Last updated: September 23, 2026
This policy describes how LeveBase ("we") collects, uses, and protects the personal data of app users, in compliance with Brazil's General Data Protection Law (LGPD — Law 13,709/2018).
LeveBase is a product of Zaiketz, operated by Daniel Itiro Tikamori as a sole proprietor (kojin jigyo / 個人事業, registered in Japan). To reach the person responsible for processing your data, use the contact form at the bottom of this page — we do not publish a personal email on this page.
When you create an account, we collect your name, email, and profile photo (via Clerk, our authentication provider). While using the app, you may voluntarily record: tasks, events, bills, financial goals, self-care moments, mood, energy level, and menstrual cycle data (dates, symptoms). This data is treated as sensitive health data under the LGPD. That's why we ask for your specific consent for this processing the first time you open one of those areas — before any health data is recorded, and not when you create your account. If you never use those areas, that consent is never asked for and never recorded. You can withdraw it at any time inside the app, under Settings › Privacy › Health data, without having to ask anyone — or through the contact form, if you prefer. Withdrawing consent stops new records being added and does not delete the ones already there: deleting your data is a separate request, equally available.
If you contact us on WhatsApp. The phone number published on our 特定商取引法 page is a WhatsApp Business line. If you choose to message it, we receive your phone number, the content of your messages, and the time they were sent. We use that only to answer you and to keep a record of your request while it is open. That conversation happens inside WhatsApp — on Meta's service, under Meta's own terms and data handling, not inside LeveBase — and we do not control how long Meta keeps it. Please do not send health details there (cycle, symptoms, energy, or anything similar): WhatsApp is not where we handle that kind of data, and if answering you needs it, we will ask you to continue in the app or through the contact form instead. Anything you can do over WhatsApp you can also do through the form, so you never have to use it.
You can connect your Google account to LeveBase to sync your calendar — it's optional and only starts when you tap "Connect Google Calendar" in the planner. This section describes specifically the Google data we access when you turn that on; for the providers that store the app's data in general, see "Where your data is stored", below — we use no provider beyond the ones already listed there for this data either.
With your permission, LeveBase first lists the calendars in your Google account so you can choose which one to sync with (your primary calendar is preselected; you can also keep a separate calendar created by LeveBase, if you prefer). From the calendar you choose, we read only the title, description, and start/end time of events from 30 days ago to 180 days ahead, and save that as your own personal LeveBase events — visible only to you unless you share one of them. Events you create, edit, or delete in LeveBase are created, updated, and deleted in that same Google calendar.
From your other Google calendars, we read only busy/free time intervals (never the title or any other content), and we do not store that information — it is used only to show when you are already busy while you plan something new. We never read or store guest lists/attendee emails, location, attachments, or video-call links for any event.
LeveBase does not store your Google access credentials (access or refresh token): the sign-in provider already described in "Where your data is stored" holds that authorization, and for each sync LeveBase requests a short-lived token from it without keeping it afterward. We do not sell this data, do not use it for advertising, and do not use it to train AI/ML models. Imported events are stored like any other LeveBase event, with the same encryption, retention period, and deletion described in "Where your data is stored" and "How long we keep your data", below.
To revoke LeveBase's access to your Google account at any time, use myaccount.google.com/permissions. This does not delete events already synced: they remain in LeveBase until you delete them individually or delete your account — deleting your account erases both the imported events and the sync records.
"LeveBase's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements."
We use your data exclusively to operate the app features you use (showing your tasks, calculating your estimated cycle, etc.) and to understand, in aggregate, how the app is used (via PostHog), which helps us fix problems and prioritize improvements. We do not sell or share your data with third parties for advertising purposes.
