Your journal and photos on your phone
Your phone is the main journal store. The app keeps entries and original observations, meal photos, comments, mood, profile, goals, day reviews, conversations and assistant memory. They support the timeline, summaries, history, search and exports.
Your profile may include the age or birth date, sex, height, weight and activity settings you provide. Profile fields and photos are optional. AI estimates are kept distinct from your own words and original observations.
The server does not keep a permanent cloud backup of your journal. Google recovery restores account access; the journal and photos are transferred separately using a ZIP backup.
Sources and permissions
Access to sources is granted through Android permissions and LifeLog settings. You can revoke permissions in the system and disable sources in the app. Revocation stops further reading but does not automatically erase records already saved.
- Health Connect: sleep, workouts, steps, heart rate, energy, nutrition, body measurements and other available physiological measurements you permit. These support the timeline, summaries and AI features you choose to use. New access to medical documents, diagnoses, medications or clinical records is not requested; an archive imported previously may remain on your phone.
- Usage access: phone app names and identifiers, usage intervals and activity duration for the timeline and summaries.
- Calendar: events from your selected calendars, including times, titles, locations and available event details. They are displayed as plans separately from observations.
- Camera and selected images: photos you explicitly add to meals; photo access does not upload your entire gallery.
- Windows: app names and identifiers, activity and idle intervals, device information and app icons. The collector does not record typed keys, window titles, website addresses, screen contents or media track names.
Transfers between devices
Your phone approves computer pairing by QR. The server queues received Windows activity until your phone confirms durable receipt. Without that confirmation, data may remain queued; account deletion also removes the queue.
Your phone creates Markdown and sends it through a temporary server relay to your selected Windows folder. File contents are not saved to disk by the server; both devices must be available for delivery. This channel does not transfer journal photos.
Windows keeps its own local activity and delivery queue. Your ZIP and Markdown copies are stored wherever you choose. When you use a cloud folder, that cloud service determines how those copies are handled.
Data sent for AI processing
When you use AI, requests pass through the LifeLog server to OpenAI. Meal estimates send the description and selected photos. Chat and day analysis send messages, selected-day context, profile, goals and assistant memory; app tools may provide relevant historical entries when requested.
This context can include health, activity, nutrition and calendar information. Your whole archive is not uploaded in advance. AI processing is not entirely local: information needed for your request leaves the phone. The timeline, manual entries and exports do not require sending an AI question.
LifeLog disables storage of response objects in the OpenAI API. This does not mean the provider retains nothing: standard OpenAI safety logs may be retained for up to 30 days, or longer for legal or safety reasons; individual features and image checks have additional rules. We do not promise Zero Data Retention.
Under standard OpenAI terms, API data is not used to train models without separate opt-in. The provider documentation explains retention and limitations. Contact LifeLog about data previously submitted; deleting our account should not be treated as confirmation that all external provider logs have been immediately erased.
Account and Google
For server features, LifeLog creates an account identifier and stores access or subscription status, device registrations, authentication keys and links between your phone and computers. These support authorization, user isolation, delivery and account recovery.
Linking Google is optional. Google sign-in provides profile information and a signed proof of sign-in. The server validates it and stores the Google identifier linked to LifeLog; Google ID tokens and email are not written to the account database. Your name, email and profile image may be used on the phone to display the selected Google account.
Recovery removes server access from your previous phone while preserving its local journal. LifeLog does not receive your Google password. Google sign-in on the website uses Google services under their own data handling rules.
Server storage and retention periods
Account, authentication and paired-device data and the technical AI usage ledger are retained to operate the service until account deletion; temporary sessions and confirmation codes have their own expiry periods. The ledger contains times, models, scenarios, statuses, request identifiers and available token counts, without texts, photos or responses.
Chat context and AI results are temporarily held in server memory for processing and safe retries, usually for around 30 minutes plus a short cleanup interval. They are not written to the usage ledger. Processing of an unfinished request may continue until it completes.
For weekly, monthly and yearly reports, the app sends computed metrics, selected entry excerpts and source references. The server keeps an encrypted temporary period snapshot, intermediate results and the completed report in its working database until the phone confirms durable storage, the job is cancelled or 7 days expire. A technical receipt without content remains for safe retries. This lets an accepted report finish while the app is closed; the main journal stays on your phone. OpenAI processes the data; encryption of the server copy is not end-to-end encryption.
Technical server events are kept for up to 14 days for diagnostics and security, without journal contents, images, conversations, passwords or tokens. Network connections process addresses and technical information needed for HTTPS, delivery and service protection.
Form submissions and reports are retained for up to 30 days; account-linked submissions are deleted with the account. A deletion receipt without an account identifier is retained for 30 days and then removed. Emails you send to support are separate correspondence: contact info@lifelog.su about deleting them.
AI reports and support
Choosing Report sends only the selected AI response, reason, your comment, response time and identifier, app version and available AI request number. The app shows the quote and warns about personal information before submission. Other journal entries, photos and messages are not automatically attached.
Reports are stored on the server for developer review and response safety improvements. Support email notifications contain only the submission number and type, without the quote. The deletion form sends a reply email and the optional details you enter. An email or entered account ID alone does not prove ownership.
Protection and user-controlled copies
Connections to the LifeLog server use HTTPS. Server operations require authorization, and device pairing requires phone approval. Local records are in app storage protected by the operating system; this is not a promise of end-to-end encryption of all data or separate encryption of the journal database.
ZIP backups contain personal history and photos and are not encrypted by LifeLog. Keep them and Markdown in a trusted location. You control access to your chosen folder, device and cloud copies.
Account deletion and data controls
Delete your server account in Android under Settings → Account → Delete account, or use the public request page without reinstalling the app. Deletion removes the account and subscription status, Google link, devices and keys, delivery queue, icons, technical AI usage and associated submissions. Computers lose server access.
A directly confirmed deletion is performed by the server immediately. An unfinished AI request may require waiting for completion. Requests using the manual form or email are fulfilled within 7 days after ownership is verified.
Deleting the server account does not delete your Google account, journal, photos, day reviews or chat on your phone, local Windows activity, or ZIP and Markdown copies you saved. To erase the local copy, clear app data or uninstall using operating-system controls; delete external copies separately from your selected folder or cloud service.
You can edit and delete your own entries, goals and assistant memory using app controls, disable sources and revoke system permissions. LifeLog does not erase original records in Health Connect or your calendar. Contact support about access, correction and deletion of data.
Website, age and policy changes
LifeLog is intended for users aged 18 and over. The site does not receive your journal and has no advertising trackers, external fonts or analytics. Your language preference is saved locally in the browser. The deletion form sends only information you explicitly enter; Google scripts load when Google sign-in is selected and may use Google cookies.
When data practices change, we update this page and the policy date. Material new uses should be accompanied by appropriate notice and, where required, in-app consent. Questions about the policy or your data: info@lifelog.su.