Legal

Privacy Policy

Last updated: 20 October 2026

1. Controller

Jason Chevalley, sole proprietorship trading as “LifePlanner”, Chemin de Marjovet C8, 1040 Échallens (VD), Switzerland — contact@lifeplnr.com. This policy covers the website lifeplnr.com and the LifePlanner app (lifeplnr-app.netlify.app). It is based on the Swiss Federal Act on Data Protection (FADP, RS 235.1) and, where applicable, the EU General Data Protection Regulation (GDPR).

Your plans stay on your device. The content you create in the tools (budgets, goals, habits, journals, etc.) is stored locally in your browser (localStorage). It is never sent to us or to any third party in readable form, and we never see it.

Sync between devices (optional, Premium). If you turn it on, the app encrypts your data on your device (AES-256-GCM, with a key derived from your passphrase, which is never sent) before sending it. Only this encrypted copy is kept, in fields of your Shopify customer account, and it passes through our Netlify function without being stored there. Neither we, Shopify nor Netlify can read it. You can turn sync off and delete this copy at any time in the app's Settings. Legal basis: performance of the contract (art. 6(1)(b) GDPR).

Push notifications (optional, Premium). If you turn on “Notifications on this phone”, we store on Netlify (Netlify Blobs) the subscription address provided by your browser’s push service (Google, Mozilla, Apple or Microsoft), your language, your customer ID and, for the next 7 days, the time and a short text of each reminder. With “Discreet text” (on by default) that text is generic (“Reminders today: 2”): no names, amounts or habits. Notifications are encrypted end-to-end up to your device; the push service only sees an opaque identifier. Legal basis: performance of the contract (art. 6(1)(b) GDPR).

Shared lists (optional). When you share a shopping list or a trip list, its content is encrypted on your device before anything is sent. The key exists only in the share link and is never sent to our servers. We store only the encrypted copy, which we cannot read, on Netlify (Netlify Blobs), with a random identifier, a version number and the times of the last change and the last opening. Anyone who has the link can read and edit the list. Abuse limits use your IP address in memory only, for a few minutes, without storing it.

Shared budgets (“Budget à deux”, optional). When you share a budget, its content (expenses, income, bills, goals, categories, optional first name) is encrypted in your browser (256-bit AES-GCM) with a key that stays in the share link and is never sent to our servers. As with shared lists, we only store an unreadable encrypted copy on Netlify (Netlify Blobs). Receipts (photos, PDFs) are never shared. Anyone who has the link can read and edit that budget. The invited person’s copy stays on their device and is included neither in sync nor in backups.

Referral program (optional). If you use the referral program, we store on Netlify (Netlify Blobs): your referral code; which account referred which (Shopify customer IDs, never names); a keyed hash (HMAC) of your email address, not the address itself, to prevent double referrals and self-referral; the dates of the referral and of the referred person’s first payment; the reward status (to apply, applied, converted into free days). On your device, a received link’s code is kept for at most 30 days. Referrers only see numbers, never the addresses of the people they referred. Legal bases: performance of the contract and legitimate interest (abuse prevention).

Bank statement import and voice input. A bank statement you import into the Budget tool is read only on your device and is never sent anywhere. When you dictate a sentence in quick add, your browser’s speech recognition is used: depending on the browser, the audio may be processed by Google (Chrome, Android) or Apple (Safari, iPhone) under their own privacy policies; nothing is sent to us.

2. Data we process, purposes and legal bases

Website and app visits — IP address, browser, pages requested, time (server logs at Netlify and Cloudflare) — to deliver and secure the website and app — legitimate interest (art. 6(1)(f) GDPR).
Sign-in and free trial — e-mail address, one-time code, customer ID, date your customer account was created (used as the trial start date), subscription status — to sign you in, apply the one-trial-per-e-mail rule and unlock Premium — performance of a contract (art. 6(1)(b) GDPR).
Subscription and payment — name, e-mail, billing address, payment data (processed by Shopify; we never see your full card number), order and subscription history — to perform the contract and meet our accounting obligations — art. 6(1)(b) and (c) GDPR.
Contact and withdrawal forms, e-mails — name, e-mail, message, subscription date — to answer you and process your requests — art. 6(1)(b) and (f) GDPR.
Anonymous audience statistics — daily counters, without cookies or identifiers (see section 6) — legitimate interest (art. 6(1)(f) GDPR).
Advertising measurement (Meta Pixel), only with your consent — see section 5 — consent (art. 6(1)(a) GDPR).

We do not sell your data and take no automated decisions that produce legal effects for you.

3. Recipients

Shopify International Ltd. (Ireland) and its affiliates, including Shopify Inc. (Canada) — checkout, payments, subscriptions, customer accounts and sign-in codes. Privacy policy
Netlify, Inc. (USA) — hosting of the website and app, storage of contact and withdrawal form submissions (Netlify Forms). Privacy policy
Cloudflare, Inc. (USA) — DNS / network (technical connection data). Privacy policy
Zoho Corporation — e-mail (content of your messages to us). Privacy policy
Meta Platforms Ireland Ltd. (Ireland) — advertising measurement, only with your consent (section 5). Privacy policy

The website's fonts are hosted on our own server; no request is made to Google. We disclose data to authorities only where required by law.

4. International transfers

Some recipients process data outside Switzerland and the EEA, in particular in the USA and Canada. Canada is recognised as providing an adequate level of protection. Transfers to the USA rely on the recipients' certification under the EU-US Data Privacy Framework and its Swiss-US extension (this applies to Meta Platforms, Inc.) or, failing that, on the European Commission's standard contractual clauses as recognised by the FDPIC.

