Privacy Policy

Privacy is a design principle of Lembra. This Policy explains clearly what data is processed, by whom, for what purpose, for how long and how you can exercise your rights. It follows the Brazilian General Data Protection Law (Law No. 13,709/2018 – LGPD), the Brazilian Civil Rights Framework for the Internet (Law No. 12,965/2014) and, for users in other countries, the EU General Data Protection Regulation (GDPR), the UK GDPR and United States state privacy laws, as set out in sections 15 to 17.

This Policy is part of the Lembra Terms of Use.

1. Who the controller is

Lembra (the "App") is developed and provided by Torres Applications, a brand used by the independent developer Maykow Roberto Lima Torres, based in Pernambuco, Brazil ("Torres Applications", "we", "us"), who is the controller of any personal data processed through the App, under art. 5, VI, of the LGPD and art. 4(7) of the GDPR.

Contact channel for data subjects (art. 41 LGPD): torres.software.app@gmail.com.

2. Summary

3. Health-related data: what Lembra does and does not do

3.1. Lembra is a reminder and personal organization app. You may log, for example, how much water you drink and your daily goal, your habits and reminders with text that you write. Some of this information may reveal data concerning your health, which the law treats as sensitive personal data (arts. 5, II, and 11 LGPD; art. 9 GDPR).

3.2. For this reason, the App was built so that this data stays exclusively on your device. It is not sent to Torres Applications, advertisers, Google Analytics for Firebase or any other third party. It leaves your device only on your own initiative: when you create or share a backup (section 10).

3.3. The App is not a medical device, does not interpret your data for clinical purposes, does not recommend treatments, medications or doses and does not diagnose. See the Medical Disclaimer.

4. What we do NOT collect (privacy by design)

Torres Applications does not collect, transmit or store on servers:

• the titles, descriptions, times and recurrences of your reminders;
• your water, habit, focus session, alarm and timer records;
• data about people you add (name, birthday, phone number chosen in the contact picker);
• your notes, lists, special dates and registered documents/due dates;
• your preferences (name or nickname, wake-up and bedtime, theme, language and the like).

All of this is stored in the App's local storage (the device's internal database) and only you have access to it.

5. Device permissions and features

The App asks only for the permissions needed by the features you use. You can revoke them at any time in the system settings, which may affect the related feature.

Features used only when you tap the related button, without a standing permission:

• System contact picker: the App receives only the contact you choose, not your whole address book.
• System speech recognition: to create reminders by voice. Audio is processed by your device's speech service (for example, Google), which may process it online under that provider's policy. Lembra receives only the transcribed text.
• System calendar and clock: the App opens the "new event" or "new alarm" screen pre-filled; you confirm it in the system app.
• WhatsApp and sharing: the App opens the chosen app with a pre-filled message. You always confirm the sending.

Lock screen and widgets. Depending on your device settings, notification content (for example, a reminder title) may appear on the lock screen. Home screen widgets show upcoming reminders and today's water. Adjust notification privacy in your Android settings.

6. Offline use and technical connection data

Reminder features run entirely on the device. When the App connects to the internet for the services in sections 7 to 9, the respective providers receive, as with any connection, technical data such as IP address, device model, operating system version and language.

7. Ads in the free version (Google AdMob)

7.1. To keep the App free, the free version shows ads provided by Google AdMob, a service of Google LLC. Ads are never shown over the screen of a ringing alarm or reminder, nor in a way that prevents you from confirming or dismissing an alert.

7.2. To serve ads, measure their delivery and prevent fraud, the AdMob SDK may automatically collect:

• the device advertising ID (which you can reset or delete and which does not reveal your name);
• interaction data with ads, such as impressions and taps;
• technical device and network data, such as IP address (used for approximate location and security), connection type, manufacturer, model, language and system version.

AdMob does not receive your reminders, logs or any other content you enter, and the App does not use your health data to select ads.

7.3. Consent. Where required by law (for example, in the European Union, the European Economic Area, the United Kingdom, Switzerland and some US states), Google's privacy message (User Messaging Platform) is shown before ads, where you choose whether you accept personalized ads. You can review this choice at any time in Profile › About › Ad privacy.

