Linger Privacy Policy
Linger has no account and no server of our own. What stays on your device, the thirteen analytics events the app sends to Google Analytics for Firebase and what Google adds on its own, what the subscription provider sees, and how to export or erase everything in one tap.
Linger has no account and no server of our own. This Privacy Policy explains what stays on your device, the thirteen analytics events the app sends to Google Analytics for Firebase and what Google's software adds on its own, what the subscription provider sees, and how to export or erase everything in one tap.
Who we are and what this policy covers
Last updated: October 4, 2026.
This Privacy Policy explains how Pixelmate Labs ("we", "us", or "our") handles information in connection with Linger, including the Linger mobile apps for iPhone and Android, this website, and direct support conversations about Linger.
Linger is a general wellness app. Not treatment for any condition. It runs one short guided session a day across five sequential tracks. There is no account and no server of our own: the programme, your check-in answers and anything you write stay on your own device in an encrypted local database unless you export them yourself.
Two outside services receive a limited amount of data, and both are described below: Google's analytics service, Google Analytics for Firebase, receives usage events along with basic device details and a general location estimated from your device's IP address, and a subscription service, RevenueCat, receives your purchase records. We do not sell your data, we do not use it for advertising, and we do not share it with advertisers or data brokers. Google, which provides our analytics service, may also use that data to improve its own products and services, as described in its privacy policy, at https://policies.google.com/privacy.
This policy names every event the app itself sends, lists what Google's analytics software adds on its own, and says plainly what the app cannot do.
Our commitments
Four commitments hold regardless of which parts of Linger you use, and each one is a property of how the app is built rather than a promise about how we behave:
- There is no account, no sign-up, no email address and no password anywhere in Linger, and we never attach a user ID to anything the app sends. We could not link your sessions to you if we wanted to.
- Nothing you write inside the app, such as a session entry or a why-clause, is ever sent to us or to anyone else. It leaves your device only if you choose to export or share it yourself. How you answer the check-in after an exercise is not sent at all, and your onboarding answers are sent only as the programme they lead to.
- No advertising identifier is collected on either platform. On iPhone the app does not include Google's advertising-identifier component and never asks for tracking permission; on Android the advertising-ID permission is removed from the app.
- We never sell your personal information, and we never use it for advertising. There are no advertising SDKs, no ad networks, no cross-app tracking and no data brokers in Linger. Google's own use of the analytics data it receives is described below.
What Linger does not collect
The clearest way to describe a local-first app is by what is absent. None of the following is collected, requested, or present in Linger:
- No account, sign-up, email address, password, or social login
- No advertising identifier — Apple's IDFA and Google's advertising ID are both switched off outright, not merely left unused
- No text you type — your entries and your why-clauses are never sent to us or to any service, and leave your device only if you export or share them yourself
- No precise location — the app never asks for your location. Google's analytics service estimates a general location, such as your country, region or city, from your device's IP address, as described below
- No contacts, no photos, and no health data from Apple Health, Health Connect or Google Fit
- No AI or language model of any kind, so nothing you write is ever sent to a model to be processed
The analytics Linger sends, named in full
Linger uses one analytics service, Google Analytics for Firebase, which Google provides. We use it to understand things like how many people finish a session and whether the app is working as intended. Google may also use the data it receives to improve its own products and services; its handling of that data is governed by Google's own terms and privacy policy, at https://policies.google.com/privacy.
The app itself can only ever send one of the thirteen named events below. Each carries a small number of fixed, structured values — a count, a yes-or-no flag, or one of a short predetermined list. There is no mechanism in the app that can send a word you typed, a sentence, or anything else in free-text form: the app's analytics layer accepts whole numbers, yes-or-no flags and fixed options, and has no way to carry free text.
Google's software also records some events of its own and attaches technical details to events. Those are listed in the next section.
