Privacy, in plain language.

• Your voice is turned into text on your iPhone. Recordings never leave it.
• When you talk to your Moji, your words, along with your name, to-dos and calendar, go to our server and to OpenAI, our AI service provider, so it can reply. The reply’s text also goes to OpenAI when the server makes its spoken voice. Moji requests only happen after you say yes.
• When you’re signed in, your to-dos, calendar and Life Notes are saved to your account on our server, so they come back if you sign out, reinstall or change phones.
• Your camera photos and a copy of your chat history stay on your iPhone.
• Other LifeHub users can see your name, @handle and bio. Messages you send to people are stored on our server so they can be delivered.
• No ads, no ad trackers, and we never sell or rent your information.
• We collect setup progress, usage events and technical crash reports to understand whether the app works and fix problems. Setup progress starts before sign-in.
• You can delete your account from inside the app. The retention section explains what is removed and the limited records that can remain.
• LifeHub is only for people 18 and older.

To sign up you give us your email address and a name, and either choose a password or, where available, sign in with Apple or Google. A password is stored as a one-way hash, so nobody, including us, can read it. If you sign in with Apple or Google, we receive your email address, your name if you share it, and a permanent account ID from them. We never see your Apple or Google password, and Apple’s Hide My Email works.

We email you one-time codes to confirm your address, using an email delivery service called Resend.

Before you make an account or sign in on a new phone, the app asks your birthday. Your phone works out whether you are 18 or older and keeps the result. Your birthday is not sent to us. If you are under 18, the phone also keeps the date you become eligible, so it can ask again then; that date can reveal your birthday. With your account we record that you confirmed you are 18 or older, which version of our terms you agreed to, and when.

We also save your profile: your name, your Moji’s face, and the answers you give when you start, like your year and program of study. That way they come back if you sign in on a new phone.

While you’re signed in, your to-dos, calendar items and Life Notes are saved to your account on our server, whether you made them or your Moji did. That’s what brings them back when you sign out and in again, reinstall the app, or use another iPhone. A copy is also kept on your iPhone so they work without a connection, and changes catch up when you’re back online.

They are encrypted on the way to and from our server, but they are not end-to-end encrypted. We don’t read them, except to help when you ask, to fix something that broke, or when the law requires it.

When you delete one, it is removed from your account on every phone; the task and notes store keeps only a marker with its ID and when it was deleted, so another phone doesn’t bring it back. Erase everything you’ve made in Settings removes all of them from your account. If you use LifeHub without signing in, they stay only on your iPhone.

Information already included in a Moji conversation remains subject to the conversation retention described below.

When you talk or type to your Moji, your words are sent to our server, and OpenAI writes the reply. To help it answer about your day, we may also provide your name, to-dos, calendar items, selected mode and its instructions, and today’s date. Earlier conversation context can also be used. That’s what lets your Moji answer questions about your day and add things to it for you.

The app asks before any of this happens. If you choose “Not now”, your list, calendar and notes keep working. Your Moji just can’t reply until you agree.

Speech is turned into text on your iPhone, and a recording of your voice is never uploaded. To read a reply out loud, our server sends the reply’s text to the same AI service, which turns it into speech. If that isn’t available, your iPhone speaks the reply itself.

We keep your conversation on our server so your Moji can pick up where you left off. A copy is also kept on your iPhone.

OpenAI processes your messages, the context sent with them and generated replies. Its retention and use of data depend on the service, features and account settings. For API requests, OpenAI describes safety-log retention of up to 30 days by default, with longer retention for legal or safety reasons; some features keep stored conversation data for longer. See its API data controls. We don’t use your conversations to train our own AI models. Deleting your LifeHub account does not immediately erase copies that a provider retains under those rules. You can contact us about provider retention before choosing to use your Moji.

Messages to your Moji are checked for signs of self-harm. When a check flags a message, the reply includes crisis resources. The check does not create a separate record identifying you or what you said; your ordinary conversation is still kept as described above. It can miss things, and no person monitors your conversation for emergencies. LifeHub is not a crisis service.

Other LifeHub users can see your name, @handle, bio, profile picture and profile banner if you add them, and how many people you follow and are followed by, subject to blocking and account restrictions.

You start out findable: people can search for you by name. To stop that, turn off Findable by name on your profile. People can still find you using your exact @handle. Search needs at least two characters and limits how often it can be used. Blocking hides your profiles from each other and prevents messages.

We store who you follow, who follows you, and who you block. Messages you send are stored on our server, along with when they were delivered and read, so they reach the other person. They are encrypted on the way to and from our server, but they are not end-to-end encrypted. We don’t read them, except to look into a report, to keep someone safe, or when the law requires it.

You can message someone who follows you or has written to you first. Typing indicators are held briefly in server memory and are not saved to the database. Delivered and seen times are saved. If either person deletes their account, the conversation is removed for both people, subject to the report and backup exceptions below.

