Privacy Policy

Effective date: September 10, 2026
Contact: support@fromlvlzero.com

FromLvlZero is a drawing-practice tracker operated by Darcnai, the independent developer of FromLvlZero. This policy explains what information the app uses and how you can control it.

Information we handle

- Account information: your email address, an internal account identifier, and an optional display name. Supabase Auth processes your password; the developer cannot see it in plain text.
- Agreement records: your authenticated account identifier, Terms and Privacy version identifiers, server-recorded acceptance time, and the app version reported by your device. We retain these records as evidence of your agreement and acknowledgement, not as permission for unrelated or optional processing.
- Practice information: session dates, start and end times, durations, projects, goals, skills, mediums, milestones, and any notes you choose to enter.
- Technical service information: Supabase, Resend, and Expo may process limited technical information needed to authenticate you, deliver account email, protect the service, and deliver app updates. This can include IP address, device operating system, security or delivery logs, and a randomized app-installation token.
- Information kept only on your device: reminder choices, app-lock preference, active timers, and practice waiting to sync. Reminders are scheduled locally.

FromLvlZero does not use advertising or marketing analytics trackers. It does not access your camera, photos, contacts, or precise location. It does not sell or rent personal information.

How we use information

We use information only to create and protect your account, save and synchronize your practice, calculate the progress shown to you, send confirmation and password-recovery email, deliver app updates, troubleshoot failures, fulfill export or deletion requests, and record your agreement to the terms and acknowledgement of this policy.

Service providers

- Supabase provides authentication, the hosted database, and server-side functions.
- Resend delivers transactional account email.
- Expo provides app builds and over-the-air app updates. Update requests may include the operating system and a randomized installation token.

These providers process information for FromLvlZero under their own security and privacy terms. We do not share personal information with advertisers or data brokers.

Optional tips

The optional Ko-fi button opens an ordinary, unparameterized Ko-fi page in your browser. FromLvlZero sends no account information to Ko-fi and never receives payment-card details. If you tip, Ko-fi and its connected payment provider process the transaction under their own policies. The developer may see transaction information in those services, such as payer name or email, amount, refund, or dispute details. Tipping unlocks nothing in FromLvlZero.

Security

Data is sent over encrypted connections. User records are protected with account-scoped row-level database rules. Privileged credentials are never included in the app. Authentication sessions are stored using the device's secure storage. If you enable app lock, your phone performs the fingerprint, face, PIN, or password check; FromLvlZero does not receive biometric data.

No system can promise perfect security. Please keep your account password and device secure.

Retention and deletion

We retain your account, synced practice information, and agreement records while your account is active. Agreement records are included in JSON exports and removed from active application tables during account deletion. A cached server receipt on your device allows offline access after acceptance; a first acceptance or material renewal requires an internet connection. You can permanently delete your account and active-system practice data in Profile → Data & Privacy → Delete my account. You can also request deletion at fromlvlzero.com/account-deletion.html (https://www.fromlvlzero.com/account-deletion.html).

A limited operational deletion record may be retained for up to 30 days after completion so deletion failures can be reconciled and verified. Pending failure records are retained until the deletion is completed. Transactional email and infrastructure security logs follow the service providers' retention schedules; Resend states that email data is retained for up to 30 days. Temporary copies may remain in provider disaster-recovery systems until their normal expiration and are not used to recreate a deleted account.

Practice waiting to sync remains on the device until it syncs, is resolved, or the app's local data is removed. Deleting the account clears FromLvlZero's local account data on that device.

Your choices

You may edit or remove practice records in the app. You may export your data as CSV or JSON from Profile → Data & Privacy. You may delete your account as described above. Contact support@fromlvlzero.com for privacy questions or help exercising these choices.

Age

FromLvlZero is intended for people age 13 and older. It is not directed to children under 13, and we do not knowingly collect personal information from a child under 13. If you believe a child under 13 supplied information, contact us so we can delete it.

Changes

We will update this policy when the app's data practices change. Material changes will be communicated in the app or through another appropriate notice before they take effect.