- onboarding_started — the first onboarding screen was shown
- onboarding_card_viewed — one onboarding screen was shown, by position only, never its content
- onboarding_completed — onboarding finished and a programme was assigned, and which of the three. Your individual answers to the onboarding questions are not sent, only the programme they lead to
- paywall_shown — the subscription screen was shown, and which version of it
- trial_started — a free trial began: which plan, and which version of the subscription screen it began from
- session_started — a daily session was opened: which track and position
- session_completed — a daily session was finished: which track and position, and whether the "nothing comes to mind" option was used
- track_completed — a full track of the programme was finished, and which track
- notification_delivered — the one daily reminder was delivered
- notification_opened — the daily reminder was tapped
- return_after_lapse — someone came back after two or more days away, and how many whole days
- presence_catch_used — the in-the-moment savouring exercise was used
- notifications_still_enabled_d30 — whether reminders were still turned on a month in
What Google's analytics software adds on its own
Google Analytics for Firebase does not use session replay, and the app switches off its automatic screen tracking. It does, however, record a standard set of events of its own and attach technical details to events. These come from Google's software that is built into the app. We do not write them and cannot switch them all off one by one, so they are listed below rather than left out.
None of what is listed below includes your name, email address, phone number, contacts, advertising identifier, precise location, or anything you wrote in the app. We do not set a user ID. We have not turned on Google signals for this app, and it is not linked to a Google Ads account. We do not use this data for advertising. We use it only to count installs and sessions, to see which links or campaigns led to installs, and to see which devices and settings the app needs to work well on.
- Events of its own: first_open (the first time the app is opened after installing), session_start (when a new session begins), user_engagement (how long the app was in use), app and operating-system updates, uninstall and clearing the app's data (Android only), and in_app_purchase (the product and its name, the price, currency and quantity, and whether it was a subscription, a free trial or an introductory offer), and, where Google's software can detect them, subscription events: a free trial converting to a paid subscription, a renewal (with how many times it has renewed) and, on Android, a cancellation or refund
- The app version, the device model and brand, the screen resolution, the operating system and its version, and the language setting
- On Android, how the app was installed: which app store installed it and, from Google Play's Install Referrer, the link or campaign that led to the install, if there was one
- A random app-instance identifier, and a separate random installation identifier used by Google's Firebase software to tell installs apart
- A general location, such as country, region or city, which Google estimates from the device's IP address. Google uses the IP address for that estimate; we never see it. This is an approximate location, not your precise location, and the app never asks for your location
The analytics identifier
Google's analytics software assigns each install a random app-instance identifier. It is not your name, email address or advertising identifier, and we never attach an account or user ID to it.
On iPhone, Google's analytics software is configured not to collect Apple's identifier for vendor. The subscription service does receive that identifier, as described under Subscriptions below.
Delete everything in Settings resets the app-instance identifier, and Google's software replaces it with a new random one.
What stays on your device, and how it is protected
Your profile, every session record, and every entry you write are stored in a local database on your device. That database is encrypted with SQLCipher using a 256-bit key generated on first launch and held in the platform keychain or keystore. The key is never logged, never exported, and never included in anything the app shares.
On iOS the key is stored so that it cannot be read before the device has been unlocked once, and it is explicitly marked as not synchronisable, so it never reaches iCloud Keychain. On Android it is held in encrypted preferences.
The database file itself is kept out of device backups on both platforms: on iOS it is excluded from iCloud and iTunes backup, and on Android the app sets allowBackup to false, so Android's automatic backup never copies it. Android device-to-device transfer can still copy app files, but the key stays behind in the keystore, so what transfers is unreadable ciphertext.
Subscriptions and purchase information
Subscriptions are sold and billed entirely by the App Store or Google Play. Linger uses RevenueCat as its subscription infrastructure: it confirms a purchase with the store and tells the app whether a subscription is currently active.
RevenueCat receives your purchase and subscription records, the product and price, the country of your store account, basic app and device details such as the app and operating-system versions, a random identifier it generates for the install, and, on iPhone, Apple's identifier for vendor (an ID Apple gives one developer's apps on one device; it is not the advertising identifier). It is not given your name or email address, because the app has no account to attach them to, and it does not receive anything you have written in the app.
RevenueCat does not receive an advertising identifier from Linger. The setting that would let it collect one is switched off in our configuration and no attribution feature is used. On Android the app also removes the advertising-ID permission altogether, and on iPhone the app never asks for tracking permission and never reads the IDFA.
