Life by Visioneering MT

Life by Visioneering MT — Privacy Policy

1. Who operates Life?

Life is a personal productivity, fitness and wellness application developed under Visioneering MT, an independent student-run project based in Malta.

Data controller: Roberto Filletti, trading under the project name Visioneering MT.
Privacy contact: visioneeringmt@gmail.com
Website: https://visioneeringmt.com/life
Correspondence address: 54, Triq Taz-Zwejt, Malta SGN 3000

The data controller is responsible for determining why and how personal information is processed through Life.

This policy applies to the Life application, including its connected services, personal dashboards and optional mobile companion applications. The general Visioneering MT website has a separate privacy policy.

2. What information Life processes

Depending on which features a person enables, Life processes:

• Account information: Email address, display name, time zone, account preferences, session and authentication details. Password credentials are managed through the authentication provider.
• Calendar and productivity information: Scheduled events, tasks, work schedules, reminders, habits and planning information.
• School information: Subjects, timetables, study topics, assignments, study plans and progress.
• Fitness information: Activities, exercise duration, distance, pace, heart rate, calories, training plans, races and available GPS routes.
• Wellness information: Sleep, resting heart rate, HRV, weight, steps and other measurements the person chooses to share.
• Device details: User-entered watch or scale brand, model and nickname.
• Security and operational information: Consent records, connection status, synchronisation history, necessary security logs and error records.

Providing optional health information or connecting an external account is not required to use Life’s general planning features.

3. Google Calendar: what we access

When a user chooses Connect Google Calendar, Life requests the following read-only permissions:

• https://www.googleapis.com/auth/calendar.calendarlist.readonly
• https://www.googleapis.com/auth/calendar.events.readonly

These permissions allow Life to list available calendars and read events from calendars selected by the user.

Life does not request permission to create, edit or delete events in Google Calendar.

The primary calendar is selected initially. The user may choose additional calendars, up to ten, and change those selections in Life’s Connections settings.

Information read and stored

For selected calendars, Life may process:

• Calendar names, identifiers and time zones.
• Event titles and locations.
• Start and end dates and times, including all-day events.
• Event identifiers and recurring-series identifiers.
• Links back to events in Google Calendar.
• Limited event characteristics used to classify the type of appointment, such as whether an event includes multiple attendees or a video meeting.

Life does not store attendees’ names or email addresses, event descriptions, attachments, organiser details or video meeting links as part of its imported calendar records.

Why we use Google Calendar information

Life uses imported events to:

• Display personal schedules in Today and other planning views.
• Help organise school, work and training around existing commitments.
• Identify available times using Life’s internal rules-based planning features.
• Keep displayed events updated when the user reconnects or refreshes their calendar.

Calendar information is shown only within the corresponding user’s Life account.

Synchronisation and storage

Life reads events covering approximately seven days before the current date and 56 days ahead, using the user’s time zone.

Synchronisation occurs when the account is first connected, when Life is opened after its calendar refresh interval has elapsed, or when the user requests a refresh.

Imported event records are stored in the user’s account in Life’s database, operated using Supabase infrastructure in the European Union.

Information inside the synchronisation window is refreshed to reflect changes or deletions in Google Calendar. Google Calendar events imported into Life are automatically deleted 30 days after each event ends, based on the user’s time zone. For recurring events, each occurrence is treated separately. Cleanup runs approximately every 30 minutes. Users can delete imported Google Calendar events sooner when disconnecting and selecting the removal option, or by deleting their Life account. Events created directly in Life are unaffected.

Life does not alter the original events in Google Calendar.

Revoking access

Users can disconnect Google Calendar through Life → Connections → Google Calendar → Disconnect.

During disconnection, Life allows the user to choose whether imported calendar events should also be removed from Life.

Users can additionally revoke Life’s Google permissions at:
https://myaccount.google.com/permissions

Revocation prevents further authorised access. Previously imported information remains subject to the deletion controls described above.

4. Google API Services User Data Policy

Life’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements.

https://developers.google.com/terms/api-services-user-data-policy

In particular:

• Google Calendar information is used to provide the personal scheduling functionality requested by the user.
• It is not sold to advertisers, data brokers or information resellers.
• It is not used for targeted advertising or creditworthiness assessments.
• It is not used to develop, train or improve general-purpose artificial intelligence or machine-learning models.
• Google Calendar information is not sent to Life’s external AI Coach.
• It is processed by necessary infrastructure providers for operating the authorised service, subject to appropriate protections.
• Human access to Google user information is restricted in accordance with applicable Google policies and legal requirements.

Life’s internal rules-based planning features may use calendar information to organise the user’s own schedule. This processing is separate from the optional external AI Coach.

5. Other connected services

Intervals.icu: With permission, Life may import available workouts, activity details and wellness measurements using read-only access. The exact information available depends on the provider’s permissions and data-sharing restrictions.

Strava: Life retrieves permitted recent activity information for display, subject to Strava’s API requirements. This data is not used for prohibited long-term analytics, external AI coaching or model training.

Android Health Connect: An optional companion application can read selected health categories with device-level permission. Workout routes, where available, require additional authorisation.

Apple Health: Where the native integration is available, users can choose health information to share through Apple’s permission system.

