Privacy Policy

1. Introduction

Welcome to Lilia ("the App"), a private affirmation companion for women, developed and operated by Believe PR, owned by Armando Jimenez. Lilia is built around a single belief: your inner life is yours alone. We treat your data with the same care we ask you to give yourself.

Lilia helps you discover, plant, and revisit affirmations — short positive statements written in the first person — through an immersive swipe experience, curated categories, and Lily's Lab, an AI feature that crafts affirmations personalized to whatever you choose to share in the moment.

2. Privacy-First Approach

2.1 Our Philosophy

Lilia is built on a privacy-first foundation. Affirmations are intimate by nature, and we believe an app that holds them should ask for as little as possible. With Lilia we:

• ✅ Store all of your personal data locally on your device by default
• ✅ Sync only through Apple's CloudKit (your iCloud), if you enable it
• ✅ Use no advertising networks, no Google Analytics, no Firebase, and no third-party trackers
• ✅ Do not require user accounts, email addresses, or passwords
• ✅ Keep Lily's Lab requests anonymous — no profile, no history is built about you

2.2 What This Means for You

When you use Lilia:

• The affirmations you plant ("save") in your garden stay on your phone
• The affirmations you write yourself stay on your phone
• Affirmations you let go ("dismiss") and items in Hidden stay on your phone
• Custom theme photos stay in Lilia's local storage and your photo library
• Reminder schedules are scheduled locally by iOS

Important: Because we never have a copy of your garden, deleting Lilia without enabling iCloud sync will permanently remove your saved affirmations. We cannot recover them — we never had them.

3. Information We Collect

3.1 Information You Create

The following data is created by you and stored locally on your device (and, optionally, in your own iCloud):

• Garden: Affirmations you plant, the date you planted them, and any organization you give them
• My Affirmations: Affirmations you write yourself
• Lily's Lab Collection: Affirmations you save from Lily's Lab generations
• Hidden: Affirmations you have chosen not to see again
• History: A local record of affirmations you have viewed, planted, or let go
• Reminders: Times you choose to receive a daily affirmation notification
• Appearance & Palette: Your selected color palette and light/dark/auto preference
• Custom theme photos: Photos you optionally choose for custom backgrounds

3.2 What Lily's Lab Sends

Lily's Lab is the only feature that contacts a server. When you tap "Generate," the App sends the following to our AI Gateway so it can return personalized affirmations:

• The text you typed in the Lily's Lab prompt for that single request
• An app identifier (x-app-id: lilia) and environment (dev or prod)
• A bearer token that authorizes the App to use the Gateway
• Your IP address, as is technically necessary for any internet request

That request is then forwarded by our Cloudflare-hosted Gateway to one of our model providers (xAI Grok, with OpenRouter as fallback) to produce the affirmations you see. The Gateway never receives your name, email, location, garden, or any other personal information — it only sees the prompt for that one generation.

3.3 Information We Do NOT Collect

Lilia explicitly does NOT collect or have access to:

• ❌ Your name, email address, phone number, or contacts
• ❌ Your precise location or GPS data
• ❌ The contents of your garden, hidden list, or written affirmations
• ❌ Any photo from your library other than the ones you explicitly pick
• ❌ Health data, HealthKit data, or wellness metrics from any other source
• ❌ Social media identities, friend lists, or third-party login data
• ❌ Advertising identifiers (IDFA) — Lilia has no advertising

4. How We Use Your Information

4.1 App Functionality (On-Device)

Your affirmation data is used entirely on your device to:

• Show your daily affirmations and curated categories
• Track which affirmations you have already seen, planted, or let go
• Power "My Garden," Favorites, History, Hidden, and Stats
• Schedule your local reminder notifications
• Apply your selected palette, appearance, and custom theme photos

4.2 Lily's Lab Generation

The text you submit to Lily's Lab is used solely to generate that one set of affirmations and is not used for any other purpose. We do not retain it to train models, build a profile, or improve the service over time.

4.3 Operational Logs

The AI Gateway keeps minimal operational logs (timestamp, app id, environment, status code) for short-term abuse prevention and rate limiting. These logs do not contain the prompt text and are not linked to any user identity beyond an IP address.

4.4 No Marketing, No Profiling

We do not use any of your information for marketing, profiling, behavioral advertising, or selling to third parties. There is no advertising in Lilia.

