Legal & Privacy

We believe legal documents should be as simple as our product. Here is how we protect your data and the rules of our platform, in plain English and legalese.

Privacy Policy

Last updated: March 6, 2026

1. Introduction

Life Simple Tech Enterprise ("we," "our," or "us") operates the website lifesimple.co and mobile applications including CalmNotify and Fed. (collectively, the "Services"). This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our Services.

We are based in Malaysia and comply with the Malaysian Personal Data Protection Act 2010 (PDPA), the European Union General Data Protection Regulation (GDPR), and the California Consumer Privacy Act (CCPA).

By using our Services, you consent to the collection and use of information as described in this policy. If you do not agree, please do not use our Services.

2. Information We Collect

We collect information in several ways depending on how you interact with our Services:

  • Account Data: When you create an account, we collect your email address and display name.

  • Notification Data (CalmNotify): CalmNotify uses Android's NotificationListenerService to read notifications from other apps on your device. This data is partially redacted on-device (personal names are replaced with placeholders) before being sent to our servers for AI-powered importance scoring.

  • Contact Names (CalmNotify): CalmNotify reads your device contacts in memory only to detect personal names in notification text for privacy anonymization. Your contact list is never uploaded or stored on our servers. Only VIP or muted contact names that you manually select are saved.

  • Device & Usage Data: We automatically collect device identifiers (Firebase Installation ID), app usage analytics, crash reports, and performance data through Firebase Analytics, Firebase Crashlytics, and PostHog.

  • Payment Data: Subscription payments are processed entirely through Google Play Billing. We do not collect or store your credit card or payment details directly.

  • Website Data: When you visit our website, our servers automatically collect your IP address, browser type, operating system, and pages viewed.

3. How We Use Your Information

We use your information to:

check Provide and operate our Services
check Score and filter notifications using AI
check Process subscriptions via Google Play
check Send account-related communications
check Monitor and improve app performance
check Diagnose crashes and fix bugs

We do not sell your personal data. We do not display advertisements in any of our apps.

4. AI Processing & Automated Decision-Making

CalmNotify uses Google's Gemini AI to score your notifications by importance. Here is how it works:

  • Notification text is partially redacted on your device (personal names replaced with [NAME] placeholders) before being sent to Google's Gemini API.

  • Google processes this data under their Gemini API Terms of Service. Per Google's API data usage policy, data sent through the paid API is not used to train their models.

  • The AI returns a score (1–5) indicating the notification's importance. You can customize scoring preferences in the app.

Future apps (such as Fed.) may also use cloud-based AI to generate suggestions. This policy will be updated with specific details before those features launch.

Your Rights Under Art. 22 (Automated Decision-Making)

CalmNotify uses automated AI scoring to prioritize your notifications on a scale of 1–5. This scoring may affect which notifications are surfaced to you and which are suppressed.

  • You can disable cloud-based AI scoring at any time (Settings > Privacy). When disabled, only local on-device scoring operates, with no data transmitted.

  • You can adjust the importance threshold to control how aggressively notifications are filtered.

  • You can mark specific contacts as VIP to override AI scoring entirely.

  • You may contact us to request human review of how the scoring system processes your data.

5. Legal Basis for Processing

Under GDPR Art. 6, we process your data based on the following legal grounds:

Processing Activity Legal Basis
Notification reading & local scoring Art. 6(1)(a) — consent (Android notification access permission)
Cloud AI scoring (anonymized text to Gemini) Art. 6(1)(a) — explicit consent (opt-in cloud AI toggle in Settings)
Analytics (PostHog, Firebase) Art. 6(1)(f) — legitimate interest (app improvement)
Account management (Supabase auth) Art. 6(1)(b) — contractual necessity (providing the service)
Website hosting & security (Cloudflare) Art. 6(1)(f) — legitimate interest (security, performance)

6. Third-Party Services

We use the following third-party services that may receive or process your data:

Supabase — Database and authentication. Stores account data and app settings. Hosted in the United States.

