Privacy policy

Who we are and what this covers

Numavie is operated by Ryan under the LzyLabs name. This policy covers the Numavie app and the website at numavie-prod.web.app, including the advertising-enabled Store release being prepared. Store review and rollout are pending; the features available to you depend on the release offered by your platform Store. Contact hi@lzylabs.com with privacy questions or requests.

Profiles, journal and backups

The app stores birth dates, optional nicknames, number calculations, journal entries, learning progress and preferences locally on your device. No Numavie account is required, and the app does not upload your birth dates or journal to a LzyLabs database.

Exporting a backup creates a readable JSON file containing personal data. You choose where it goes; the app does not encrypt that export. Keep it somewhere private. Sharing a number card opens your device's share sheet; the card excludes your birth date and journal, and includes a nickname only if you choose it. Apps or services you select for sharing or storing files have their own privacy practices.

You can delete entries or erase the app's local data in Settings. Copies you exported or shared remain wherever you saved or sent them. Deleting local data does not delete earlier provider records or support emails.

Exploring with sample data

The release being prepared includes a sample workspace for exploring Pro features without buying them. It starts with fictional profiles and journal entries in temporary memory, separate from your personal workspace. Use fictional information while trying it. Profiles, journal entries and other sample data are discarded when you exit or reset it; resetting keeps your chosen language. Exploring this workspace does not grant Pro access in your personal workspace.

The sample workspace does not start advertising, purchase verification, backup export or import, sharing, support email, or reminder scheduling. Those actions require your personal workspace. This separation does not stop online services that were already active in the personal workspace or other apps on your device.

Online services in the app

Google Firebase Remote Config checks limited feature settings, and Firebase App Check helps protect online services from misuse. These services operate independently of usage analytics and crash-report uploads. They may process installation identifiers, app and device information, country/language/time-zone settings, IP addresses, and integrity or attestation tokens. App Check uses Google's Play Integrity on Android and Apple's App Attest or DeviceCheck on iOS. These requests do not include your birth date, nickname or journal text.

Google Analytics for Firebase usage events and Firebase Crashlytics crash-report uploads are disabled for the initial release and cannot be enabled in Settings. References in the app's privacy settings to analytics and crash reporting being disabled refer to these two Firebase products. AdMob's advertising measurement and SDK diagnostics are separate and are described below. The bundled Firebase crash SDK may retain unsent diagnostic records locally while uploads are disabled; the app requests deletion of unsent reports when online services activate. Earlier provider records, if any, are not erased by this setting. A future change to optional Firebase reporting would require an updated app and privacy information.

See Google's Android SDK data disclosures, Apple-platform SDK data disclosures, and Analytics data information for provider details.

Advertising and purchases

When advertising is available in your release, Numavie uses Google AdMob for one adaptive banner below a Learn article. Ad requests are limited to free users with a validated adult profile, from the second app session, while the article is visible. The app first checks the applicable Google User Messaging Platform (UMP) choices and only requests ads when that SDK permits them. Verified Pro access prevents further ad requests; earlier advertising records may remain with providers.

The app requests non-personalized ads and disables Google's publisher first-party ID on iOS. In the iOS release being prepared, it also checks Apple's App Tracking Transparency permission before starting or loading advertising. Where a system request is available, it is presented after the applicable UMP checks, in the foreground and only for an otherwise eligible adult free-user article. Advertising remains off if that permission is denied, restricted, not decided or unavailable. You can continue using the core app without allowing it. Non-personalized ads still involve technical data, local storage and advertising measurement, including frequency capping and aggregated reporting. These settings do not mean that all identifiers or provider data processing are disabled.

Google Mobile Ads may collect and share IP addresses and IP-derived approximate location, device or app identifiers, advertising impressions and interactions, app interactions, SDK diagnostics and performance information. Its iOS SDK may also collect crash information for SDK diagnostics. These data support ad delivery, measurement, analytics and fraud prevention, subject to the applicable privacy choices and provider practices. Numavie's ad requests do not supply your birth date, nickname or journal text. Google and advertising partners process advertising data under their own practices. See Google's Mobile Ads disclosures for Android and iOS, and its explanation of non-personalized ads.

