Privacy Policy

Last updated: May 5, 2026

Skyline Ventures LLC ("Skyline Ventures," "we," "our," "us") operates the Life App across iPhone, Mac, Android, and the marketing website at theskylineventures.com. This Privacy Policy explains what information we collect, how we use it, who we share it with, how long we keep it, the security controls protecting it, and the rights you have over it.

Life App is designed as a private personal-information dashboard. We treat your data as belonging to you, not us. We do not sell personal information. We do not share personal information with third parties for advertising. We do not use your data for credit, lending, or fraud scoring of third parties. We do not train general-purpose machine learning models on your personal data.

1. Who this applies to

This policy applies to anyone who uses the Life App or interacts with Skyline Ventures online. The Life App is intended for adults (18+). We do not knowingly collect personal information from children under the age of 13. If you believe we have inadvertently collected information from a child under 13, please contact us at contact@theskylineventures.com and we will delete it.

2. Information we collect

We only collect what we need to provide the features you use. Most data lives in your private account, scoped to you alone via row-level security on our backend. Specific categories:

2.1 Account and identity

Email address (used as your sign-in identifier).
Password — stored only as a salted hash by our authentication provider; we never see it in plaintext.
Authentication tokens (short-lived JWT access tokens and refresh tokens) used to keep you signed in.
Optional phone number — only if you choose to enable SMS-based 2FA. Subject to our SMS Terms.

2.2 Profile

Display name, optional profile photo, optional biography text.
Preferences such as theme, notification settings, units, time zone, and section visibility.

2.3 Tasks, habits, and goals

Tasks, lists, projects, milestones, subtasks, due dates, recurrence rules, completion status.
Habits, habit logs, streaks, frequency settings, and custom unit configurations.
Goals, pillars, time blocks, and reviews you create.
All of the above is content you create. We treat it as your private content.

2.4 Health and fitness data

With your explicit permission, the app reads health and fitness data from Apple Health (iOS / macOS) or Health Connect (Android), including workouts, sleep, heart rate, steps, active minutes, distance, calories burned, body composition, and similar metrics. Permissions are granted per-category and can be revoked at any time in your device's Health settings.
Manual entries you log (weight, body fat percent, body measurements, progress photos).
Strength training session data (exercises, sets, reps, weights, tempo).
Stretch and mobility routine completions.
Optional integrations you enable, such as Whoop or Hevy, only when you connect them.
Health data does not leave your device unless your account is signed in to our backend; even then, it is encrypted in transit and at rest, and is scoped exclusively to your account. Health data is not sold, shared, or used for advertising.

2.5 Nutrition

Food entries you log (food name, meal type, calories, macros, micros, serving size, timestamp).
Barcode scans you choose to perform with your camera.
Outbound queries to the FatSecret food database when you search for a food. Search queries themselves do not include your identity beyond the network metadata required to make an HTTPS request.
Calorie, macro, and micronutrient goals you set.

2.6 Journal

Journal entries (title, body text, mood, tags) you write.
Photos and voice memos you choose to attach.
Optional location coordinates if you choose to attach a location to a specific entry.
AI-generated suggestions, when you opt in to journaling assistance.

2.7 Calendar

Read-only access to your device's calendar, with your explicit permission, solely to display your events alongside the rest of your day. Calendar data is not transmitted to our backend; it stays on your device.

2.8 Financial information (via Plaid)

When you choose to connect a bank, credit card, brokerage, or other financial institution, the Life App initiates a secure connection through Plaid Inc. ("Plaid"). Plaid is the industry-standard service used to retrieve consumer financial data from financial institutions. Section 5 of this policy goes into significantly more detail on the financial-information practices; in summary, what we collect via Plaid includes:

Account information: account names, account types (checking, savings, credit card, brokerage, loan), institution names, partial account numbers (last 4 digits), and account metadata.
Balances: current and available balances on the accounts you connect.
Transactions: historical transactions including merchant, amount, date, category, location (where Plaid provides it), and pending status. Plaid generally provides up to 24 months of historical transactions.
Recurring transactions: patterns Plaid identifies for subscriptions, recurring bills, and recurring deposits.
Liabilities: credit-card and loan balances, if you connect such accounts.
Investments: holdings and positions, and investment transactions (buys, sells, dividends), if you connect such accounts.
Plaid access tokens: opaque credentials that allow Life App to refresh your data on your behalf. Tokens are stored encrypted on our backend and in the OS secure enclave on device; they are never exposed in user interfaces, logs, analytics, or third-party services.

Plaid acts as a data processor on our behalf for the purpose of providing you with this functionality. Plaid's own collection, use, and protection of your data is governed by the Plaid End User Privacy Policy, which we link from inside the app and recommend you review.

