tracking Transparency prompt before using your advertising identifier for tracking. You can change this in your device settings at any time.
- Android: You can reset or delete your advertising ID in your device settings.
- We do not use health-related habit content to choose which ads you see.
Premium subscribers do not see ads.
9. Notifications and data stored on your device
- Reminders are scheduled on your device and do not need a server to send them.
- Blast Text messages are checked periodically by a background task on your device, which then shows a notification. Operating systems decide when background tasks run, so notification timing is not guaranteed.
- Offline data: The app keeps a local copy of your habits and goals so it works offline. This copy stays on your device, and it is removed when you sign out or delete your account.
- You can turn off notifications at any time in your device settings.
10. Who we share data with
We share personal data only with the following categories of recipients, and only as needed for their role:
| Recipient | Role | Location |
|---|---|---|
| Microsoft Azure | Hosting for our servers, database, and web app | European Union |
| Stripe | Payment processing and subscription management | United States and EU, with safeguards |
| Google (sign-in, AdMob) | Sign-in verification; advertising for free-tier users | United States and EU, with safeguards |
| Apple | Sign in with Apple; App Store and iOS services | United States and EU, with safeguards |
| Meta Platforms Ireland Limited | Facebook Login | Ireland and United States, with safeguards |
| Mailgun (Sinch) | Sending transactional emails | European Union |
We may also share data where required by law, in response to a valid court order or request from a public authority, or to protect the rights, safety, or property of LifePusher, its users, or others. If the business is sold or transferred, personal data may transfer to the new owner under the same protections.
We do not sell your personal data.
11. International transfers
Some of our providers are located outside the European Economic Area. Where we transfer data outside the EEA, we rely on an adequacy decision (such as the EU-U.S. Data Privacy Framework where applicable) or on the European Commission's Standard Contractual Clauses, with supplementary measures where needed.
12. Automated consequences
LifePusher applies consequences automatically when a commitment is missed. For example, gems may be deducted or a Blast Text may be sent. These consequences are part of the service you choose when you set a stake. They do not produce legal effects that you have not agreed to.
If you believe an automated consequence was applied in error, contact us and we will review it. You may also object to this processing under Article 21 GDPR.
13. How long we keep your data
- Account and habit data: kept while your account is active.
- Deleted accounts: removed from our live systems on request. Copies in encrypted backups are deleted within 30 days.
- Payment and invoice records: kept by us and Stripe for the period required by Polish tax and accounting law, generally 5 years from the end of the relevant tax year.
- Support emails: kept for as long as needed to resolve the request and for a reasonable period after that, unless longer retention is required by law.
- Security and crash logs: kept for a limited period needed to keep the Service secure and stable.
14. How we protect your data
- All connections use HTTPS encryption.
- We keep sign-in details separate from habit content, and we limit internal access to people who need it.
- Passwords are not used for social sign-in. Where we store credentials, they are hashed and salted.
- Sensitive data is encrypted at rest on our servers.
- No system is completely secure. If we learn of a personal data breach that puts your rights at risk, we will notify the Polish supervisory authority within 72 hours where required, and inform you where required.
15. Your rights
Under the GDPR you have the right to:
- Access your personal data and receive a copy (Art. 15).
- Rectify inaccurate data (Art. 16).
- Erase your data (Art. 17). You can delete your account in the app, or ask us to do it.
- Restrict processing (Art. 18).
- Receive your data in a structured, commonly used, machine-readable format, and transfer it to another controller (Art. 20).
- Object to processing based on legitimate interest (Art. 21).
- Withdraw consent at any time, without affecting earlier processing (Art. 7(3)).
- Not be subject to decisions based solely on automated processing with legal or similarly significant effects, subject to the exceptions in Art. 22.
To exercise your rights, email contact@mindrebel.pl. We will respond within one month. We may ask you to confirm your identity first. We do not charge a fee unless your request is clearly unfounded or excessive.
You can also delete your data yourself by deleting items in the app, or your account in the account settings.
Right to complain: You can lodge a complaint with the Polish supervisory authority: Prezes Urzędu Ochrony Danych Osobowych (UODO), ul. Stawki 2, 00-193 Warszawa, Poland, uodo.gov.pl. You can also complain to the authority in your country of residence within the EU.
16. Age requirement
LifePusher is intended for users aged 16 and over. This is the minimum age for consent to information society services under Polish law. We do not knowingly collect personal data from anyone under 16. If we learn that an account belongs to a user under 16, we will delete it. If you believe a child under 16 has created an account, please contact us.
17. Cookies and similar technologies
The LifePusher web app uses browser storage that is necessary to keep you signed in and to make the app work offline. We do not use non-essential cookies in the web app for tracking. If we add analytics or advertising cookies to the web app, we will ask for your consent first. Free-tier ads in the mobile app are covered in section 8.
18. Changes to this policy
We may update this policy. If we make material changes, we will notify you in the app or by email before they take effect. The "Last updated" date at the top shows when the policy was last revised.
19. Contact
For questions, requests, or complaints about this policy or your personal data:
contact@mindrebel.pl
Przemysław Rogala, 00-851 Warszawa, Poland