Privacy Policy
The short version
- What you write in Lowkei — check-ins, vent pages, Mirror chats, your plan, letters, notes — is kept on your phone, encrypted. It is not uploaded to our servers.
- Your writing leaves the phone only when you have switched on AI reflections and ask the Mirror something or ask for a reflection on a page. It passes through our server to an AI service to get an answer, and neither we nor that service keep it.
- Our server holds a small account record: your email, a random account ID, your consent choices, and — if you use Circle — what you chose to share with your circle.
- No ads, no analytics, no tracking SDKs. We do not sell or share your data for advertising.
- You can download everything, or erase everything, from the You tab at any time.
This policy explains what personal data Lowkei (“the app”, “we”, “us”) handles, why, where it goes, and the rights you have over it. Lowkei is operated by [OPERATOR NAME], who is the Data Fiduciary for this data under India’s Digital Personal Data Protection Act, 2023 (“DPDP Act”). You can reach us at getlowkei@gmail.com.
1. What stays on your phone
Most of Lowkei works without a server. The following is stored only on your device, in a database encrypted with SQLCipher. The key is held in your phone’s secure storage and never leaves it:
- Check-ins: the feelings you choose and your energy for the day.
- Vent pages, and any reflections written on them.
- Your Mirror conversation, and the items on “What the Mirror knows”.
- Sleep and wake times, whether entered by hand or read from Health Connect.
- Steps, resting heart rate and heart-rate variability, if you allow Lowkei to read them.
- Your safety plan, letters, experiments, and the record of times you opened crisis help.
- Your profile photo, if you choose one from your phone. Your circle sees the drawing you picked, never the photo.
- Your answer to the age question, and app preferences such as appearance and reminders.
Your daily reading, patterns, Mind Chart, forecast and Wrapped are all calculated on the phone from this data.
Because this data is on your device, we cannot see it, recover it, or move it to a new phone for you. If you uninstall the app or lose the phone, it is gone. Use “Download everything” to keep a copy.
Using Lowkei in a browser
On iPhone, and anywhere else you open Lowkei at getlowkei.vercel.app/app, the same things are kept in that browser’s storage on your device instead. They are still not uploaded. A browser can’t use SQLCipher, so this copy is not encrypted by Lowkei: protect the device with a passcode, and know that clearing the browser’s website data deletes it. Health Connect isn’t available in the browser version, and voice works differently there (section 4).
2. What our server holds
You sign up with your email address; it is how you sign in, with a six-digit code, on any phone. Our server stores:
| Data | Why |
|---|---|
| A random account ID, and when the account was created and last used | To sign the app in and keep it secure. |
| Your email address | To sign you in with a six-digit code, on this phone or a new one. We only email you sign-in codes. |
| What you said you came to Lowkei for (chosen during onboarding) | To shape the app around it. |
| When you confirmed you are 18 or older, and when you saw the AI disclosure | To show we asked before you started. |
| Each consent you give or withdraw: which one, yes or no, the policy version, and when | To honour your choices, and to show we did, as the DPDP Act requires. |
| A push notification token for your phone, if you allow notifications for Circle | To tell you when someone in your circle reaches out. |
| If you use Lowkei from your Home Screen and allow notifications: your browser’s push address; the times of the coming week’s daily reminders, of each sealed letter’s day and of each waiting reflection; and the coming week’s 11:11 daily notes — for each, its time and its two short lines (a headline and one sentence) | To send those notifications, which a browser can’t schedule by itself. The daily notes are written on your device from your own days. They may say what a day is about — a short night, “work” coming up a lot — but never a feeling word you chose, never anything you wrote, and never what a letter says. |
Circle — only if you use it
If you start or join a circle, and only after you agree to it on its own consent screen, our server also stores:
- The name and picture you show your circle, and your invite code.
- Who is in your circle, and the nudges you send and receive.
- Today’s Inner Weather — one word, such as “fog” or “clear”.
- That you are “running low”, when you say so. It clears itself after a day.
- Which days of the week tend to be lighter or heavier for you, as seven numbers.
The people in your circle can see these. They never see your words, notes, pages, Mirror conversation, or which feelings you chose.
3. AI reflections
AI reflections are off unless you switch them on, during onboarding or later in You → Privacy. When they are on:
- When you send a message to the Mirror, the conversation so far is sent to get a reply.
- When you ask for a reflection on a vent page, the text of that page is sent.
- If you also switch on “What the Mirror knows”, the patterns and notes on that page are sent with each Mirror message.
This text travels encrypted to our server, which passes it to Groq, the AI service that writes the reply, and returns the answer to your phone. Our server does not store the text or the reply. Groq does not use it to train models, and under our account settings does not retain it. The reply is saved only on your phone.
The Mirror is software. It is not a person, a therapist, or a medical service, and its replies can be wrong.
If you turn AI reflections off, nothing you write is sent anywhere; Vent keeps working and Mirror chat closes.