2.9 Voice and AI assistant ("Jarvis")

When you initiate a Jarvis voice or chat conversation, the message and (for voice) the captured microphone audio are sent to the large-language-model provider you have configured (such as Anthropic, OpenAI, or xAI) using the API key you supplied. We do not store conversation contents on our backend by default; the conversation transcript persists only on your device and is bound to your account.
Jarvis only accesses data within your account that you allow it to.
The third-party AI provider's privacy policy governs that provider's handling of your messages. You can disable Jarvis at any time from Settings.

2.10 Device permissions

Camera (for food barcode scanning, journal photos).
Microphone (for Jarvis voice and journal voice memos).
Location (optional, only when you attach a location to a journal entry).
Biometric (Face ID, Touch ID, fingerprint) used for app unlock and step-up authentication before sensitive actions such as connecting a bank account.
Notifications (only if you opt in).
Photo library (only when you choose to attach a photo).

Each of these permissions is requested only when needed and can be revoked at any time in your device settings.

2.11 Technical and operational data

Basic device information (device model, operating system version, app version, language, time zone) used to render the app correctly and triage issues.
Limited error and crash diagnostics. We make best efforts to redact personal content from these reports.
Server-side request logs at our backend and CDN providers, which include IP address and timestamps for security and abuse-prevention purposes; these are retained for short periods and are not used to build advertising profiles.

3. How we use the information

To provide and operate the features you actively use.
To synchronize your data across your devices.
To surface insights and summaries (e.g., weekly review, spending patterns, habit consistency) inside your account, visible only to you.
To answer questions you ask Jarvis about your own data.
To detect and prevent fraud, abuse, and security incidents.
To comply with applicable legal obligations.
To communicate with you about service issues and material changes to this policy or our terms.

We do not use your information for advertising. We do not sell or rent personal information. We do not use Plaid-derived financial data for credit underwriting, lending decisions, fraud scoring of third parties, or any consumer-report purpose under the Fair Credit Reporting Act.

4. How we share information

We share personal information only with service providers necessary to operate Life App, and only the minimum required for them to perform their function. We do not share personal information with third parties for marketing, profiling, or advertising. Our service providers and the role of each:

Supabase — backend database, authentication, and file storage. Hosts your account data encrypted at rest. SOC 2 Type 2 attested.
Cloudflare — CDN and asset delivery for our public marketing site only. SOC 2 Type 2, ISO 27001, and PCI DSS attested.
Plaid — financial-account aggregation. Sole processor for the financial-information category described in Section 5. SOC 2 Type 2 attested.
FatSecret — nutrition database lookup. Receives only the food query you type or scan; no personal account information is sent.
Apple Health / HealthKit and Google Health Connect — operate entirely on your device. Health data is read into the app on your device with your permission; we transmit it to our backend only when your account is signed in and only for the purpose of cross-device sync.
Apple App Store and Google Play Store — distribute the app. Subject to their respective platform privacy policies.
Large-language-model providers you choose for Jarvis (such as Anthropic, OpenAI, or xAI) — receive only the messages you send to Jarvis, using the API key you supplied.
Optional integrations you enable (e.g., Whoop, Hevy) — receive and provide only what is necessary for their integration, and only after you authorize them.

We may also disclose information when required by law (subpoena, court order, valid government request), to protect the rights and safety of users or the public, or in connection with a corporate transaction such as a merger or acquisition (in which case the successor will be bound by an equivalent or stricter privacy obligation).

5. Financial information — additional details (Plaid)

Because financial data is sensitive, this section describes our practices for that data category in more detail. This section supplements (and prevails over, where there is any conflict) the general statements above.

5.1 What you authorize when you connect an institution

Connecting a financial account is always initiated by you, from Settings or the Finance section of the Life App, and requires you to pass an additional phishing-resistant authentication factor (Face ID, Touch ID, fingerprint, or device passcode) immediately before Plaid Link is surfaced. When you complete Plaid Link successfully, Plaid returns to Life App a long-lived access token tied to that specific institution and the specific accounts you selected. Life App stores that token encrypted in the OS secure enclave on device and in our Supabase backend, and uses it solely to fetch account data on your behalf.

5.2 Categories of financial data and why we collect them

Account information and balances — to display your accounts on the Life App home screen and Finance dashboard.
Transactions and recurring transactions — to display your spending history, generate categorized weekly and monthly summaries, surface recurring subscriptions, and enable cross-domain insights such as spending vs. nutrition or spending vs. habits.
Liabilities — to display credit-card balances, loan balances, due dates, and interest data on your dashboard, when you choose to connect such accounts.
Investments — to display brokerage holdings and investment transaction history on your dashboard, when you choose to connect such accounts.