7.4. Legal bases. Personalized ads depend on your consent, which you may withdraw at any time. Non-personalized ads, based only on context and approximate location, rely on our legitimate interest in keeping the App free, respecting your rights and expectations.

7.5. Google acts as an independent controller of the data it collects through AdMob, under its own policy: policies.google.com/privacy. Learn how Google uses data from partner apps at policies.google.com/technologies/partner-sites.

7.6. How to control ads: reset or delete the advertising ID in your system settings (on Android, under Settings › Google › Ads or Settings › Privacy › Ads, depending on the device); manage personalization at myadcenter.google.com; or get Lembra Premium, which shows no ads.

8. Lembra Premium and payments

The purchase of Lembra Premium (whether a one-time purchase or a subscription, as shown in the store) is processed entirely by the app store (Google Play or the App Store). Torres Applications does not collect, access or store card, ID or banking data. The App receives from the store only the confirmation that the purchase is active and a transaction identifier, used solely to unlock Premium features and to restore the purchase. The store processes payment data as a controller under its own privacy policy.

9. Usage statistics and crash diagnostics

9.1. Usage statistics (Google Analytics for Firebase). To understand how the App is used, fix problems and measure marketing, we use Google Analytics for Firebase, a service of Google LLC. It records events such as first open, sessions, App version and Premium purchase, plus generic App events (for example, "backup created" or "widget added"). For this it may collect a random app-instance identifier, the advertising ID, approximate location (derived from IP address), device model, system version and language.

9.2. We never send the title or content of your reminders, water or habit records, data about people you add or any other health data. We also do not log events whose mere sending would reveal a health condition. Torres Applications sees only aggregated reports.

9.3. Crash diagnostics. When the App crashes, Firebase Crashlytics (if enabled in the installed version) and the app store may record a technical report (device model, system version, the code location of the crash and a random installation identifier), without the content of your reminders, used only to fix bugs.

9.4. Legal bases. Legitimate interest in maintaining, protecting and improving the App (art. 7, IX, LGPD; art. 6(1)(f) GDPR). Where the law requires consent, such as in the European Union and the United Kingdom, usage statistics are collected only according to your choice in the privacy message, which you can change in Profile › About › Ad privacy. Google processes this data under the Google Analytics Terms and its privacy policy.

10. Backup

10.1. Automatic local copy. The App keeps automatic copies of your data in the device's private storage to allow restoring in case of error.

10.2. Backup file. You can create a backup file at any time. It is created on your device and handed to you. It is not sent to Torres Applications servers. The file contains all your App data, including the health data you entered, and is not encrypted: keep it as a personal document.

10.3. Google Drive and other services. If you choose to save the backup to Google Drive or share it through another app, the App uses the system file picker and share sheet. The file is then stored in your account with that service and is subject to the privacy rules of the provider you chose. Torres Applications has no access to your account or to the file. If you turn on automatic backup updates to Drive, the App periodically rewrites that same file, and you can turn this off at any time.

10.4. Android backup. Android may include App data in your Google account's automatic backup, according to your device settings and Google's policy. Torres Applications has no access to that backup, and you can turn it off in Android settings.

11. Sharing data with third parties

Torres Applications does not sell, rent or trade personal data. The only data flows with third parties are those described in this Policy: Google AdMob (section 7), the app store (section 8), Google Analytics for Firebase and crash diagnostics (section 9) and the services you choose to store or send your backup (section 10). Data may also be disclosed to authorities when required by law or court order.

12. International transfers

Google and the app stores may process data on servers located outside Brazil and outside your country, including the United States. These transfers take place under art. 33 LGPD and Chapter V GDPR, with the safeguards adopted by those providers, such as the standard contractual clauses approved by the European Commission and by the Brazilian National Data Protection Authority.

13. Security

Because your data stays on the device, the main protection is your device's. We recommend keeping your screen lock on, your system up to date and being careful about who can access your device and backup files. Before a backup leaves the device through your action (sharing or saving to Google Drive), the App asks the device owner to confirm with biometrics or the screen lock password, when the device has a screen lock set. We adopt technical measures so that the App accesses only what you authorize, does not expose App content over the lock screen and does not send your reminders off the device without your action.

14. Retention and deletion

14.1. App data: stays on your device for as long as you want. You can delete it in the App, and full removal happens when you clear the App's data or uninstall it. Backup files you saved elsewhere must be deleted by you.