Google Gemini API — AI processing for notification scoring. Receives redacted notification text only.

Firebase (Analytics & Crashlytics) — App analytics and crash reporting. Collects device identifiers and usage patterns.

PostHog — Product analytics. Collects anonymized usage events to help us improve the app experience.

Google Play Billing — Subscription payment processing. We do not directly handle payment card information.

Cloudflare — Website hosting and content delivery. May process IP addresses for security and performance.

Each service operates under its own privacy policy. We encourage you to review their policies.

7. Disclosure of Your Information

We may share your information only in these situations:

Service Providers: With the third-party services listed above, solely to operate and improve our Services.

Legal Requirements: If required by law, court order, or governmental authority, or to protect the rights, property, or safety of our users or the public.

Business Transfers: In connection with a merger, acquisition, or sale of assets, your data may be transferred as part of that transaction.

We do not sell, rent, or trade your personal data to third parties for marketing purposes.

8. Data Retention

We retain different categories of data for different periods. When you delete your account — whether in-app or by requesting deletion via our contact page — all associated server data is permanently removed within 30 days.

Data Category Location Retention Period
Notification history (text, scores) Device only User-configurable: default 7 days, max 90 days. Auto-deleted when expired.
Scoring usage records Supabase server 90 days rolling (auto-cleanup)
Global score cache (anonymized) Supabase server 30 days since last cache hit; quarantined entries: 7 days
Sender profiles (VIP/muted) Device only Persistent until manual deletion
Account data (email, settings) Supabase server Until account deletion; removed within 30 days of request
Analytics events (PostHog) PostHog Cloud (US) 1 year
Analytics events (Firebase) Google Analytics (US) Event data: 2 months; User data: 14 months
Crash reports (Crashlytics) Firebase Crashlytics (US) 90 days
Rate limit abuse strikes Device only (encrypted) 2–7 day cooldown, then auto-cleared

9. Data Security

We implement appropriate security measures to protect your data, including:

  • Encryption in transit (HTTPS/TLS) for all data communications

  • Row-level security on our database to ensure users can only access their own data

  • On-device PII anonymization before data is sent to AI services

  • Encrypted local storage on your device for sensitive preferences

While we strive to protect your data, no method of transmission over the internet is 100% secure. We cannot guarantee absolute security.

10. Your Privacy Rights

Depending on your location, you may have the following rights regarding your personal data:

All Users: You can delete your account and all associated data directly within the app at any time, or request deletion via our contact page. You may also request a copy of your data by emailing us.

Malaysian PDPA Rights: Under the Personal Data Protection Act 2010, you have the right to access, correct, and withdraw consent for processing of your personal data.

EU/EEA Residents (GDPR): You have the right to access, rectify, erase, restrict processing, data portability, and object to processing. You may also lodge a complaint with your local data protection authority.

California Residents (CCPA): You have the right to know what personal information we collect, request deletion, and opt out of sale of personal information. We do not sell personal information.

To exercise any of these rights, email us at privacy@lifesimple.co. We will respond within 30 days.

11. Children's Privacy

Our Services are not intended for children under the age of 13. We do not knowingly collect personal data from children under 13. If you are a parent or guardian and believe your child has provided us with personal data, please contact us at privacy@lifesimple.co and we will delete that information.

12. International Data Transfers

We are based in Malaysia. Your data may be transferred to and processed in countries outside your country of residence, including the United States (where Supabase, Google, and Cloudflare operate). These countries may have different data protection laws. By using our Services, you consent to these transfers. We ensure appropriate safeguards are in place with our service providers.

13. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes by posting the updated policy on this page and updating the "Last updated" date. For material changes, we may also notify you via email or in-app notification. Continued use of our Services after changes constitutes acceptance.

14. Contact Us

If you have questions about this Privacy Policy or wish to exercise your privacy rights, contact us at:

privacy@lifesimple.co

Life Simple Tech Enterprise
B-5-8 Plaza Mont Kiara, Mont Kiara,
50480 Kuala Lumpur, Malaysia