5.3 What we do not do with financial data

We do not sell, rent, or share financial data with third parties for marketing, advertising, or profiling.
We do not use financial data for credit underwriting or lending decisions.
We do not use financial data to score, evaluate, or report on third parties.
We do not provide financial data to data brokers or aggregators.
We do not train general-purpose machine learning models on your financial data.
We do not initiate payments or transfer money on your behalf without your explicit, in-app, biometric-protected authorization.
We do not retain Plaid data after you disconnect an institution and request deletion (see 5.6).

5.4 How financial data is stored and protected

In transit: all communication with Plaid, with our backend, and with our app is encrypted with TLS 1.2 or higher (TLS 1.3 preferred). HTTP is rejected.
At rest in Supabase: AES-256 disk encryption applied by the managed provider. Every row in financial-data tables includes the user identifier and is enforced via row-level security so that no other user, and no anonymous request, can read your data.
At rest on device: data inherits OS full-disk encryption (iOS Data Protection class NSFileProtectionComplete, Android File-Based Encryption, macOS FileVault).
Plaid access tokens specifically: stored in the operating-system secure enclave (iOS Keychain Services, Android Keystore-backed EncryptedSharedPreferences). Tokens are never written to logs, crash reports, or analytics, and are never visible in any user-facing surface.
Administrative access: our administrative dashboards are protected by individually-enrolled multi-factor authentication. Internal access to financial data is limited to what is strictly required to operate the service and is logged.

5.5 Retention

We retain financial data while your account is active and for as long as you have an institution connected. When you disconnect an institution from inside the app, we revoke the corresponding Plaid access token, stop refreshing data for that institution, and within thirty (30) days delete the historical data we retrieved for that institution from our active backend systems. Aggregated, fully de-identified usage statistics that cannot reasonably be associated with you may be retained for product analytics; these contain no personally identifying information and no specific financial details.

5.6 Your control over financial data

Disconnect any institution at any time from Settings → Finance → Connected Accounts.
Request a copy of all financial data associated with your account by emailing contact@theskylineventures.com; we will respond within 30 days.
Request deletion of all financial data associated with your account using the same email; deletion is honored within 30 days, subject to limited legal-retention exceptions.
Delete your entire account from Settings → Account → Delete Account, which removes all of your data including all financial data.

5.7 Plaid's role and Plaid's own privacy policy

Plaid Inc. acts as a data processor on our behalf for the functionality described in this section. Plaid's collection, use, and protection of your data are governed by the Plaid End User Privacy Policy, which is presented to you during the Plaid Link flow and is accessible at any time from inside the app. We strongly encourage you to review it before connecting any institution.

6. Security and incident response

We follow a written Information Security Policy maintained by our Information Security Lead, reviewed at least annually and on any material change to the product or vendor surface. Specific controls include: encryption of data in transit and at rest; row-level security on every user-data table; multi-factor authentication on administrative dashboards; storage of sensitive secrets in OS-managed secure enclaves; vendor due diligence for any provider handling personal data; vulnerability patching within defined SLAs; and a documented incident-response procedure with a target user notification window of 72 hours from confirmed exposure of personal data, in line with applicable breach-notification laws.

No system can guarantee absolute security. If you become aware of a security concern relating to your Life App account or Skyline Ventures, please contact us at security@theskylineventures.com.

7. Your rights

Depending on where you live, you may have specific rights regarding your personal information. We extend the following rights to all users regardless of jurisdiction:

Right to access — request a copy of the personal information we hold about you.
Right to correction — correct inaccurate personal information.
Right to delete — request deletion of your personal information, including all financial data, subject to limited legal-retention exceptions.
Right to portability — request an export of your personal information in a structured, machine-readable format.
Right to opt out of sale or sharing — we do not sell or share personal information for advertising, but you may confirm this at any time.
Right to withdraw consent — disable any specific integration at any time (HealthKit, Plaid institutions, Whoop, Hevy, Jarvis) without affecting other features.
Right to non-discrimination — we will not discriminate against you for exercising any of these rights.

To exercise any of these rights, contact contact@theskylineventures.com. We will verify your identity (typically by confirming control of the email address on the account) and respond within 30 days.

8. International users

Skyline Ventures LLC operates from the United States. If you access Life App from outside the United States, you understand that your data will be transferred to, stored in, and processed in the United States. We use providers (Supabase, Cloudflare, Plaid) that themselves offer recognized cross-border-transfer mechanisms where applicable.

9. Changes to this policy

We may update this policy when our practices change or to clarify existing practices. We will update the "Last updated" date at the top, and for material changes we will give reasonable advance notice through the app or by email. Your continued use of Life App after a material change constitutes acceptance of the updated policy. The previous version of this policy can be made available on request.

10. Contact

Skyline Ventures LLC
General privacy inquiries: contact@theskylineventures.com
Security inquiries: security@theskylineventures.com