Where an advertising privacy form is required or available, use Settings → Advertising privacy to review or change the UMP choices. The form and available choices depend on your region and the provider's requirements. Withdrawing personalization or storage consent can change which ads are permitted; limited ads may still be available under the provider's rules. On iOS, Apple's tracking permission is a separate requirement for advertising in this release; changing UMP choices alone does not grant it. Your device provides tracking and advertising identifier controls. The app checks permission again before a new ad load and when it returns to the foreground; a revoked permission stops subsequent loads and removes its banner. It cannot undo data already processed by a started SDK or provider. Disabling Firebase reporting or deleting local app data does not erase advertising records already held by providers.

Numavie Pro is an optional one-time purchase through Google Play or Apple's App Store, available only when the platform listing offers it. Store review and rollout are pending; this policy does not establish that checkout is available to every user. The Store shows the applicable price and purchase conditions before payment. Offline calculations, the journal, lessons, calculation trace and backups do not require a purchase. The following section describes how the service verifies a Pro purchase or restoration when available.

Purchase verification and retention

When you buy or restore Pro, the platform Store handles payment and the app sends the product and app identifiers, a Store purchase token or signed transaction, a request identifier and an App Check attestation token to Numavie's verification service on Google Cloud/Firebase. The service checks the transaction with Google Play or Apple, including purchase state and refunds, and returns a signed entitlement. We do not receive your payment card details. These requests do not contain your birth date, nickname or journal.

The server retains an entitlement ledger with an opaque purchase reference, app/product/Store identifiers, verified environment, state, revision and verification/request information. It does not put raw purchase tokens or signed transactions in that ledger. Opaque references are used to recognize the same purchase for restoration and fraud prevention; hashing does not make purchase information anonymous or remove its relationship to the Store transaction. The ledger is retained while needed to maintain purchase and refund state, restore access and meet applicable obligations. Deleting the app's local data does not erase that server record or the Store's payment records.

For a Google purchase that still needs acknowledgement, the service temporarily stores its token encrypted with Google Cloud KMS in a separate server-only job. A task contains only an opaque job identifier and retry generation. The service removes the encrypted token from the active job when it finishes, is cancelled or expires. The acknowledgement deadline is based on Google's payment-completion time and is 72 hours for a production purchase; processing or provider failures can delay cleanup. Non-secret terminal job metadata is scheduled for cleanup after 30 days. Rate-limit counters contain keyed hashes and expire according to their short request windows; scheduled cleanup and Firestore TTL provide delayed deletion. The entitlement ledger has no automatic TTL deletion. Provider history, backups and operational logs follow their separate retention policies.

Google Cloud may process IP addresses and technical request information for service delivery, security and operational logs. Application logs use fixed outcome categories and do not intentionally contain raw receipts, purchase tokens, attestation tokens, birth dates or journals. Contact hi@lzylabs.com for purchase-data requests. We may need limited transaction information to locate a record and verify ownership; do not send passwords, payment card details, your journal or a full backup. Google and Apple handle their own purchase and payment records under their privacy policies.

Website visits and support

This website serves static pages without analytics, cookies, advertising, embedded forms, remote scripts or remote fonts. Google Firebase Hosting receives the requests needed to serve those pages and may process IP addresses and technical request information for delivery, operations and abuse prevention. Google's Firebase privacy information describes Hosting and service data.

If you email us, we receive your email address, message and anything you attach. We use that information to respond and resolve your request. Please send device/app versions and a brief description rather than your journal, birth date, complete backup or passwords. We keep correspondence while needed to handle the issue and related obligations; you can ask us to delete it.

Retention, choices and your rights

Local entries remain until you delete them, erase app data or remove the app, subject to your device's behavior. Provider-held technical records follow the relevant service settings and published retention practices; disabling a feature or deleting the app does not guarantee their immediate deletion. Google and Apple may process technical data in countries other than yours. Their Firebase privacy information and Apple privacy policy describe provider practices. We do not promise a particular processing location or retention period for those services.

Depending on the law that applies to you, you may have rights to access, correct or delete personal information, object to processing, withdraw consent, or complain to a privacy authority. Email hi@lzylabs.com to ask about information we hold or to request help with provider-related data. We may need limited information to verify and locate a request. We cannot recover a journal that exists only on your device.

The app is intended for adults aged 18 and over and checks the birth date you enter. If you believe a child has sent personal information to us, contact us so we can address it. We will publish policy changes here with a new effective date and explain material changes before enabling new online features.