Privacy Policy

Effective date: September 30, 2026
Contact: support@fromlvlzero.com

FromLvlZero is a drawing-practice tracker operated by Darcnai, the independent developer of FromLvlZero. Darcnai is responsible for the app's personal-data practices and can be reached at support@fromlvlzero.com. This policy explains what information we handle through the app, public website, and support mailbox and how you can control it.

Information we handle

- Account information: your email address, an internal account identifier, and an optional display name. Supabase Auth processes your password; the developer cannot see it in plain text.
- Agreement records: your authenticated account identifier, Terms and Privacy version identifiers, server-recorded acceptance time, and the app version reported by your device. We retain these records as evidence of your agreement and acknowledgement, not as permission for unrelated or optional processing.
- Practice information: details such as journey names and descriptions, your prior lifetime practice estimate, session dates, start and end times, durations, project and goal details, skill and medium names and descriptions, milestones, and any notes or optional reflections you choose to enter. Each recorded session also receives a permanent quest-log number. If you delete a session, we retain only its internal identifier, account identifier and entry number to prevent number reuse; that numbering record is deleted with your account.
- Technical service information: Supabase, Resend, and Expo may process limited technical information needed to authenticate you, deliver account email, protect the service, and deliver app updates. This can include IP address, device operating system, security or delivery logs, and a randomized app-installation token.
- Website and support information: When you visit our public website, its hosting provider processes request and security information, such as your IP address, browser or device information, requested page, and access time, to deliver and protect the pages. If you email support, your address, message, any attachments you choose to send, and delivery metadata pass through the providers that route and host the mailbox.
- Information stored on your device: an offline copy of some synced practice information; practice and projects waiting to sync; your active timer, timer and reminder choices, theme and app-lock preferences; a cached legal-acceptance receipt; and, if you choose Remember my email, your sign-in email. The Android widget also stores an account identifier, timer state, and accepted policy versions so it can work without opening the app. Reminders are scheduled locally. The offline practice copy and remembered email use ordinary app-private device storage, not the secure storage used for authentication sessions.
- Optional photos and sharing drafts: If you choose to share your practice, we keep a copy of your selected photo, editable captions and any sharing preferences you ask us to remember in app-private storage on that device. FromLvlZero does not upload these photos or caption drafts to its backend. This storage is separate from secure authentication-session storage and may be included in device backups.
- Optional crash reports: If crash reporting is configured and an error screen offers Send report, nothing is sent to Sentry unless you choose that button. A report contains the app version, release environment, and limited technical code locations; the app removes notes, names, account details, screen contents, and arbitrary error messages before sending. Sentry may also process connection information such as your IP address to receive the report.

FromLvlZero does not use advertising or marketing analytics trackers. Camera access is optional and requested when you choose to take a photo. The photo picker gives the app access to photos you select. FromLvlZero does not request access to your contacts or precise location. It does not sell or rent personal information.

How we use information

We use information only to create and protect your account, save and synchronize your practice, calculate the progress shown to you, send confirmation and password-recovery email, deliver app updates and understand aggregate update adoption, serve and protect our public website, answer support requests, troubleshoot failures (including an optional report you choose to send), prepare the photo and caption sharing you request, fulfill export or deletion requests, and record your agreement to the terms and acknowledgement of this policy.

Service providers

- Supabase provides authentication, the hosted database, and server-side functions.
- Resend delivers transactional account email.
- Expo provides app builds and over-the-air app updates. Update requests may include the operating system and a randomized installation token.
- Cloudflare hosts the public FromLvlZero website, including the Privacy Policy, Terms, and account-deletion pages, and processes website requests for delivery and security.
- Porkbun forwards messages sent to support@fromlvlzero.com to the support mailbox.
- Google (Gmail) hosts that mailbox. Porkbun and Google process message content, sender addresses, attachments you choose to send, and delivery metadata so Darcnai can receive and answer requests.
- Sentry, if configured, receives a sanitized technical crash report only when you choose Send report on an error screen. Crash reporting is not active merely because its software is included in the app.

These providers process information for FromLvlZero under their own security and privacy terms. We do not share personal information with advertisers or data brokers.

Optional social sharing

You decide whether to share a photograph and caption to another app. Session notes and reflections are excluded from generated captions unless you select them. You may ask us to remember these inclusion choices for your account on this device. You can review and edit the caption before copying or sharing; editing it does not change your original session record.

“Copy caption & open…” places the chosen caption on the device clipboard and hands your selected photo to the destination app or system share sheet. You control posting in the destination app. Other apps may access clipboard content according to your device's rules. The receiving service handles anything you share under its own policies. Copies you paste or publish elsewhere are not deleted when you delete your FromLvlZero account.

