Privacy Policy

Last updated: May 29, 2026  ·  Version: 2026-05-29

Data controller: BeepBoop Studios LLC (operating as Level: Adult)

1. Overview

BeepBoop Studios LLC ("we," "us," or "our"), operating the Level: Adult app, is committed to protecting your privacy. This Privacy Policy explains what information we collect, how we use it, with whom we share it, and the rights you have over your data.

By using the Service, you agree to the collection and use of your information as described in this Policy. If you do not agree, please do not use the Service.

2. Information We Collect

Account and Profile Data

When you register, we collect your email address, display name, username, birth year, and any profile information you provide (such as character appearance choices, living situation, and job status). If you sign in with Google OAuth or Sign in with Apple, we receive your account email, name, and basic profile information as permitted by those provider settings. If you choose Apple's "Hide My Email" option, we receive only a private relay email address (format xxxxx@privaterelay.appleid.com) and forward any communications through Apple's relay service.

Usage and Activity Data

We collect data about how you interact with the app: quests completed, lessons viewed, XP earned, streaks maintained, skills unlocked, and in-app choices made. This data is used to personalize your experience and track your progress.

Device and Technical Data

We automatically collect certain device and technical information, including: IP address, browser type and version, operating system, device type, time zone, referring URLs, and session duration. This information helps us operate and improve the Service.

Product Analytics Data

We collect pseudonymous event-level data about how you use the app — for example, when you start a lesson, complete a quest, view the paywall, or recruit an NPC. This data is tied to a randomly-generated analytics identifier (not your name or email) so we can analyze aggregate behavior. We also record a sampled subset of session replays (approximately 5% of sessions) to diagnose UI bugs we cannot reproduce ourselves. Form inputs, passwords, and the contents of private messages are masked. You can opt out by enabling "Do Not Track" in your browser; our analytics provider respects DNT and will not capture events from those sessions. This data is processed by PostHog (see Section 4).

Health and Wellness Data (if granted)

If you grant permission, the app may access health metrics from Apple HealthKit (on iOS) or Android Health Connect (on Android) — such as step count, sleep data, heart rate, active calories, distance, blood oxygen (SpO₂), mindfulness minutes, and workout information. Health data is read locally on your device for the purpose of auto-completing wellness quests; we do not transmit raw health readings to our servers and never share, sell, or use health data for advertising. You can revoke individual metric permissions at any time through iOS Settings → Health → Data Access & Devices, or Android Health Connect → App permissions.

Push Notification Tokens

If you opt in to push notifications, your device registers a notification token with Apple Push Notification service (APNs) on iOS or Firebase Cloud Messaging (FCM) on Android. We store this token to deliver streak reminders, quest nudges, and account-related alerts. You can disable push notifications at any time through your device's notification settings, and tokens are deleted when you delete your account.

Communications Data

If you contact us by email or through in-app support, we retain those communications to respond to your inquiry and improve our support processes.

Legal Agreement Records

We record when you agree to our Terms of Service and Privacy Policy, including the agreement timestamp, IP address, and version accepted. This is retained permanently for legal compliance.

3. How We Use Your Information

We use the information we collect to:

• Create and manage your account;
• Provide, personalize, and improve the Service;
• Track your progress and deliver quest recommendations tailored to your goals;
• Send transactional emails (account confirmations, password resets);
• Send push notifications about quests and streaks (only if you opt in);
• Process payments and manage subscriptions;
• Monitor for and respond to security incidents and fraud;
• Comply with legal obligations;
• Analyze aggregate usage patterns to improve app features (in anonymized or pseudonymized form);
• Respond to your support requests.

We do not use your personal data for automated decision-making that produces legal or similarly significant effects without human review.

4. How We Share Your Information

We do not sell your personal data. We share data only as follows:

• Supabase: Our backend infrastructure provider handles authentication, database storage, and file storage. Supabase processes your data on our behalf under a data processing agreement and does not use your data for its own purposes. Data is stored in Supabase's cloud infrastructure (AWS).
• Google OAuth and Sign in with Apple: If you sign in with Google, Google handles authentication and provides us with basic profile information per your Google account permissions. If you sign in with Apple, Apple handles authentication and provides an identity token; we receive your name and email (or a private relay address if you chose "Hide My Email") only on the first sign-in, per Apple's Sign in with Apple guidelines. Use of your data by each provider is governed by their respective Privacy Policies.
• Apple App Store / Google Play (in-app billing): Subscription purchases made through the iOS or Android apps are processed by Apple or Google. Payment card and billing information stays with those platforms; we receive only the receipt and entitlement status via RevenueCat (see below). Their use of your data is governed by Apple's and Google's respective Privacy Policies.
• APNs and FCM (push delivery): When push notifications are enabled, Apple Push Notification service (iOS) or Firebase Cloud Messaging (Android) handles delivery. They receive the notification payload and your device token. Notification content is limited to short text — never health data, lesson content, or personal details.
• Sentry: We use Sentry for error monitoring and performance tracking. Sentry may receive technical data such as device information, browser type, and anonymized user identifiers when errors occur. Sentry does not receive your health data or detailed personal profile information.
• Stripe: Payment processing is handled by Stripe. We do not store full payment card information. Stripe's use of your payment data is governed by Stripe's Privacy Policy.
• RevenueCat: Cross-platform subscription state management. We send your pseudonymous user identifier and the subscription receipt from your platform of purchase (Stripe, Apple App Store, or Google Play) so the app can determine whether to unlock premium features. RevenueCat does not receive payment card data. Their use is governed by RevenueCat's Privacy Policy.
• PostHog: Product analytics provider (US-hosted). Receives the pseudonymous event data and sampled session replays described in Section 2. We do not send health data, message contents, or full names. PostHog processes this data on our behalf under a data processing agreement. Their use is governed by PostHog's Privacy Policy.
• Legal requirements: We may disclose your information if required by law, court order, or government authority, or to protect the rights, property, or safety of us, our users, or the public.
• Business transfers: If we merge with or are acquired by another company, your information may be transferred as part of that transaction. We will notify you before your information is transferred and subject to a different privacy policy.

