Your data, on your terms.

LifeLayers ("LifeLayers", "we", "us") is operated by SynaVora FZ-LLC, a company registered in Dubai, United Arab Emirates. For the purposes of EU data-protection law, we are the data controller of personal information processed through the LifeLayers website (lifelayers.net), the LifeLayers mobile applications for iOS and Android, and any related services that link to this policy (together, the "Service").

This policy applies whenever you create an account, install the app, visit the website, or otherwise interact with us. If you don't agree with how we handle your data, please don't use the Service.

We try to collect only what we need. The categories below describe everything LifeLayers may collect about you, why we collect it, and how you can avoid or limit each category where possible.

Account information

When you sign up, you give us a username, your first and last name, an email address, and a password (which we store only as a salted hash — we never see your plain password). You may optionally add a profile photo and a short bio.

Content you post

LifeLayers is built around "layers": photos or short videos that you attach to a specific location. When you post a layer, we collect the photo or video file itself, any caption or title you write, the coordinates you choose to attach to it, and the privacy setting you pick (public, followers, friends, or only me).

We also collect comments, replies, likes, and friend/follow relationships you create on the Service, plus any direct messages and attachments you exchange with other users in chat.

Location data

Location is the single most sensitive category we handle, so it has its own section below. In short: we use precise GPS to power the AR view, the nearby-layers map, and to attach coordinates to layers you choose to post.

Device and technical information

Push token

An anonymous identifier from Apple Push Notification service / Firebase Cloud Messaging that lets us deliver notifications to your device.

App version & platform

To deliver the right features and diagnose bugs.

IP address

Logged on each API request for security, abuse prevention, and to estimate aggregate geographic usage.

App integrity check

On security-sensitive actions — signing in or resetting your password — the mobile app attaches a short-lived attestation token from Firebase App Check that confirms the request comes from a genuine, untampered copy of the app. Producing it relies on Apple App Attest (iOS) or Google Play Integrity (Android), which process device- and app-integrity signals, plus a per-install app identifier that resets if you reinstall. We don’t receive a permanent device identifier from this, and we use it only to block automated abuse.

Cookies and similar technologies (website)

The lifelayers.net website uses a single first-party session cookie to keep you signed in. We do not set advertising cookies and we do not embed third-party tracking pixels. Logs of HTTP requests are retained for a limited period for security and debugging.

Information from other sources

We do not buy personal information from data brokers or social networks. If you sign in with a third-party identity provider in the future, we'll update this section before that goes live.

When we read your location

• AR view (the "Live" tab): we request your current coordinates once per session and again when you actively refresh. We use these to query for layers within a small radius (~120 m) so the camera view can show what's around you.
• Map view: when you open the map, the app asks for your current location to center the map. Panning the map after that does not send your device location to us — only the bounding box of the visible map area is used to fetch layers.
• Posting a layer: if you choose to attach the current location to a new layer, the app reads your coordinates at that moment. You can override the location with a different point before publishing.

What we store

Coordinates of posted layers are stored on our servers because that's the whole point of LifeLayers — those layers need to appear at the right place on other users' maps and AR views. Coordinates you used only to browse nearby content (without posting) are not retained on our servers beyond the request log rotation window.

Background location

LifeLayers does not run in the background to track your location. The app only reads your location when it is open and you are actively using a feature that needs it.

Reverse-geocoding

For human-readable place names (e.g. "Café Riche, Cairo") we use OpenStreetMap's Nominatim service. When you reverse-geocode a point, only the coordinates are sent to Nominatim — never any account identifier.

Turning location off

You can revoke location permission at any time from your device settings. Without it, the AR view, the map, and location-tagged posting will not work, but the rest of LifeLayers (feed, chat, profile, notifications) will continue to function.

We use the information described above to:

• Run the Service. Sign you in, deliver your feed, let you post layers, surface nearby content, route messages between you and your friends, send notifications.
• Apply your privacy choices. Every layer carries the audience setting you picked at the time of posting. We enforce that setting on every request, server-side.
• Keep the Service safe. Detect and prevent fraud, abuse, spam, and unauthorized access. Investigate violations of our Terms of Service.
• Communicate with you. Send transactional emails (password resets, security notices), and — if you opt in — product updates.
• Understand usage in aggregate. Count active users, track feature adoption, and find performance bottlenecks. This is done in a way that doesn't identify individual users.
• Comply with the law. Respond to valid legal requests, enforce our agreements, and protect our rights and the rights of our users.