Profile pictures and uploaded profile banners are stored on our server and shown to people allowed to see your profile, never across a block. You can remove them, and they are removed when you delete your account. We can also remove them after a report. Copies already saved or cached by another person may remain.

When enabled and available, we use OpenAI to help check profile pictures, banners, messages, bios and changes to public names for content that breaks our rules. These checks may be unavailable and do not catch everything. Messages, pictures and bios rejected by a check are not saved as posted content. An attempted name change may remain in your private account profile even if it is not shown publicly.

A report includes your reason and can include a copy of the one message you report. It is stored for moderation and may also be copied to the operator’s email and technical logs. We aim to act within 24 hours. If the reported account is deleted, the report can remain with its handle but without a link to that account. Suspending an account ends its sessions, removes its notification tokens and hides it from normal search, profiles and conversations. A suspension can be reversed.

In app versions with Share usage & diagnosticsin Settings → Privacy & data, optional reporting is off until you turn it on. Turning it off stops new optional reports and clears reports waiting on that iPhone. Older versions report automatically. Updating or turning sharing off does not erase earlier server records. Essential server logs and records of requests needed to operate the service are separate from this optional reporting.

Before sign-in, the app sends our server a random installation ID, how far you got through setup, and whether that installation was already set up when reporting began. Our server records when it first and last hears from that installation. The ID is created by LifeHub; it is not an advertising ID. When you sign in, we link that installation record to your account. This helps us see where setup fails or people stop using the app.

While you are signed in, the app tells our server simple facts, for example: the app was opened, you finished setting up, you sent a message by voice or by typing (and in which mode), your Moji did something for you, you added a to-do, you set a reminder, you opened a notification or a screen, or a reply failed (as a short code).

These are events with timestamps and short codes, rather than copies of your messages. They are linked to your account, and we use them to see whether LifeHub is useful and to fix what breaks.

The app also collects crash and freeze reports using Apple’s MetricKit. These include the time, app and iOS versions, device model, error details and technical call stacks. Reports can wait on your iPhone until you are signed in, then go to our server linked to your account. They are designed to describe the app’s code and performance, not to collect your conversations.

If you allow location, your approximate position, rounded to about a kilometre, is sent to the Open-Meteo weather service to show the temperature on your home screen. It goes with no account details, and we don’t store that position on our server. Apple’s location services also help turn your location into a place name. The weather service may keep technical logs, including requested coordinates and IP addresses, for up to 90 days under its privacy policy.

Reminders you set are scheduled on your iPhone. If you allow notifications from our server, we store your Apple push token for new messages and followers. Apple delivers these notifications; a message notification can include the sender’s name and a short preview of the message. You can control previews in iPhone Settings. On sign-out, the app asks our server to remove its token; this needs a working connection. Suspension and account deletion remove the account’s tokens.

A copy of your chat history, photos and videos taken with LifeHub’s camera, pinned lines, your activity history, wallpapers and reminders are kept on your iPhone. Camera photos and videos are not automatically uploaded. A picture you choose for your profile or banner is uploaded as described above. Photos you save also go to your Photos library. Your Moji conversations, to-dos, calendar and Life Notes are also kept on our server, as described above.

Deleting the app removes its local files, but does not delete your account, pictures saved to Photos or existing backups. Your iPhone’s backups, in iCloud or on a computer, may include local files under Apple’s terms.

When you join the waitlist on this website, we store your email address, the date and time, the version of the consent statement you accepted, and that the signup came from this site. We use these details to manage the waitlist and tell you when access is ready, never for a newsletter.

When owner notifications are enabled, Resend sends a copy of your signup email address, time, source, consent version and signup ID to the operator’s inbox. We store the notification’s status, delivery-service message ID and acceptance time to check whether it was sent. This is an internal notification; joining the waitlist does not send you an automatic confirmation email.

To leave the waitlist or ask us to delete the signup and its notification copies, email support@thelifehub.site. Deleting an app account does not automatically remove a separate waitlist signup.

This website uses no advertising or analytics tracking cookies. It remembers your light or dark theme in your browser’s local storage. Cloudflare runs the site and may use security cookies and browser checks to prevent abuse. It also handles connection information such as IP addresses to deliver and protect the site.

If you email us, we keep what you send so we can help. Reporting a Moji reply from the app opens an email draft with that reply in it. Nothing is sent until you press send yourself.

Our server also keeps technical logs, such as request paths, errors and sometimes IP addresses, to keep it secure and working. Report details can appear in those logs as described above.

Other LifeHub users see only what is listed under Friends and messages, and the messages you send them.

Service providers that run parts of LifeHub for us see only what they need for that job:

• Cloud hosting: our app server in Montreal, Canada.
• OpenAI: writes your Moji’s replies, reads them out loud, and helps check profile pictures, banners and social content when those checks are enabled and available.
• Resend: delivers sign-in codes and operational emails, including enabled waitlist notifications and moderation reports to the operator. See its privacy policy.
• Cloudflare: runs this website and the waitlist.
• Apple and Google: only if you sign in with them. Apple also delivers notifications and provides location services.
• Open-Meteo: weather, with no account details.