5. Data Storage & Security

5.1 Local Storage

Your personal data is stored on your device using:

• SwiftData / Core Data in Lilia's secure app sandbox
• iOS Data Protection — files are encrypted at rest using your device passcode
• App Storage for preferences (palette, appearance, reminders)

5.2 Encryption

• At Rest: Data is protected by iOS file-system encryption tied to your device passcode
• In Transit: All Lily's Lab requests use HTTPS (TLS)
• iCloud Sync: CloudKit encrypts your data in transit and at rest under your Apple ID

5.3 Security Practices

• The Lily's Lab authentication token is XOR-obfuscated within the binary to discourage casual extraction
• The Gateway enforces per-IP rate limits to mitigate abuse
• Lilia does not include any analytics, attribution, or crash-reporting SDKs
• Lilia does not contain WebViews that load third-party content

5.4 Data Retention

• Your data remains on your device for as long as Lilia is installed
• You can delete individual entries at any time inside the app
• Deleting the app removes all locally stored data permanently
• If you used iCloud sync, the iCloud copy remains until you delete it from your Apple ID
• Lily's Lab prompts are not retained by Lilia or by the Gateway after the response is returned

6. Lily's Lab (AI Feature)

6.1 What Lily's Lab Is

Lily's Lab is an optional feature inside Lilia that turns whatever you choose to share — a feeling, a situation, a hope — into a small set of affirmations written in the first person. You decide whether to plant them in your garden, save them to your Lily's Lab Collection, or let them go.

6.2 How It Works

• You type a short message in the Lily's Lab screen
• Lilia sends that message to our AI Gateway over HTTPS
• The Gateway forwards it to a model provider (currently xAI Grok, with OpenRouter as fallback)
• The model returns a set of affirmations, which Lilia displays to you
• The prompt is not retained, indexed, or used to build a profile

6.3 Privacy in AI Processing

• ✅ No name, email, or account is attached to the request — the Gateway has no idea who you are
• ✅ Your garden and hidden list are NEVER sent
• ✅ The Gateway does not log prompt text after a response is returned
• ✅ Model providers process the prompt to generate a response in real time
• ⚠️ Model providers (xAI, OpenRouter) receive only the prompt you typed; treat it like any other AI chat input

6.4 What Not to Share

6.5 Not Therapy, Not Medical Advice

Lily's Lab and all affirmations in Lilia are for self-reflection and inspiration. They are not a substitute for licensed mental-health care, therapy, or medical advice. If you are struggling, please reach out to a qualified professional or one of the resources listed in section 16.

7. iCloud Sync

7.1 How iCloud Sync Works

Lilia uses Apple's CloudKit framework so your garden and preferences can sync between your own Apple devices (for example, iPhone and iPad) signed into the same iCloud account. CloudKit is provided by Apple, not by us. Believe PR has no servers that hold your affirmations.

7.2 What Syncs

• Your garden of planted affirmations
• Affirmations you wrote in My Affirmations
• Affirmations saved from Lily's Lab
• Your hidden list and basic history
• Your palette, appearance, and reminder configuration

7.3 What We See

Nothing. CloudKit data is stored under your Apple ID inside Apple's infrastructure. Believe PR cannot read, export, or download any user's CloudKit data.

7.4 Disabling Sync

You can stop using iCloud sync at any time by signing out of iCloud on your device or by disabling Lilia under Settings → Apple ID → iCloud → Apps Using iCloud. To delete the cloud copy, remove Lilia from iCloud and delete your iCloud backups for the app.

8. App Permissions

8.1 Photo Library (Add)

• Purpose: So you can save an affirmation card you generated in Lilia to your photo library to share or revisit
• When Requested: The first time you save or share a card
• What We Access: Lilia only writes the image you explicitly chose to save — it does not read your library

8.2 Photo Library (Read, Optional)

• Purpose: So you can pick a personal photo as a custom theme background
• When Requested: Only if you tap to choose a photo for a custom theme
• What We Access: Only the photos you explicitly select

8.3 Camera (Optional)

• Purpose: So you can take a fresh photo to use as a custom theme background
• When Requested: Only if you choose "Take Photo" instead of selecting from the library
• What We Access: The single photo you choose to capture for that theme

8.4 Notifications (Optional)

• Purpose: To send your daily affirmation reminders at times you pick
• When Requested: The first time you set up a reminder
• What We Send: A short affirmation, scheduled locally by iOS — nothing leaves your device to deliver it

8.5 Permissions Lilia Does NOT Request

• ❌ Location / GPS
• ❌ Contacts
• ❌ Calendar
• ❌ Microphone
• ❌ HealthKit / Apple Health
• ❌ Bluetooth
• ❌ Phone or SMS
• ❌ Tracking (App Tracking Transparency is not used because Lilia does not track you)

8.6 Managing Permissions

You can manage all permissions in iOS Settings → Lilia. Revoking a permission will turn off that single feature; the rest of the app continues to work.

9. Notifications & Reminders

9.1 Local Notifications Only

Lilia uses local notifications scheduled by iOS through the UserNotifications framework. There is no push-notification server, no APNs token tied to an account, and no message ever travels through Believe PR's infrastructure to reach your device.

9.2 What Notifications Contain

• A short affirmation chosen from the bundled or saved content on your device
• An optional category label

9.3 You Are Always In Control

You can set, edit, or remove reminder times in Lilia → More → Reminders, and you can disable notifications entirely in iOS Settings → Lilia → Notifications.