14.2. Ads: data is kept by Google for the periods in Google's privacy policy.

14.3. Usage statistics: data linked to the app-instance identifier is kept in Google Analytics for the configured retention period, up to 14 months; aggregated reports, which identify no one, may be kept longer.

15. Your rights under the LGPD (Brazil)

You may at any time request: confirmation that processing exists; access to the data; correction of incomplete, inaccurate or outdated data; anonymization, blocking or deletion of unnecessary data or data processed unlawfully; portability; deletion of data processed on the basis of consent; information about with whom data is shared; information about the possibility of refusing consent and its consequences; and withdrawal of consent. You may also object to processing based on legitimate interest and petition the Brazilian National Data Protection Authority (ANPD).

In practice:

• App data: since it is only on your device, you access, correct and delete it yourself in the App. Portability is provided by the Backup & restore feature, which exports your data to a file.
• Ads and statistics: use the controls in sections 7.6 and 9.4 and Google's tools.
• Any other request: write to torres.software.app@gmail.com. We will reply within the legal deadlines. Since we keep no accounts or servers with your reminders, we will tell you, where applicable, that we do not hold the requested data.

16. Users in the European Union, the European Economic Area, the United Kingdom and Switzerland

If you are in the European Union or the European Economic Area, Regulation (EU) 2016/679 (GDPR) also applies. In the United Kingdom, the UK GDPR and the Data Protection Act 2018 apply; in Switzerland, the Federal Act on Data Protection (nFADP).

• Controller and contact: as set out in section 1.
• Legal bases (art. 6 GDPR): consent for personalized ads and usage statistics; performance of a contract for Lembra Premium; legitimate interests for non-personalized ads, security, fraud prevention and crash diagnostics. Health data leaves your device only with your explicit consent (art. 9(2)(a)), in the case of section 10 (a backup you create and send).
• Your rights: access, rectification, erasure, restriction of processing, portability, objection and withdrawal of consent at any time, without affecting processing carried out before withdrawal. We reply within one month.
• Complaints: you may lodge a complaint with the data protection authority of the country where you live or work or, in the United Kingdom, with the Information Commissioner's Office (ICO).
• Automated decisions: we do not make decisions that produce legal effects on you based solely on automated processing, nor do we profile you using your health data.

17. Users in the United States

If you reside in a US state with a privacy law (such as California — CCPA/CPRA —, Virginia, Colorado, Connecticut, Utah, Texas and others):

• Categories of data: identifiers (advertising ID and app-instance identifier), internet activity information (ad interaction and App usage) and approximate location, collected by the services in sections 7 and 9. We do not collect health data in our systems.
• Sale and sharing: we do not sell personal data for money. Personalized ads served by Google may be considered "sharing" for cross-context behavioral advertising; you can opt out in Google's privacy message under Profile › About › Ad privacy, or by purchasing Premium.
• Your rights: to know, access, correct and delete data, to opt out of sale/sharing and targeted advertising, and not to be discriminated against for exercising these rights. Send your request to the e-mail in section 1.
• Consumer health data (such as the Washington My Health My Data Act): the health data you enter stays only on your device and is not collected, shared or sold by Torres Applications.

18. Users in other countries

If you use the App in another country, we process your data under this Policy and respect the rights granted to you by local law. To exercise them, write to the e-mail in section 1.

19. Children and teenagers

The App is intended for adults and is not directed to children. We do not knowingly collect data from children under 13 (or the minimum age required by the law of your country, which may be up to 16 in some EU countries). Use by teenagers should take place with the knowledge and supervision of their parents or guardians. If you learn that a child has sent us personal data, write to the e-mail in section 1 so that it is deleted.

20. Changes to this Policy

This Policy may be updated to reflect changes in the App or in the law. The date at the top shows the current version. Material changes, especially those involving new processing of data, will be announced in the App before they take effect and, where necessary, your consent will be requested.

21. Language

This Policy is available in Portuguese and English. For users in Brazil, in case of discrepancy, the Portuguese version prevails. For all other users, the English version is equally valid, unless local law requires another language.

22. Contact

Questions or requests about privacy and data protection: torres.software.app@gmail.com