4. Voice
When you tap speak in the Mirror, your phone turns your speech into text using its own on-device speech recognition. Lowkei does not record audio, and no audio is sent to us or to anyone else. If you then send the text to the Mirror, it is handled as in section 3. Answers read aloud are spoken by your phone’s own text-to-speech.
In the browser version, your browser does the listening instead (on iPhone, Apple’s dictation — the same as the keyboard’s microphone), and it may send your voice to its maker’s speech service to turn it into text, under their terms. The audio never reaches Lowkei; only the words, if you then send them. Answers read aloud use the browser’s own voice.
5. Health Connect
On Android, Lowkei can read from Health Connect, but only with your permission, which you can withdraw in Health Connect at any time:
- Sleep — to show your nights and include them in your patterns.
- Steps, resting heart rate and heart-rate variability — asked for separately, as a second step, to show how your body and your days move together.
This data stays on your phone. It is not sent to our server, to the AI service, or to anyone else. Lowkei never writes to Health Connect and reads nothing else from it.
Lowkei’s use of information received from Health Connect adheres to the Health Connect Permissions policy, including its Limited Use requirements. We do not use it for advertising, do not sell it, and do not use it to decide whether you are eligible for credit, insurance or anything else.
6. Notifications
In the app, the daily reminder, the 11:11 daily note and a letter’s notice are scheduled on your phone; no server is involved. Circle alerts are sent from our server through Expo’s push service and Google’s Firebase Cloud Messaging. They contain no names, feelings or weather — only a line such as “Someone in your circle is thinking of you.”
If you add Lowkei to your Home Screen from the browser and allow notifications, our server sends them all: it keeps your browser’s push address, the time each one is due and, for daily notes, their two lines (section 2), and sends them through your browser’s own push service — Apple’s on iPhone, Google’s on Android. A reminder, note or letter time is deleted once it is sent, and the week ahead is replaced each time you open the app; the address is deleted when the browser stops accepting notifications or you erase your account.
7. This website
Our website has no cookies, analytics or advertising. Vercel, which hosts it and the browser version of the app, keeps short-lived request logs, such as IP addresses, for security.
8. Who processes data for us
We use these service providers, as Data Processors acting on our instructions:
| Provider | What for | Where |
|---|---|---|
| Supabase | Database and sign-in for the account record in section 2, and sending sign-in codes by email | Japan (Tokyo) |
| Render | Runs our server | Singapore |
| Groq | Writes AI reflections and Mirror replies (section 3) | United States |
| Expo and Google Firebase | Delivers Circle notifications (section 6) | United States |
| Apple, Google, Mozilla or Microsoft push services, whichever your browser uses | Delivers notifications to Lowkei on your Home Screen (section 6) | United States |
| Vercel | Hosts our website and the browser version of the app | Global |
| Brevo | Delivers the emails carrying sign-in codes | European Union |
This means some data is processed outside India. We only send each provider what it needs for the task in the table.
Like most servers, ours and our providers’ keep short-lived technical logs (such as IP addresses and the time of a request) for security and to prevent abuse. We do not use them to track you.
We do not sell personal data, and we do not share it with advertisers or data brokers. We will disclose data only if the law requires it, and then only what is required.
9. How long we keep it
- Data on your phone stays until you delete it, erase everything, or uninstall the app.
- Your account record and Circle data stay until you erase your account. “Running low” clears itself after a day.
- Text sent for AI reflections is not kept by our server or by Groq.
10. Your rights
Under the DPDP Act, and wherever you live, you can:
- Access your data — You → Your data → Download everything gives you one file with what is on your phone and what our server holds.
- Withdraw consent — switch off readings or AI reflections in You → Privacy, leave or stop sharing with your circle, or remove Health Connect access. Withdrawing is as easy as giving consent, and it doesn’t affect anything that happened before.
- Correct your data — edit or delete entries in the app, change your circle name and picture, or write to us.
- Erase your data — You → Erase → erase everything deletes your account on our server and everything on the phone. It cannot be undone.
- Nominate someone to exercise these rights for you if you die or become unable to — write to us.
- Raise a grievance — write to getlowkei@gmail.com. We will reply within 30 days at most. If you are not satisfied, you may complain to the Data Protection Board of India.
11. Age
Lowkei is for people aged 18 and over. The app asks your age at the start and does not let anyone who says they are under 18 continue. If you believe someone under 18 has an account, write to us and we will erase it.
12. Security
Your writing is encrypted on the phone, and you can add an app lock. Everything between the app and our server travels over HTTPS. On the server, each account can reach only its own rows. No system is perfectly secure; if a breach affects your data, we will tell you and the Data Protection Board as the law requires.
13. Changes
If we change what we collect or where it goes, we will update this page and its version date. If a change affects something you consented to, the app will ask you again before it applies.
14. Contact
[OPERATOR NAME]
getlowkei@gmail.com
Questions, requests and grievances about your data all go to this address.