Authentication is managed by Clerk. App data (tasks, bills, cycle, etc.) is stored in a Cloudflare D1 database, on servers located in the United States. Aggregated usage events are processed by PostHog (servers in the European Union). If you have a paid subscription, who sells it depends on the plan and the country: for yearly plans outside Japan it is PayPro Global, and for monthly plans outside Japan it is Stripe, through the Link program — in both cases that company acts as the Merchant of Record and receives your data as an independent controller for the sale of the subscription, subscription management and payments, and tax compliance and invoicing. For purchases made in Japan, the seller may instead be LeveBase itself, and in that case Stripe only processes the payment, as a processor acting on our behalf. We do not store card data. We send transactional emails (daily digest, reminders) via Resend, only to users without active push notifications. Technical app errors are logged with Sentry, with no personal or health/financial data attached. None of these providers is permitted to use your data for its own purposes. Because these providers operate outside Brazil, your data is processed internationally (United States and European Union), under Art. 33 of Brazil's LGPD, solely to operate the service you use.
International transfer of sensitive health data. LeveBase processes sensitive health data (cycle, symptoms, energy). It is stored on servers located in the United States. As you may be in Brazil or Japan, this is an international data transfer (LGPD, Art. 33); by creating your account and giving the specific consent, you agree to it. Your sensitive data is encrypted in our database with a key unique to you; we do not offer end-to-end encryption — our servers can technically decrypt this data to run the service. Cycle dates and some structured fields (for example, numeric pain intensity) are stored unencrypted out of technical necessity. You can export or delete your data at any time in Settings, and reach our data-protection contact using the contact form below.
We keep your data while your account is active. You can export or delete your account and all associated data at any time, immediately, in Settings inside the app. If you prefer, you can also request this by email. After deletion, residual copies of your data may remain in encrypted backups for up to 30 days, until they are overwritten in the rotation cycle.
When you delete an individual item (a task, an expense, a cycle entry), it goes to the Trash: we keep a complete copy of that record for 30 days so you can restore it, and after that it is permanently removed. Deleting your account clears that Trash with it, immediately. You do not have to wait the 30 days: you can permanently delete an item from the Trash at any time, and it is removed immediately.
Items shared with your household. Five kinds of data can be shared: calendar, finances, tasks, shopping list and goals. When one of those is deleted, the deletion appears in the Trash of everyone in the household who could see that item, and not only the person who deleted it. Anyone with permission to edit that kind of data can restore the item or permanently delete it from there. Everything else (cycle, health, self-care, habits, focus and anything not shared) never appears in another person's Trash: it exists only in your account.
You may, at any time: confirm what data we hold about you, access it, correct incomplete or outdated data, export it (in Settings, in the app), and delete it (also in Settings, with immediate effect). You can also withdraw the consent you gave for processing sensitive health data (Art. 8 §5) under Settings › Privacy › Health data in the app, with immediate effect — or using the form below: from then on no health data is recorded. Withdrawing consent does not erase what was already recorded — for that, use the deletion above. If you reside in the European Union (for example, in Portugal) and the GDPR (General Data Protection Regulation) applies to your situation, you also have the right to object to certain processing of your data for reasons related to your particular situation (GDPR, Art. 21) and the right to request that we restrict/limit processing — for example, while we verify the accuracy of data you have contested (GDPR, Art. 18). There is no equivalent in-app option for these two requests; to exercise them, use the contact form below. For corrections or other questions about your data, use the contact form below.
We use cookies/local storage only to keep your session authenticated (Clerk) and for PostHog to identify anonymous/aggregated usage sessions. We do not use advertising or cross-site tracking cookies.
If we identify a security incident that compromises personal data, we will notify the people affected as soon as reasonably possible after confirming the incident, and we will notify the competent data protection authority when required by law. While we investigate an incident, we may take additional steps to protect your account — for example, ending active sessions on all devices and asking you to reset your password. If you suspect a security incident related to LeveBase, let us know using the contact form below.
Questions about this policy or about the processing of your data can be sent using the form below. The form and the app itself are the channels we monitor, and where we handle anything involving your health data. The phone number on our 特定商取引法 page is published because the law requires it, not as a support channel; if you do message it, see "If you contact us on WhatsApp" in section 1 for what we receive there and why health details should not be sent that way.