5. Data Retention

We retain your account data for as long as your account is active. If you delete your account, we will delete your personal data within 30 days, except:

• Legal agreement records (retained indefinitely for compliance);
• Transaction records required by financial regulations;
• Data we are required to retain by law.

Backups may retain copies of your data for up to 90 days after deletion.

6. Security

We implement industry-standard security measures to protect your data, including:

• Encryption of data in transit (TLS/HTTPS);
• Encryption of data at rest in our database;
• Row-level security (RLS) policies ensuring users can only access their own data;
• Authentication handled by Supabase Auth with secure session management;
• Regular security reviews and monitoring.

No system is completely secure. If you believe your account has been compromised, contact us immediately at support@leveladult.com.

7. Your Rights

GDPR Rights (EEA, UK, and Switzerland residents)

If you are located in the European Economic Area, United Kingdom, or Switzerland, you have the following rights under the GDPR and applicable national laws:

• Right of access: Request a copy of the personal data we hold about you.
• Right to rectification: Request correction of inaccurate or incomplete data.
• Right to erasure: Request deletion of your personal data ("right to be forgotten").
• Right to data portability: Request your data in a structured, machine-readable format.
• Right to restriction: Request that we limit how we process your data.
• Right to object: Object to processing based on legitimate interests.
• Right to withdraw consent: Withdraw consent at any time where processing is based on consent.

To exercise these rights, contact us at support@leveladult.com. We will respond within 30 days. You also have the right to lodge a complaint with your local supervisory authority. The data controller is BeepBoop Studios LLC.

CCPA Rights (California residents)

If you are a California resident, you have the following rights under the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA):

• Right to know: Request disclosure of the categories and specific pieces of personal information we have collected about you in the past 12 months.
• Right to delete: Request deletion of your personal information, subject to certain exceptions.
• Right to opt out of sale: We do not sell personal information. You may still submit an opt-out request at support@leveladult.com.
• Right to correct: Request correction of inaccurate personal information.
• Right to non-discrimination: We will not discriminate against you for exercising any CCPA rights.

To submit a verifiable consumer request, contact support@leveladult.com. We will respond within 45 days.

8. Minors and Parental Consent

The Service is intended for users aged 13 and older. We do not knowingly collect personal information from anyone under 13. If we become aware that a user is under 13, we will promptly delete their account and associated data. If you believe we have inadvertently collected data from a child under 13, please contact us at support@leveladult.com immediately.

Users between the ages of 13 and 18 must have permission from a parent or legal guardian to use the Service and to consent to this Privacy Policy. By using the Service, users in this age range confirm they have obtained that permission. In jurisdictions where the digital age of consent for data processing is higher than 13 (such as parts of the EU), users must meet their local minimum age and obtain parental consent where required.

9. Cookies and Local Storage

We use cookies and browser local storage to operate the Service:

• Authentication cookies: Required for keeping you signed in. These are set by Supabase Auth and are essential for the Service to function.
• Preference storage: We store your onboarding progress and UI preferences in local storage so you don't lose your place.
• Analytics: PostHog stores a pseudonymous analytics identifier in local storage and cookies so events from the same session can be linked. We do not use third-party advertising trackers. See Section 2 ("Product Analytics Data") and Section 4 for the full disclosure and opt-out instructions.

You can disable cookies through your browser settings, but doing so may prevent some parts of the Service from working correctly.

10. International Data Transfers

BeepBoop Studios LLC is based in the United States. If you are accessing the Service from outside the United States, your information may be transferred to, stored, and processed in the United States or other countries where our service providers operate. These countries may have different data protection laws than your country of residence.

For EEA/UK users, such transfers are conducted under appropriate legal mechanisms, including Standard Contractual Clauses as approved by the European Commission.

11. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will notify you by email or through a prominent in-app notice at least 14 days before the changes take effect. Your continued use of the Service after the effective date constitutes acceptance of the updated Policy. The version date at the top of this document identifies the current version.

12. Contact Us

For privacy-related questions, requests, or concerns, please contact us:

Email: support@leveladult.com
Data Controller: BeepBoop Studios LLC (Level: Adult)
Incorporated in: Texas, USA