Privacy Policy

Last updated: May 7, 2026

Welcome to System Life. We attach great importance to the protection of your personal data. This privacy policy explains what data we collect, why, and how we use it, in accordance with the General Data Protection Regulation (GDPR – EU 2016/679) and French data protection law (Loi Informatique et Libertés).

1. Data controller

The controller of personal data is:
Bertrand Perrier, operating under the brand Stat-Up
Email: contact@systemlife.app

2. About the application

System Life is a personal development mobile application designed to improve your wellbeing, productivity, and physical fitness through gamification mechanics (experience points, levels, ranks, streaks). It is available on Google Play and is intended for users aged 18 and over.

3. Data collected

When you use System Life, we collect the following data:

Account data (provided by you):

• Email address.
• Password (stored in hashed form, never in plain text), or your Google account identifier if you sign in via Google Sign-In.
• Username (chosen by you and visible to other users on the leaderboard).
• Avatar identifier (chosen from preset avatars).

Gameplay data (generated by your use of the application):

• Total XP, current level, current streak, longest streak, shields earned/used.
• History of completed quests (date, category, XP earned). The category includes general areas such as fitness, mindset, and productivity, but does not constitute medical or health data within the meaning of GDPR Article 9.
• Custom quests created by you (title, description, XP value, category).
• Daily reward streak and last claim date.
• Achievement unlocks.
• Theme preference (premium themes if applicable).

Subscription data:

• Subscription status (active or not), type (monthly/yearly), and expiration date.
• This data is provided to us by Google Play and RevenueCat. We do not directly store your payment information (card number, billing address).

We do not collect your name, surname, postal address, geolocation, advertising identifier, or any sensitive health data within the meaning of GDPR Article 9.

4. Legal basis for processing

Personal data is processed on the following legal bases:

• Performance of the contract (Art. 6.1.b GDPR): account creation, delivery of the gamification service, management of subscriptions and premium features.
• Legitimate interest (Art. 6.1.f GDPR): security of the service, prevention of fraud and abuse, leaderboard functionality.
• Consent (Art. 6.1.a GDPR): sending of local notifications (you may revoke this at any time in your Android system settings).
• Legal obligation (Art. 6.1.c GDPR): retention of billing records as required by French commercial law.

5. Purpose of processing

Your data is used to:

• Create and manage your user account.
• Send transactional emails (welcome email, password reset).
• Display your quest history, statistics, and progress (XP charts, RPG stats radar).
• Display your username, level, streak, and shields on the public leaderboard, accessible to all authenticated users of the application.
• Schedule daily local reminder notifications (8 AM and 4 PM, your local time).
• Manage your premium subscription and verify entitlements.
• Detect and prevent fraudulent or abusive use of the service.

6. Cookies, tracking, and local storage

System Life does not use any behavioural tracking, audience analytics (no Google Analytics, no Firebase Analytics), nor any advertising identifiers or third-party cookies.

The application stores limited preferences locally on your device using localStorage: sound effects toggle, current theme, language preference, and tutorial completion flag. This data never leaves your device.

7. Third-party services (sub-processors)

System Life relies on the following sub-processors, which may process some of your data:

• Supabase – secure data storage, authentication, and serverless functions (EU region, Ireland). Privacy policy
• Resend – sending of transactional emails. Privacy policy
• Sentry – crash reporting and error monitoring (EU region, Germany). Privacy policy
• Google Play / Google Identity – authentication via Google Sign-In and processing of payments. Privacy policy
• RevenueCat – management of in-app subscriptions and entitlements. Privacy policy

8. Data location and international transfers

Your account and gameplay data is hosted on servers located in the European Union (Ireland region via Supabase). Some data may be processed by sub-processors located outside the European Union (notably Resend, Google, and RevenueCat in the United States).

For all transfers outside the European Union, we ensure that appropriate safeguards are in place in accordance with Articles 44–49 of the GDPR, including the European Commission's Standard Contractual Clauses (SCCs) and adequacy decisions where applicable.

9. Data security

We implement appropriate technical and organisational measures:

• Encryption of data in transit via HTTPS/TLS.
• Passwords stored in hashed form (bcrypt, never in plain text).
• Authentication via PKCE flow with short-lived JWT tokens.
• Row-Level Security (RLS) applied at the database level — users can only access their own data.
• Access to administration interfaces restricted to authorised personnel only.
• Infrastructure hosted with certified providers (Supabase – SOC 2 Type II).

10. Data retention

Your data is retained for as long as your account is active. Upon deletion of your account, your personal data is permanently erased within 30 days.

Certain data may be retained beyond this period only where required by applicable law, in particular billing records retained for 10 years under Article L.123-22 of the French Commercial Code. After this legal retention period, all remaining data is irrevocably deleted.

11. Your rights (GDPR)

In accordance with the GDPR, you have the following rights:

• Right of access: obtain a copy of your data.
• Right to rectification: correct inaccurate data.
• Right to erasure ("right to be forgotten"): request the deletion of your account and associated data via this page.
• Right to portability: receive your data in a structured, machine-readable format.
• Right to object: object to processing based on legitimate interest.
• Right to restriction: request the restriction of processing in certain cases.
• Right to withdraw consent: at any time, where processing is based on consent (notifications).

To exercise these rights, contact us at contact@systemlife.app. You will receive a response within a maximum of 30 days.

You also have the right to lodge a complaint with the CNIL (French supervisory authority) or with the supervisory authority of your country of residence.

12. Minors

System Life is intended exclusively for users aged 18 and over. We do not knowingly collect personal data concerning minors. If you become aware that a minor has created an account, please contact us at contact@systemlife.app and we will delete the data without delay.

13. Public profile and leaderboard

By using System Life, you acknowledge that the following data is visible to other authenticated users via the in-app leaderboard:

• Your username.
• Your level, current streak, total XP, and shields earned.
• Your selected avatar.

Your email address, password, completed quests history, and custom quests are never visible to other users. Choose a username that does not reveal information you do not wish to share publicly.

14. Changes to this policy

We may update this policy at any time. In the event of a substantial change affecting your rights or the purposes of processing, you will be notified by email or via an in-app notification at least 14 days before the change takes effect. The date of the last update is indicated at the top of this document.

15. Contact