Us. As the person who runs LifeHub, Mahd Qureshi can access its servers. We look at a specific person’s information only to help when they ask, to look into a report or misuse, to fix something that broke, or when the law requires it.

The law. We disclose information when the law requires it, or when it is needed to protect someone from serious harm.

If LifeHub changes hands. If LifeHub becomes a company or is taken over by someone else, your information moves with it under this policy, and we will tell you.

We never sell or rent your information, and we don’t share it with advertisers or data brokers.

Our app server is in Montreal, Canada. OpenAI and Resend process information in the United States, and Cloudflare operates worldwide. So your information may be handled outside Canada, where local authorities may be able to get access to it under their own laws.

• Your account, profile, to-dos, calendar, Life Notes, Moji conversation, profile picture and banner, follows, blocks, messages and account-linked usage events: while your account is active, unless you delete an item where the app offers that option. Account deletion removes these from the active service.
• Crash and freeze reports: linked to your account until it is deleted, or removed earlier as newer reports replace older ones. Our server keeps at most 2,000 reports across the service.
• Installation records: the random installation ID, setup stage and timestamps remain after account deletion, with the link to the deleted account removed. We also retain a usage summary with signup and departure days and setup and return milestones, without your name, email, account ID or conversation content. These records help measure whether people return to LifeHub; they currently have no automatic expiry.
• Sign-in codes: stop working after 15 minutes. Expired database records and related operational logs may remain until cleaned up.
• Local server backups: scheduled nightly, with the seven most recent successful copies kept on the same server. An older copy is removed as new backups succeed. Deleted information can remain in those copies until they rotate out; this is not a guaranteed seven-day deletion deadline.
• Reports about an account: may be kept as a safety record after that account is deleted. Deleting the reporter’s account removes the database report, but copies in email or technical logs may remain while needed to handle safety, support or legal matters.
• Waitlist records and owner notification copies: kept to manage early access, then deleted when no longer needed. You can ask to leave and have them deleted earlier. Delivery-service logs and backups may remain under their retention rules.
• Support emails: as long as we need them to help.
• Weather location: not stored on our app server.

Open your profile and tap Delete account. That removes your account, profile, to-dos, calendar, Life Notes, Moji conversation, follows and followers, blocks, profile picture and banner, notification tokens, account-linked usage events, crash and freeze reports, the database reports you filed, and every message you sent or received from the active service. Those conversations disappear for the other person too. It also clears your local Moji conversation, to-dos, calendar and Life Notes on that iPhone. Other local files, such as camera captures, settings and queued diagnostics, can remain until you delete the app.

Backup copies, reports about your account, installation records without the account link, and the limited usage summary may remain as explained above, as may report copies in email or logs and provider-held records. Deletion does not remove pictures you saved to Photos or your own backups.

Deleting the app on its own does not delete your account. Delete the account first.

• Choose “Not now” when LifeHub asks to send your words to the AI service. To take back a yes you already gave, open Settings → Privacy & data → AI replies → Withdraw consent. This stops new Moji requests on that device until you agree again; it does not delete earlier conversations. Your lists, calendar and notes still work. In versions whose permission screen covers Friends checks, new messages, bios, public-name changes and profile-image uploads also require AI permission; reading, reporting and blocking remain available. Older versions may continue social checks after you withdraw Moji consent. Update the app before sending social content if you want the newer control. If you need help, email support@thelifehub.site.
• Turn off Findable by name on your own profile, or block someone from their profile.
• Switch off location, notifications, the microphone and speech recognition any time in iPhone Settings → LifeHub.
• Ask to see, correct, or get a copy of the personal information we hold about you, or to have it deleted, by emailing support@thelifehub.site. We reply within 30 days.
• If you are unhappy with how we handled your information, you can complain to the Office of the Privacy Commissioner of Canada.

Everything between the app and our server travels over an encrypted connection. Passwords are hashed, your sign-in is kept in the iPhone’s Keychain, and LifeHub’s files on your iPhone are protected by iOS data protection. Mahd Qureshi administers our app server; the service providers above handle data needed for their services.

No system is perfectly secure. If a breach puts you at real risk of significant harm, we will tell you and the Privacy Commissioner, as Canadian law requires.

LifeHub is for people 18 and older. It is built for university students, but any adult can sign up without a school email address. It is not meant for anyone younger, and the app will not make an account for someone whose birthday says they are under 18.

If you tell the app you are under 18 while you are signed in, we suspend the account straight away and then delete it, unless you write to us that the birthday was a mistake. If we learn in any other way that an account belongs to someone under 18, we will delete it.

When this policy changes, we update the date at the top. If a change affects what we collect or who we share it with, we will tell you in the app or by email before it takes effect and ask for new consent where required. Updating this page alone does not give us permission to use your information for a new purpose.

Mahd Qureshi is responsible for how LifeHub handles personal information. Write to support@thelifehub.site with any question or request. See also the Terms.