5. Cookies, local storage and Meta Pixel

Strictly necessary (no consent needed). The website saves your language choice (lp-lang) and your cookie choice with its date (lp-consent, lp-consent-at; you are asked again after 13 months) in your browser's local storage; the app keeps its own copy of these two keys. The app saves your planning data in local storage and, after sign-in, a session cookie lp_session (HttpOnly, Secure, valid at most 7 days, containing only an internal customer ID and an expiry date) and, for customers of former one-time packs, a licence cookie lp_license (HttpOnly, Secure, valid 30 days, containing only the packs owned and an expiry date). Shopify sets its own cookies on its checkout and customer-account pages (see Shopify's privacy policy).

Meta Pixel (only with your consent). If you click “Accept” in the cookie banner, the Meta (Facebook) pixel is loaded to measure how well our ads work. Without your consent, nothing is loaded or sent to Meta. With consent, Meta receives your IP address, browser and device information, the page address (on this website: the home and start pages; contact and legal pages do not send events), the event (PageView) and the identifier stored in the _fbp cookie (lifetime up to 90 days). Automatic event collection is turned off. If you are logged in to Facebook or Instagram, Meta may link this data to your account. The LifePlanner app shows its own consent banner and works the same way: with your consent it sends a PageView for its home page only (never for a tool's page) and a StartTrial event when you start your free trial, both only from the app's bare home address (no tool name, sign-in code or other parameter in the page address); its automatic page-change tracking is turned off. Your plans and the content of the tools are never sent.

For collecting and transmitting this data we and Meta Platforms Ireland Ltd. are joint controllers (art. 26 GDPR; Meta's Controller Addendum); Meta is responsible for its subsequent processing, which may include a transfer to Meta Platforms, Inc. in the USA under the Data Privacy Framework. You can withdraw your consent at any time with the Cookies link at the bottom of every page (and in the app); this does not affect processing carried out before withdrawal.

6. Anonymous audience statistics

To learn which pages and features are useful and to improve the site and the app, we count events anonymously with our own tool, hosted by Netlify (no third-party analytics service): site page views and clicks on its free-trial and open-the-app buttons, app openings (installed or in the browser, phone or computer, language), pages and tools opened, templates applied, use of quick add (form, typed sentence or voice), notifications or sync turned on, bank statement imports (only the format: CSV or camt), shared lists created or opened, welcome and install steps, sign-up steps (trial started, "Subscribe" click, active subscription — a plain yes/no, without any identifier) and the general origin of the visit (utm_source, utm_medium and utm_campaign values, and the name of the referring site, e.g. google or instagram.com, never the full address).

No cookies, no identifiers. This measurement stores no identifier on your device and sends no customer id, e-mail address, tool content or typed text. The server only accepts event names and values from a fixed list; everything else is rejected.
Daily counters only (e.g. "Budget tool opened: 12 times on 20 October"). Your IP address is never stored: it is used in memory to limit abuse and, together with your browser's identification string, to compute a fingerprint (a hash with a random salt that is different every day) used to count the day's unique visitors. The salt and these fingerprints are deleted within about two hours after the end of the day; only a number remains. You cannot be recognised from one day to the next or tracked across other sites.
Do Not Track / Global Privacy Control: if your browser sends either signal, nothing is counted.
Legal basis: legitimate interest in measuring our audience and improving our offer (art. 6(1)(f) GDPR; art. 31 FADP). Since no cookie or identifier is used and the data is anonymous, no consent is needed: the cookie banner does not change. Recipient: Netlify (hosting, section 3). Retention: daily counters for 24 months, then deleted automatically.

7. Retention

Orders, invoices and payment records: 10 years (art. 958f Swiss Code of Obligations).
Customer account (e-mail, creation date used for the trial): as long as your Shopify customer account exists; you can ask us to delete it at any time (subject to the accounting retention above).
Contact and withdrawal form submissions and e-mails: up to 2 years after our last exchange, longer only if needed for a pending matter.
Server logs: the short retention periods of our hosting providers.
_fbp cookie: up to 90 days; data received by Meta: according to Meta's privacy policy.
Data stored on your device: until you delete it (e.g. by clearing your browser storage).
Encrypted sync copy: until you turn sync off and delete the copy, or your customer account is deleted.
Push notifications: until you turn them off or sign out, your browser revokes the subscription, or at the latest 30 days without opening the app; each reminder is deleted after it is sent or after 7 days.
Anonymous audience statistics: daily counters for 24 months; the day's salt and fingerprints are deleted within about two hours after the end of the day.
Shared lists: until you stop sharing, and automatically after 30 days without being opened or changed.
Shared budgets: until you stop sharing, and automatically after 30 days without use.
Referral data: as long as the account exists and at most 24 months after the last referral event; deletion on request at contact@lifeplnr.com (pending benefits are then lost).

8. Your rights

You may request access to your personal data, its rectification or erasure, the restriction of processing and data portability, object to processing based on legitimate interest, and withdraw your consent at any time. Write to contact@lifeplnr.com; we reply within 30 days.

You may also lodge a complaint with the Federal Data Protection and Information Commissioner (FDPIC, edoeb.admin.ch) or, in the EU, with the data protection authority of your country of residence.

9. Changes

We will publish any update on this page with a new date.

See also our Legal Notice and Terms of Sale.