2.1 Account and profile data

When you create or use an account, we process:

• Email address
• Authentication credentials (password is handled by our auth provider; we do not store your plaintext password)
• Username (display identity in the App)
• Profile and cosmetics you choose (for example profile picture, background, emblem selections from our catalog)
• Account flags needed to run the product (for example progression totals, preferences, and eligibility for features)

We also support email verification and password recovery (including one-time codes sent to your email). Those flows process your email and related auth challenge data.

You may change your username or password in Settings (subject to App rules such as cooldown or content filters).

2.2 Health and fitness activity data

With your explicit permission, Levely reads limited fitness data from the platform health store:

How we use it

• On-device reads are converted into gameplay (XP, streaks, awards, daily challenges, social challenges, leaderboards).
• When you are signed in, we sync day-level aggregates and related progression state to our servers so your progress works across devices and in multiplayer features.
• We aim to exclude obviously manual / user-entered samples where the platform allows us to detect them.
• You may select preferred data sources / writers in Health & Metrics (for example which phone or wearable app Levely trusts).

What we do not do

• We do not sell health data.
• We do not use health data for ads or cross-app tracking.
• We do not provide medical advice, diagnosis, or treatment recommendations.
• We do not need write access to change your health records for normal play; Levely is designed around reading activity to fuel gameplay.

You can revoke health permissions at any time in system settings (Health Connect on Android; Apple Health / Settings on iOS). Revoking access stops new progression from that data but does not by itself delete your account.

2.3 Social, competition, and user-generated content

Levely includes social features. We process:

• Friends (requests, accept/decline, friend lists)
• Social challenges you create or join (rules, roster, scores, standings, placements, leave/cancel events)
• Leaderboards and seasons (rankings based on gameplay metrics)
• Usernames and profile cards visible to other players as part of those features
• In-app notifications related to friends and challenges

Usernames are user-created text. We apply filters and moderation tools (including reporting) to reduce abuse and keep the community fair.

2.4 Push notifications

If you allow notifications, we process:

• Push tokens (FCM on Android / APNs via Firebase on iOS)
• Notification preference flags (for example challenges, friends, LMS-related alerts, daily reminders)
• Timezone (IANA timezone) so time-sensitive reminders can respect your local day

You can change push preferences in Settings and disable notifications in system settings. Disabling notifications does not delete your account.

2.5 Device, diagnostics, and security data

To operate and improve the App we may process:

• App version information
• Basic server / auth logs from our backend (for security, abuse prevention, and troubleshooting)
• Crash and diagnostic reports via Firebase Crashlytics (for example crash stacks, device/OS class information, and an internal user id association so we can diagnose account-specific failures). Crashlytics is used for reliability — not for advertising.

We do not use your health samples as advertising identifiers.

2.6 Support communications

If you email us (for example for deletion, export, or support), we process the content of that correspondence and the email address you use to contact us.

2.7 Data we do not collect (current product)

As of this policy date, Levely does not:

• show third-party advertising networks in the App
• sell subscriptions or in-app purchases (if that changes, we will update this policy and store disclosures)
• require access to your contacts, camera, microphone, or precise continuous background location for core play
• use App Tracking Transparency / advertising ID for cross-app tracking

4.1 We do not sell personal data

We do not sell, rent, or trade personal information to advertisers.

4.2 Service providers (processors)

We share data with providers who help us run Levely, under instructions consistent with this policy:

These providers process data as needed to provide their services (for example storing account records, delivering a push, or receiving a crash report).

4.3 Visibility to other users

Some information is intentionally visible to other Levely players as part of the product:

• username and profile presentation
• friend relationships you accept
• challenge participation, scores, and placements
• leaderboard standings

Do not choose a username you are unwilling to show other players.

4.4 Legal and safety disclosures

We may disclose information if reasonably necessary to:

• comply with law, regulation, legal process, or governmental request
• protect the rights, safety, or integrity of Levely, our users, or the public
• investigate fraud, cheating, or Terms violations

4.5 Business transfers

If Levely is involved in a merger, acquisition, or asset transfer, personal data may be transferred as part of that transaction, subject to appropriate protections and notice where required.

Controls in product / OS

• Revoke Health Connect or Apple Health permissions in system settings.
• Disable push notifications in Settings and/or system settings.
• Change username/password (where available) in Settings.
• Delete your account as described above.

Privacy rights

Depending on where you live (including the EEA/UK and similar jurisdictions), you may have rights to access, correct, delete, restrict, or object to certain processing, and to data portability.

Export / correction requests: email levelyapp@protonmail.com. Export requests are handled manually and may take a reasonable time.

You may also have the right to lodge a complaint with your local data protection authority.