Garmin: Garmin information may reach Life through a supported authorised integration, Health Connect or user-imported workout files. These indirect methods do not require users to give Life their Garmin passwords.

Users control individual connections and can disconnect them independently.

6. School documents and topic lists

Users who enable School may import subjects and topic lists.

Where the on-device topic-import feature is used, source photographs are processed on the device rather than uploaded to Life’s server. The user reviews extracted topics before confirming which information to save.

Confirmed subjects and topics are stored privately in the user’s account and can be edited or deleted.

7. Artificial intelligence

Life contains two distinct kinds of personalisation.

Life Brain uses internal rules and stored information to generate planning insights. It is not an external generative AI model.

Life’s optional AI Coach, when enabled, may use selected information to provide personal recommendations. It requires separate consent where applicable.

The external AI Coach is not currently enabled for the private beta. If activated, its relevant provider and data-processing arrangements will be disclosed before use.

Google Calendar and Strava API information are excluded from the external AI Coach.

Life does not provide medical diagnoses, and its training or wellness suggestions are not a substitute for professional medical advice.

8. Legal bases for processing

Depending on the particular activity, Life processes personal information under the following GDPR legal bases:

• Performance of a contract: Providing account, productivity and planning functionality.
• Consent: Optional account connections, notifications and processing that relies on consent.
• Explicit consent: Processing special-category health information where required by GDPR Article 9.
• Legitimate interests: Maintaining appropriate account and service security, subject to balancing users’ rights.
• Legal obligations: Processing necessary to comply with applicable law.

Users can withdraw consent through the available settings or by contacting the privacy address.

Withdrawal does not retrospectively invalidate lawful processing that occurred before withdrawal.

9. Where information is stored and processed

Life uses selected service providers to operate its infrastructure.

These include:

• Supabase: Database and authentication services. Primary application data is hosted in the Frankfurt EU region.
• Cloudflare: Application hosting, delivery, request processing and operational logging.
• GitHub: Encrypted database backup artifacts.
• Netlify: Public Visioneering MT website hosting. If the planned Life application proxy is activated, Netlify will also process application traffic in transit.
• MapTiler: Map delivery, where a user views relevant maps.
• Browser push providers: Delivery of optional notifications.
• Email providers: Delivery of account and service messages through the configured email service.
• Connected service providers: Google, Intervals.icu, Strava and other services selected by the user.

Some providers operate internationally, including outside the European Economic Area.

Where required, transfers outside the EEA are subject to applicable data protection transfer safeguards, such as adequacy decisions or appropriate contractual protections.

Details about applicable safeguards may be requested through the privacy contact.

Life does not sell personal data.

10. Security

Life uses technical and organisational safeguards intended to protect personal information, including:

• Encrypted HTTPS connections.
• Protected session cookies.
• Per-user database access controls.
• Encryption of connected-service authorisation tokens.
• Restricted administrative access.
• Authentication and optional additional security verification.
• Consent records and account-access controls.
• Encrypted database backups.

Users should keep their account credentials confidential and contact us if they suspect unauthorised access.

No internet-connected service can guarantee absolute security.

11. How long information is kept

Life retains account and personal planning information while an account remains active, unless it is deleted earlier or a different retention rule applies.

Specific practices include:

• Account deletion: A seven-day cancellation period before erasure from active application records.
• Encrypted database backups: Backup artifacts have a configured retention period of 14 days.
• Google Calendar: Imported events are refreshed within the synchronisation window and automatically deleted 30 days after each event ends (see section 3). Deleted events may remain in encrypted backups for up to 14 days, until those backups expire.
• Strava: Recent activity information is temporarily cached under the provider’s restrictions and is not retained as permanent Life training history.
• Operational records: Necessary error and background-processing records are kept for limited operational periods.

Some deleted information may remain temporarily in protected backups until the relevant backup expires.

12. User rights and controls

Depending on applicable law, users may request:

• Access to their personal information.
• Correction of inaccurate information.
• Erasure of personal information.
• Restriction of processing.
• Objection to processing based on applicable legal grounds.
• Data portability where applicable.
• Withdrawal of consent.

Life provides account data export and account deletion through its Settings.

Connected services can be managed independently through Connections.

Privacy requests may be sent to:
visioneeringmt@gmail.com

Users may also lodge complaints with Malta’s Information and Data Protection Commissioner:
https://idpc.org.mt

13. Cookies, notifications and analytics

Life uses necessary session and authentication technologies to operate and secure accounts.

The Life application does not currently use third-party advertising trackers or behavioural analytics.

Optional push notifications are enabled only after the user grants the relevant permissions.

The public Visioneering MT website operates separately and has its own cookie and privacy practices.

14. Children and eligibility

Life’s initial external private beta is intended for invited adults aged 18 or older.

Additional safeguards and legal requirements will be reviewed before the service is made available to younger users.

15. Updates to this policy

This Privacy Policy may change as Life’s features, connected services or legal requirements evolve.

Material changes will be communicated where required. New processing purposes that require consent will not be introduced without obtaining the appropriate authorisation.

16. Contact

Life by Visioneering MT
Independent student-run project, Malta
Data controller: Roberto Filletti
Email: visioneeringmt@gmail.com
Website: https://visioneeringmt.com/life