With other LifeLayers users and the public web

Your profile (display name, username, avatar, bio, layer count, and your public layers) and any layer whose audience is set to Public are visible to anyone on the web — including people who don’t have a LifeLayers account. Visitors without an account can only view this content; liking, commenting, following, voting, and messaging always require signing in. Layers you post with a non-public audience (Followers, Friends, or Only me) are only shown to the audience you selected and are never visible to logged-out visitors. Direct messages are visible only to you and the recipient.

Search engines

Because public profiles and public layers are viewable by anyone, search engines such as Google and Bing may index them, and they may appear in search results and link previews. We only make public content available for indexing — non-public layers, your feed, the live map, and your messages are excluded from search engines by design. If you change a layer’s audience from Public to any other setting, or delete it, it is removed from our public pages and sitemaps right away; see section 6 for how search-engine caches are handled after that.

With service providers

We use a small number of trusted third parties to operate the Service:

• Hosting and storage — our servers and uploaded media live with reputable cloud infrastructure providers, under contractual obligations to keep your data confidential and only process it on our instructions.
• Push notifications — Apple Push Notification service (APNs) and Firebase Cloud Messaging (FCM), via the Expo push delivery layer. They receive your device's push token and the notification payload.
• Map tiles — MapTiler delivers the visual map tiles you see in the Map view. Tile requests include the map coordinates you're viewing but not any account identifier.
• Reverse-geocoding — OpenStreetMap Nominatim, as described in section 3.
• Email delivery — for password resets and security notices.
• App integrity (anti-abuse) — Firebase App Check (Google) verifies that security-sensitive requests come from the genuine app; on the device this uses Apple App Attest (iOS) or Google Play Integrity (Android). These providers process device- and app-integrity signals to issue the attestation token.

For legal reasons

We may disclose your information if we believe in good faith that we are required to do so by law, by a valid order from a competent authority, or to protect the safety of any person or the integrity of the Service. Where we are legally able to do so, we will notify you before disclosing your information.

In a business transfer

If LifeLayers is involved in a merger, acquisition, or sale of assets, your information may be part of that transaction. We will notify you (by email and through the app) before your information becomes subject to a different privacy policy.

What we don't do

We don't sell your personal information. We don't share it with data brokers. We don't permit third parties to use it for their own independent marketing.

LifeLayers gives you granular controls over the most sensitive categories of data. All of these live inside the app, under Profile → Settings.

Per-layer audience

Every layer can be set to one of four audiences when you post it:

Public

Anyone on the web can see this layer — including visitors without a LifeLayers account — and it may be indexed by search engines and appear in search results and link previews.

Followers

Only your followers (including friends) can see it.

Friends

Only people you are friends with (mutual connection) can see it.

Only me

Visible only to you. Useful for private journaling.

You can also choose a default audience for new layers under Settings → Default privacy.

Search-engine visibility

Only content with a Public audience can appear in search engines. To keep a layer out of search results, post it with any non-public audience — or change its audience later, which removes it from our public pages and sitemaps immediately. The same applies to your profile: if you have no public layers, we ask search engines not to index your profile page.

One honest caveat: search engines keep their own cached copies. After you change a layer’s audience or delete it, our pages return “not found” and the URL disappears from our sitemaps, and search engines typically drop their copy within days to a few weeks on their own schedule. If you need a cached result removed faster, tools like Google’s “Refresh Outdated Content” can expedite it, and you can always email [email protected] and we’ll help.

Notifications

Settings → Notifications lets you toggle each kind of push and in-app notification — likes, comments, follow requests, friend requests, new friend posts, and posts from people you follow. Device-level toggling is also available from your OS settings.

Location permission

Granted on first launch; revocable from your device settings at any time. See section 3 for what changes when location is off.

Account deletion

You can permanently delete your account from Settings → Danger zone → Delete account. We don't ask twice and we don't make you wait — the moment you confirm, your profile, layers, comments, chat messages, social-graph entries, and uploaded media are removed from the live service. The deletion is permanent and unrecoverable by design. If you change your mind later, you're welcome to sign up again with the same email; you'll be starting fresh. Any of your public content that search engines had indexed will stop resolving on our site the moment you delete, and drops out of search results as those engines refresh their caches (see “Search-engine visibility” in this section).