10. Third-Party Services

10.1 AI Gateway (Cloudflare Workers)

• Purpose: Routes Lily's Lab prompts to a model provider with rate limiting and content filtering
• What It Receives: Your prompt text, app identifier, environment, IP address (technical), bearer token
• What It Stores: Minimal short-term operational logs (timestamps, status codes); not the prompt
• Provider Privacy: Cloudflare Privacy Policy

10.2 xAI (Grok) — Primary AI Provider

• Purpose: Generates affirmations from Lily's Lab prompts
• What It Receives: Only the prompt text passed by the Gateway
• Provider Privacy: xAI Privacy Policy

10.3 OpenRouter — Fallback AI Provider

• Purpose: Acts as a fallback router across alternative models if the primary provider is unavailable
• What It Receives: Only the prompt text passed by the Gateway
• Provider Privacy: OpenRouter Privacy Policy

10.4 Apple iCloud / CloudKit

• Purpose: Optional sync of your garden and preferences across your own Apple devices
• What It Stores: Your encrypted Lilia data inside your personal iCloud
• Provider Privacy: Apple Privacy Policy

10.5 Apple App Store

• Purpose: Distribution and any future in-app purchases
• What It Receives: Standard download and purchase data handled by Apple, not by us
• Provider Privacy: Apple Privacy Policy

10.6 No Advertising, No Analytics

Lilia does not include Google AdMob, Google Analytics, Firebase, Facebook SDK, Mixpanel, Amplitude, AppsFlyer, Adjust, Branch, Sentry, or any other advertising, attribution, analytics, or crash-reporting SDK.

11. Your Privacy Rights

11.1 GDPR Rights (European Union / UK)

If you are in the EU, EEA, UK, or Switzerland, you have the following rights under the GDPR / UK GDPR:

• Right to Access: Request information about data processed about you
• Right to Rectification: Correct inaccurate data
• Right to Erasure: Request deletion of your data
• Right to Data Portability: Receive your data in a portable format
• Right to Object: Object to the processing of your data
• Right to Withdraw Consent: Withdraw consent at any time
• Right to Lodge a Complaint: With your local data-protection authority

11.2 CCPA / CPRA Rights (California)

If you are a California resident, you have the following rights:

• Right to Know what categories of personal information are collected
• Right to Delete personal information held by Believe PR
• Right to Correct inaccurate personal information
• Right to Opt-Out of the sale or sharing of personal information
• Right to Non-Discrimination for exercising any of these rights

We do not sell or share your personal information as those terms are defined under the CPRA.

11.3 How to Exercise Your Rights

Because almost all of your data lives on your own device:

• Access: Open Lilia — your garden, history, hidden list, and reminders are visible inside the app at any time
• Correction & Erasure: Edit or delete entries directly inside Lilia, or delete the app to remove all local data
• iCloud: If you used iCloud sync, manage or delete your data in Settings → Apple ID → iCloud
• Other Requests: Email lilia@armandojimenez.dev with your request

We will respond to formal rights requests within the timeframe required by applicable law (generally within 30 days).

12. Children's Privacy

12.1 Age Requirement

Lilia is intended for users 13 years of age or older. We do not knowingly collect personal information from children under 13. If you believe a child under 13 has used Lilia, please contact us so we can take appropriate steps.

12.2 Younger Teens

For users under 18, we recommend parental awareness. Lilia contains no chat with strangers, no public profile, no advertising, and no in-app purchases that could be made without device-level controls.

13. International Users

13.1 Where Data Lives

Your personal Lilia data lives on your device. Lily's Lab requests are routed through Cloudflare's global network and processed by AI providers (xAI in the United States, OpenRouter as fallback) in real time. iCloud sync, if enabled, stores data on Apple's infrastructure under your Apple ID.

13.2 International Transfers

If you are located outside the United States, your Lily's Lab prompt may be processed in the United States or other countries where the AI providers operate. By using Lily's Lab, you consent to that processing for the purpose of returning a generation.

13.3 Regional Compliance

• European Union / UK: GDPR / UK GDPR
• California: CCPA / CPRA
• Brazil: LGPD
• Other Regions: We respect all applicable privacy laws

14. Changes to This Privacy Policy

We may update this Privacy Policy to reflect new features, legal requirements, or third-party changes. When we make material changes:

• The "Last Updated" date at the top of this page will change
• We will surface a notice inside the app where appropriate
• Your continued use of Lilia after the change becomes effective constitutes acceptance

The most current version is always available at this URL and inside the Lilia settings.

15. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our privacy practices, please contact us:

Response Time

• Within 30 days for general privacy inquiries
• Within 72 hours for urgent privacy concerns
• As required by applicable law for formal rights requests

Mental Health Resources

Lilia is a companion, not a clinician. If you are in crisis, please reach out:

• US: Call or text 988 — Suicide & Crisis Lifeline
• US: Crisis Text Line — text HOME to 741741
• International: findahelpline.com