Linger does not ask for, see, or store full payment card details. Those stay with Apple and Google.
Crash and error reporting
Linger does not include a crash-reporting service, so the app itself sends no crash reports. If you have chosen in your device settings to share usage and crash data with Apple or Google, your device may send them a report when the app crashes, under their terms, and they may show us that report so we can fix the problem. We add nothing to it.
How information is shared
There are exactly two third-party services in Linger, and both are named above:
- Google, which provides Google Analytics for Firebase, for the thirteen events listed above and the details its software adds. Google may also use that data to improve its own products and services, under Google's own terms and privacy policy
- RevenueCat, for subscription infrastructure, together with Apple and Google when you buy a subscription through their store, under their own terms
Legal disclosures, business changes, and where information is processed
We may disclose information when required by law, to enforce our rights, to protect users or the service, or in connection with a merger, acquisition, financing, or sale of assets. In practice there is very little to disclose: there is no account, no server of ours, and no copy of anything you have written.
The two services named above process the limited information they receive on their own infrastructure and under their own privacy terms. If you use Linger outside the country where a provider operates, that information may be transferred to and processed in a country whose data-protection laws differ from those where you live. Where required, we rely on the data-processing terms those providers offer.
Export everything, delete everything
Settings has two controls that act on everything Linger has stored on your device, immediately, with no account and no waiting period.
Export everything is a single tap with no confirmation step. It builds a JSON file containing your profile, every session record and every entry, and hands it to your device's own share sheet so you can save or send it wherever you like. The encryption key is never part of that file.
Delete everything is a tap and one plain confirmation — a neutral dialog, with no attempt to talk you out of it. Confirming erases your profile, every session, and everything you have written, removes the database file, destroys the encryption key, clears the app's local preferences, resets the analytics app-instance identifier (Google's software replaces it with a new random one), and empties the home-screen widget. It cannot be undone, and we hold no backup to restore from, because nothing you wrote was ever sent to us.
Both controls are free and always available. They are not part of any subscription and cannot be placed behind one.
Data retention
Your sessions, entries and settings stay on your device until you delete them, clear the app's data, or uninstall the app. We hold no copy and therefore have no retention period for them.
For detailed analysis, Google Analytics for Firebase keeps event-level data for 2 months and user-level data for 14 months, then deletes it automatically; aggregated reports are kept by Google under its own terms. The events carry no name, no email address, and none of your written content, and they are not tied to an account, so we have no way to find one person's events and nothing we could look up and delete on request.
Purchase records held by RevenueCat, the App Store and Google Play are subject to those services' own retention terms, and we cannot delete records that Apple or Google hold on your behalf. Their own account settings and support channels control those.
Security
The local database is encrypted at rest, its key is held in the platform keychain or keystore, and the database file is excluded from device backups. Traffic to the two services named above is encrypted in transit using TLS.
The strongest security property of this design is structural rather than procedural: there is no account to compromise, no server of ours holding your sessions, and no copy of what you have written for anyone to obtain.
No system is completely secure, and we cannot guarantee absolute security.
Your choices and rights
Depending on where you live, you may have rights to access, correct, delete, or receive a copy of certain personal information, or to object to or restrict some processing. Export everything and Delete everything, both in Settings, answer the access, portability and deletion rights directly and instantly, without asking us.
For anything else, including a question about the analytics events or a request relating to information held by one of the two providers named above, email hello@pixelmatelabs.com. Because Linger has no account, those records are not tied to your name or email address, so we may need to ask you for something that identifies the right record before we can act — we will say exactly what in our reply.
Children
Linger is not directed at children and does not knowingly collect information from anyone under the age required by their local law to consent to data processing. If you believe a child has provided personal information through Linger, contact us at hello@pixelmatelabs.com and we will review the request.
Changes to this policy
We may update this Privacy Policy as Linger changes or as legal, operational, or platform requirements evolve. When we do, we will update the effective date shown above and post the revised policy at the same public URL.
Questions? Email us at hello@pixelmatelabs.com.
This page requires JavaScript for the full interactive experience.