See section 8 for what happens to backup copies and the residual records we may keep for abuse-prevention purposes.

Requesting your data

We're building a self-service export tool. Until that's available, email [email protected] and we'll prepare a copy of the personal information we hold about you — profile, your layers and their captions, your messages, friend and follower lists — and send it within a reasonable period, typically within 30 days.

Depending on where you live, you may have some or all of the following rights regarding your personal information:

• Access — request a copy of the personal information we hold about you.
• Correction — ask us to fix information that is inaccurate or incomplete.
• Deletion — ask us to delete your information, subject to limited exceptions (for example, where we have a legal obligation to keep it).
• Restriction or objection — ask us to limit how we process your information, or object to certain processing.
• Portability — receive your information in a machine-readable format and have it transmitted to another controller, where technically feasible.
• Withdraw consent — where processing is based on consent, you can withdraw it at any time.
• Lodge a complaint — with your local data protection authority, if you believe we have not handled your information properly.

To exercise any of these rights, write to us at [email protected]. We'll respond within 30 days. For your security, we may need to verify your identity before fulfilling certain requests.

For users in the European Economic Area, the UK, and Switzerland: you may also contact us about the legal bases on which we rely to process your information. For most processing, the legal basis is one of: performance of our contract with you (so we can run the Service), our legitimate interests (such as keeping the Service secure), your consent (for optional features like push notifications), or compliance with a legal obligation.

For users in California: you have the rights described above under the California Consumer Privacy Act (CCPA), including the right to know what personal information we have collected and the right to deletion. We do not "sell" or "share" personal information as those terms are defined under the CCPA.

We keep your information for as long as your account is active. When you delete your account, here's what happens:

• Your profile, layers, comments, likes, friend and follower connections, chat messages, and uploaded photos and videos are removed from the live service immediately. The deletion is permanent — we don't keep a recovery window, and our support team cannot restore a deleted account.
• Residual copies may persist temporarily on operational backups and database replicas. We don't routinely access this data, and it rolls off our infrastructure as backups rotate.
• A minimal record — a hashed identifier and the date of deletion — may be retained beyond that, only where required to prevent abuse, enforce our Terms of Service, or comply with a legal obligation.
• Aggregate, de-identified statistics (such as monthly active user counts) may be retained indefinitely. They cannot be linked back to you.

HTTP request logs and security event logs are kept for up to 90 days, then deleted.

We use industry-standard technical and organisational measures to protect your information, including:

• TLS encryption (HTTPS) on every connection between your device and our servers.
• Passwords stored only as salted hashes — never in plain text and never reversible.
• Access to production systems limited to a small number of authorised personnel, on a need-to-know basis.
• Server-side enforcement of every privacy setting on every request, so a layer's audience cannot be bypassed by client-side tampering.
• Regular software updates and dependency reviews.

No method of transmission or storage is 100% secure. If we become aware of a security incident that affects your personal information, we will notify you and the relevant authorities as required by applicable law.

LifeLayers is not directed to children under 13, and we do not knowingly collect personal information from children under 13. In jurisdictions where the minimum age is higher (for example, 16 in parts of the European Economic Area), that higher minimum applies.

If you are a parent or guardian and believe your child has provided us with personal information, please contact us at [email protected] and we will delete the information.

For our full approach to keeping minors safe on the platform — including how we handle reports of CSAM and our cooperation with child-safety agencies — see the child safety page.

LifeLayers operates globally. Our servers, our staff, and our service providers may be located in countries other than your own — including the United Arab Emirates, the European Union, and the United States.

When we transfer personal information out of the European Economic Area, the UK, or Switzerland, we rely on appropriate safeguards recognised under applicable law, such as the European Commission's Standard Contractual Clauses, to ensure your information continues to receive an adequate level of protection.

We may update this Privacy Policy from time to time. When we make material changes, we will update the "Last updated" date at the top of the page and, where appropriate, notify you in the app or by email before the changes take effect. We encourage you to review this page periodically.

Questions, comments, or requests about this policy or about your personal information should go to:

Email

[email protected]

Postal

SynaVora FZ-LLC
Dubai, United Arab Emirates

We aim to acknowledge every privacy inquiry within 5 business days and to substantively respond within 30 days.