Privacy Policy

Effective date: 28 June 2026 · Contact: hello.lystly@gmail.com

A plain-language summary of how Lystly handles your data, derived from the app's actual data flows.

The short version

Lystly is local-first. Everything you create — your planner, journal, notes, budget, and habits — is stored on your own device and works fully offline. You can use the entire app without an account, and none of your content leaves your device unless you choose to sync.

If you choose to create an account, your content syncs to your private, owner-only space in our cloud so you can use Lystly across devices. We do not show ads, we do not use third-party advertising or tracking, and we do not sell or share your personal data. (The only data that leaves your device is what you opt into — an account and the optional features described below; the app's font is bundled with it, so it makes no third-party request on launch. The one automatic exception is crash diagnostics: if the app hits an error, it sends a scrubbed error report — containing none of your notes, finance data, or other content — to our error-monitoring provider so we can fix the bug. See Crash diagnostics (Sentry) below.)

What data Lystly handles

Lystly stores the content you create:

• Planner — tasks, reminders, events, recurring items, habits.
• Commonplace — note pages and their blocks (text, checklists, images, files, links you add).
• Journal — daily entries, reflections, mood/weather, and attached images.
• Budget — accounts, transactions (including merchant, notes, tags, attachments you add), categories, budgets, bills, savings goals, net-worth tracking (assets and debts), recurring rules/subscriptions, merchant rules, and wishlist items, plus derived figures (balances, the Financial Health score). Amounts and notes you enter stay on your device unless you sync.
• Settings — display name, first day of week, currencies, appearance (theme), notification preferences, and time zone.

Where it is stored

• Desktop (Windows app): a local database file on your computer (SQLite, under your user-data folder).
• Web / installed PWA: your browser's local storage (IndexedDB) for that site, on your device.

Each identity has its own isolated on-device store — signed-out use, and each account you sign into, get a separate local database on the device. By default, none of your content is transmitted anywhere; the local database is the source of truth.

Optional account and cloud sync

Creating an account is optional and is the main thing that causes your content to leave your device.

• Authentication is provided by Supabase Auth. We store your email address and an account identifier. Passwords are handled by Supabase's authentication service and are stored hashed — we never see or store your password in plain text. When you are signed in, an authentication session token is stored locally on your device to keep you logged in; signing out clears it.
• When you are signed in, your content syncs to a managed PostgreSQL database (Supabase). Access is restricted by owner-only row-level security: each account can read and write only its own rows. Your data is not visible to other users.
• Images you add (note/journal images, receipt photos) are uploaded to Cloudflare R2 object storage under keys scoped to your account. The bucket is private — it is not publicly readable. Both uploading and viewing go through our server (the r2-sign function), which checks that you are signed in and that the image key belongs to your account, then issues a short-lived signed URL (it expires within the hour). When you are not signed in, images stay on your device (embedded locally).

If you never sign in, none of the account/sync/image-hosting flows apply.

Notifications (optional)

• On-device reminders (planner reminders, events, bills, budget alerts) are scheduled locally and shown by your operating system or browser. They require no server.
• Web Push (notifications when the app is closed) is optional. If you enable it, your browser creates a push subscription (an endpoint URL and keys provided by your browser's push service) which we store so our server can deliver your own reminders to that device. Your reminder content travels through your browser's push service to reach you. You can revoke it at any time in your settings or browser. We use it only to send your own reminders — never marketing.

Receipt scanning (optional AI feature)

Receipt scanning is not yet enabled in the current release — it is marked "Coming soon" in the app, and no receipt data is sent to OpenAI until the feature is turned on. The description below documents how it will work once it is enabled.

Receipt scanning is optional and available only when you are signed in. When you scan a receipt, the receipt image is first stored on Cloudflare R2 (as above), and our server then gives a third-party AI provider (OpenAI) a short-lived signed link to the image so it can read the receipt and extract fields (date, amount, merchant). So a scanned receipt is handled by two providers — R2 (storage) and OpenAI (which fetches and reads it). The feature is rate-limited and runs only when you trigger it. If you don't use it, no data is sent to OpenAI.

Crash diagnostics (Sentry)

To find and fix crashes, Lystly uses Sentry (hosted in the EU region) for error reporting. This is the one case where the app itself automatically contacts a third party, and it happens only when an error occurs — never on launch and never during normal use.

