Privacy

Revel LLC runs Life Manager. This page says what is stored, why, and what you can do about it. The short version: your data is yours, it is kept on one server for you alone, and it is never sold, shared for advertising or used to profile you.

What is stored

Account: your email address, name, a hash of your password (never the password itself), and your authenticator settings if you turn two-factor sign-in on.
What you enter: projects, tasks, goals, journal entries, health and money records, people, assets, and the files you import.
Security records: sign-in times, the device type, and a shortened network address (the last part removed), kept to protect your account.

Why

Only to run the service for you: to show your data back to you, calculate totals and trends, send the reminders you ask for, and keep your account secure.

Who can see it

Each account is kept separate from every other account, and the database itself refuses to show one account’s rows to another. Nobody else using this server can see your data.

Encryption

The private text you write is encrypted in the database: journal entries, notes, insights, health notes, names of people, account names and numbers, transaction descriptions, tasks, goals, decisions and similar fields. Each account has its own key, and that key is locked by a server key kept in a separate file that only the server’s administrator account can read. The server key is never stored in the database or in its backups.

What this protects: a stolen copy of the database or of a backup cannot be read. What it does not: this is not end-to-end encryption. The server reads your data to run the app for you (search, totals, reminders, and resetting a forgotten password without losing anything), so someone with full control of the running server could read it. Not encrypted, and protected by the account separation above instead: dates, amounts and other numbers that totals need; the labels you organise with (tags, categories, life-area, metric, calendar, budget and alert names); your email address, your name and the name of your space.

Our commitments: no screen or tool shows anyone else your content. Your data is decrypted only inside your own requests and the jobs that serve you, and decrypted text is never written to logs. If you need help that requires a look at your data, you turn on support access in Settings → Data for a limited time; every look is listed there, and you can turn it off at any moment.

The assistant

Life Manager includes an optional assistant built on Claude, an AI model made by Anthropic. It is off until you turn it on in Settings → Assistant, and the person who runs this server can switch it off for everyone.

What it can read. Only what you allow. When you turn it on, it can read your tasks, projects, goals, decisions, reviews, calendar, metrics, alerts and upkeep. Journal and insights, health, money and people each have their own switch, and each starts off (for the server’s owner, pre-selected as they decided, until they confirm them). A journal entry marked “Keep from assistant” is never read, not even as a passage behind an insight, and neither is an insight in a category whose Assistant memory is off. A person is never included unless you turn them on. In a shared space, the assistant sees only what your own role can see.

What is sent. When you ask it something, during your weekly strategy session, when it writes a project’s “Assistant’s read” or the line at the top of Today, or when your morning briefing or a memory update runs for you, the server decrypts the records it needs inside your own request and sends that text to Anthropic over an encrypted connection. Your password, sign-in details, email address and connection keys are never sent.

What Anthropic does with it. Under Anthropic’s commercial terms, Anthropic does not use this data to train its models, and it deletes it within 30 days. It may keep it longer only where its usage policy or the law requires (up to 2 years for content flagged under its usage policy). Details: privacy.claude.com.

What is kept here. Your conversations, briefings, suggestions, weekly sessions and their outcomes, project readings, notifications and what the assistant has learned about you are stored in your account and encrypted like your journal. Our usage records keep token counts (the units the model is billed in) and cost, never the text.

What it changes. It changes simple things like tasks and your day plan when you ask it to, shows each change and lets you undo it for 7 days. Anything bigger, and anything it suggests on its own, waits for your approval. It cannot move money, contact anyone, delete without a fresh sign-in, change security, privacy or AI settings, or approve its own suggestions.

What it learns about you. Settings → Assistant → What I know about you lists everything it keeps: what it has observed, what it assumes, and what you have confirmed, with the records behind each one. You can confirm, correct or forget any item. Turning a switch off, or keeping an entry from it, stops it from using anything it learned from that part of your account, and closes that day’s conversation so nothing read before is sent again.

How often it speaks up. You choose Quiet, Balanced or Proactive. It stays quiet during your quiet hours, a focus session or a calendar event, never raises something you paused or asked it never to suggest, and does not bring a decision you made back up unless something has changed. Notifications are inside the app only.

Not advice. It helps you organise and decide. It does not give medical, legal or financial advice.

Turning it off and deleting. Turning it off stops it at once. Settings → Assistant → Delete assistant data erases your conversations and everything it learned. Copies already sent to Anthropic are deleted on their schedule above.

Outside services

Weather: if you set a location, its coordinates (not your name or account) are sent to Open-Meteo and the US National Weather Service to get forecasts.
Email: when email is set up on this server, your address is passed to our email provider (Resend) only to send account messages such as a confirmation link.
Anthropic (assistant): only while the assistant is on, and only what is described under “The assistant”.
Calendar feed: if you paste a calendar’s secret address, the server fetches that calendar from its provider (for example Google) to show it here, read-only. Nothing is sent to the provider but the request itself.
Bank feed: if you connect SimpleFIN Bridge, the server fetches your account balances and transactions from it. Nothing from your account is sent to it.
No analytics, advertising or tracking scripts. The only cookies keep you signed in and remember your display preferences.

Your choices

Export: Settings → Data downloads everything in your account, including your assistant conversations and what it has learned, as JSON, or any table as CSV.
Delete: Settings → Account deletes your account. Access ends at once, and the data is permanently removed from the server after 7 days. Until then the operator can restore the account if you ask (you set a new password on your next sign-in). Server backups age out on their own schedule.
Correct: everything you entered can be edited or removed in the app. Metric readings and credit scores keep the earlier entry as history when you correct or delete one (it is no longer shown, but stays in your export), and a deleted project can be restored from Projects for 30 days before it is removed for good. Deleting the account removes all of it.

Contact

Privacy questions or requests: ask the person who runs this server, or write to Revel LLC.