Optional tips

The optional Ko-fi button opens an ordinary, unparameterized Ko-fi page in your browser. FromLvlZero sends no account information to Ko-fi and never receives payment-card details. If you tip, Ko-fi and its connected payment provider process the transaction under their own policies. The developer may see transaction information in those services, such as payer name or email, amount, refund, or dispute details. Tipping unlocks nothing in FromLvlZero.

Security

Data is sent over encrypted connections. User records are protected with account-scoped row-level database rules. Privileged credentials are never included in the app. Authentication sessions are stored using the device's secure storage. If you enable app lock, your phone performs the fingerprint, face, PIN, or password check; FromLvlZero does not receive biometric data.

Offline practice copies, remembered email, and widget data are kept in app-private device storage, which is separate from the device's secure authentication-session storage. Other apps cannot normally read this storage without elevated device access, but anyone with access to your unlocked device or its backups may have access to locally stored information.

No system can promise perfect security. Please keep your account password and device secure.

Legal basis and international processing

Where EU or UK data-protection law applies, we rely on performance of our contract with you to provide your account, practice records, progress, and requested exports or deletion. We rely on our legitimate interests in operating and protecting the service for security logs, website delivery, support, and aggregate update-adoption information, while considering your privacy rights. If you choose to send an optional crash report, we rely on your consent for that specific report; declining does not affect your account. You can decline future reports and contact us about a report already sent or to object to other processing where applicable.

Our providers may process information outside your country, including in the United States. Contact us for information about applicable transfer safeguards.

Retention and deletion

We retain your account, synced practice information, and agreement records while your account is active. Agreement records are included in JSON exports and removed from active application tables during account deletion. A cached server receipt on your device allows offline access after acceptance; a first acceptance or material renewal requires an internet connection. You can permanently delete your account and the practice data in our active systems in Profile → Data & Privacy → Delete my account. You can also request deletion at fromlvlzero.com/account-deletion.html.

A limited operational deletion record may be retained for up to 30 days after completion so deletion failures can be reconciled and verified. Pending failure records are retained until the deletion is completed. Transactional email and infrastructure security logs follow the service providers' retention schedules; Resend states that email data is retained for up to 30 days. Temporary copies may remain in provider disaster-recovery systems until their normal expiration and are not used to recreate a deleted account.

Website request and support-email records may remain with the relevant providers under their own retention schedules. Deleting your FromLvlZero account does not automatically erase support correspondence or security records held outside the active app database. Contact us if you have questions about those records.

Practice waiting to sync remains on the device until it syncs, is resolved, or the app's local data is removed. On the device where you delete your account, the app attempts to remove that account's synced offline practice copy, pending practice and projects, stored timer, cached agreement receipt, and matching remembered email. If this device cleanup fails, the app tells you to clear its storage in your phone settings. Signing out clears the synced offline copy but keeps unsynced work so it can be recovered if you sign back in. A remembered email may remain after an ordinary sign-out if you selected that option. App-wide preferences may remain until you clear the app's data or uninstall it. Deletion from another device cannot clear local data on a device that does not connect again.

Caption drafts and app-owned photo copies remain on this device so you can return and share again. Ordinary sign-out preserves them for the same account. Account deletion on this device attempts to remove that account's drafts, remembered sharing choices and app-owned photo copies. If cleanup fails, the existing notice explains how to clear app storage. Removing FromLvlZero's copy does not remove your original library photo or copies held by another app. FromLvlZero cannot remotely clear an offline device or erase material already copied to another app or the clipboard.

JSON exports include permanent entry numbers, current-device caption draft text and sharing preferences, with local photo-file references. JSON and CSV exports do not embed the photo files. CSV includes permanent entry numbers alongside session data.

Your choices

You may edit or remove practice records in the app. You may export your data as CSV or JSON from Profile → Data & Privacy. You may delete your account as described above. You may also ask us about access, correction, restriction, objection, or deletion of personal information where applicable. If EU or UK data-protection law applies, you may complain to your data-protection authority. Contact support@fromlvlzero.com for privacy questions or help exercising these choices.

Age

FromLvlZero is intended for people age 13 and older. It is not directed to children under 13, and we do not knowingly collect personal information from a child under 13. Some places require a higher age or parental authorization for online services; you must also meet the requirements that apply where you live. If you believe a child who does not meet the applicable age requirements supplied information, contact us so we can review and delete it as appropriate.

Changes

We will update this policy when the app's data practices change. Material changes will be communicated in the app or through another appropriate notice before they take effect.

The previous Privacy Policy is available in our dated archive once that page is published. Contact support@fromlvlzero.com if you need another prior version.