Crash diagnostics contain no personal content, no user identifiers, no IP address, and no location — IP storage is disabled at the Sentry project level ("Prevent Storing of IP Addresses"), so no geolocation is derived or retained, and the client attaches no user id. Reports are limited to the error type and stack trace, used solely to fix bugs:

• The error type and message, a code stack trace (Lystly's own code — file, function, line), the app version, and basic device/browser type.
• We explicitly remove anything that could contain what you typed or your data: no request bodies, no URL query strings, no page text or form input, no console logs, no email address, and no account identifier of any kind — the user record is dropped entirely.
• No IP address or location: IP storage is turned off at the project level, so no IP is retained and no coarse country/city is ever derived from it.
• There is no session replay and no screen/DOM capture.

Error reporting runs in the production app (the cloud-connected build) and is off in development and test builds. It works whether or not you are signed in, and either way no user identifier is attached. In a purely local build with no cloud backend configured, it is off entirely.

What Lystly does not do

• No advertising and no third-party ad/marketing trackers.
• No selling, renting, or sharing of your personal data.
• No usage telemetry or analytics inside the app. (The only diagnostic data the app sends is the scrubbed, content-free crash report described above, and only when an error occurs.)
• The marketing website uses no analytics and no tracking cookies.

Sub-processors

These providers process data on our behalf:

Provider	Purpose	Data involved	When
Supabase	Authentication, synced database, server functions	Email, account id, your synced content	When you have an account
Cloudflare R2	Image storage (private bucket; served via short-lived signed URLs)	Images you add, scoped to your account	When signed in
OpenAI	Receipt scanning (reads the receipt image at a temporary signed link)	The receipt image you submit	Only if you use receipt scan (signed in)
Your browser's push service	Web Push delivery	Push subscription + your reminder content	Only if you enable web push
Sentry (EU region)	Crash/error diagnostics	Error details + code stack trace, app version, device type — no user identifier, no IP address or location, never your content or email	Only when the app encounters an error

Each provider's processing region and data-processing-agreement (DPA) details are being confirmed and will be linked here.

Data retention and deletion

• Local data: stays until you delete it in the app, export it, clear your browser storage, or uninstall the app. Each account's on-device store is separate; clearing one does not clear another.
• Export / backup: you can export all of your data to a JSON file at any time (Settings → Data) and re-import it. You can optionally protect the export with a passphrase — it encrypts the file (AES-GCM) so it is unreadable without that passphrase. We cannot recover the passphrase, so keep it safe. We recommend regular backups, since for a local-first app, clearing your device storage removes local data.
• Erase account data: Settings → Data → Erase account data removes your synced content from the cloud; the deletion propagates to your other signed-in devices. (It does not, by itself, wipe a different account's local store on the same device — use the in-app delete/export/uninstall paths for that.)
• Account deletion: you can permanently delete your account yourself from the in-app Delete account control (Settings), which removes your authentication record and, by cascade, all of your synced cloud content. You can also request account deletion via the contact email.

Your rights

You can access, export, correct, and delete your data using the in-app controls above. Depending on where you live (e.g. GDPR/UK GDPR, CCPA), you may have additional rights. To make a request about your data, contact us at the email in the Contact section below.

Children

Lystly is a general-purpose productivity tool and is not directed at children. You must be 16 or older to use the app or create an account.

Security

• In transit: all communication with our cloud — authentication, sync, image upload/download, and server functions — is over HTTPS/TLS.
• At rest: the synced database (Supabase Postgres) and image storage (Cloudflare R2) encrypt stored data at rest (AES-256) at the provider level.
• Access control: cloud data is restricted per account by owner-only row-level security — each account can read or write only the rows it owns (auth.uid() = user_id), enforced by the database itself. The image bucket is private; viewing an image requires a short-lived, server-issued signed URL scoped to your account.
• Passwords: account passwords are hashed by Supabase Auth and are never seen or stored by us in plain text. In a purely local build (no cloud backend configured), a local account password is hashed on your device with PBKDF2 (per-account salt) and the hash never leaves the device.
• Crash diagnostics are scrubbed of personal content, identifiers, and IP before leaving the app (see Crash diagnostics above).
• Local data is protected by your device's own account/disk protections; we recommend device encryption and a screen lock.
• Backups can optionally be encrypted with a passphrase (AES-GCM, key derived via PBKDF2) so an exported file is unreadable without it.

Changes to this policy

We may update this policy as Lystly evolves. Material changes will be reflected here with a new effective date.

Contact

Lystly is operated by Veeravalli Lochani Pushpa (a sole individual, based in India). For any privacy question or data request, email hello.lystly@gmail.com.