Privacy Policy

Lifestream Dynamics  ·  Effective date: April 22, 2026  ·  Version 1.0

1. Who We Are

Lifestream Learn is operated by Lifestream Dynamics ("we", "us", "our"). Questions about this policy can be directed to info@lifestreamdynamics.com.

2. Information We Collect

We collect the following categories of personal information:

• Account data — email address, display name, and hashed password (or passkey credential identifier) provided at registration.
• Profile data — optional avatar URL and biographical information you choose to add.
• Usage data — course enrollments, video watch positions, cue responses, and assessment results. This data is inherent to delivering a personalised learning experience.
• Analytics events — anonymised interaction events (e.g. which screen was tapped) collected when you opt in. Events contain no free-text input and are associated only with an internal identifier, not your email address.
• Crash reports — anonymised stack traces and device context collected when the application crashes and you have opted in. Reports never include content you have typed.
• Session data — access tokens, refresh tokens, and hashed IP addresses used to authenticate requests and detect suspicious activity. Raw IP addresses are hashed with a server-side salt before storage and cannot be reversed.
• Multi-factor authentication data — encrypted TOTP secrets or passkey public keys if you enable MFA. Private keys never leave your device.
• Designer content — video files, cue configurations, and course metadata uploaded by users with the Course Designer role.

We do not collect payment information directly; no billing is currently processed through the platform.

3. How We Use Your Information

We use your information solely to:

• Operate and deliver the Lifestream Learn service, including video playback, interactive cue assessment, and progress tracking.
• Authenticate your identity and maintain session security.
• Detect and prevent fraudulent or abusive activity.
• Improve platform stability and diagnose bugs (crash reports and opt-in analytics only).
• Respond to your support requests and communicate service-critical notices.
• Comply with applicable legal obligations.

We do not use your data for targeted advertising and do not profile you for commercial purposes unrelated to delivering the service.

4. Legal Basis for Processing (GDPR / PIPEDA)

Where applicable law requires a legal basis, we rely on the following:

• Contract — account and usage data necessary to deliver the service you signed up for.
• Legitimate interests — security monitoring, fraud prevention, and service stability, balanced against your rights.
• Consent — opt-in analytics and opt-in crash reporting. You may withdraw consent at any time in the app under Settings → Privacy & data.
• Legal obligation — where we are required to retain or disclose data by law.

5. Data Retention

• Account and profile data — retained for the life of your account. Deleted within 30 days of account deletion.
• Usage and progress data — retained for the life of your account. Deleted within 30 days of account deletion.
• Analytics events — retained for 90 days, then automatically purged.
• Crash reports — retained for 30 days, then automatically purged.
• Session tokens — access tokens expire after 15 minutes; refresh tokens expire after 30 days or on logout.
• Security logs — hashed IP and authentication event logs retained for up to 12 months for fraud and abuse detection.
• Designer content (video files) — retained until the designer deletes the content or their account is deleted.

6. Data Sharing and Disclosure

We do not sell, rent, or trade your personal information. We may share data only in the following limited circumstances:

• Service providers — infrastructure providers (hosting, object storage, transactional email) that process data on our behalf under contractual data-processing obligations. They are not permitted to use your data for their own purposes.
• Legal requirements — if required by a valid court order, warrant, or applicable law, or to protect the rights, property, or safety of Lifestream Dynamics, its users, or the public.
• Business transfer — in the event of a merger, acquisition, or sale of assets, your data may be transferred as part of that transaction. We will notify affected users before data is transferred and a materially different privacy policy applies.

7. Data Security

We implement industry-standard technical and organisational measures to protect your data, including:

• All data in transit is encrypted using TLS 1.2 or higher.
• Passwords are stored as salted cryptographic hashes (bcrypt); we never store plain-text passwords.
• TOTP secrets are encrypted at rest using AES-256-GCM.
• Authentication tokens are stored encrypted on your device using platform secure storage APIs.
• Sensitive screens in the application are protected against screen capture using OS-level secure window flags.
• Access to production systems is restricted to authorised personnel only.

No method of electronic transmission or storage is 100% secure. While we strive to use commercially acceptable means to protect your data, we cannot guarantee absolute security.

8. Your Rights

Depending on your jurisdiction, you may have the following rights regarding your personal data:

• Access — request a copy of the personal data we hold about you. A JSON export is available directly in the app under Settings → Privacy & data → Export my data.
• Rectification — correct inaccurate or incomplete data via your profile settings, or by contacting us.
• Erasure — request deletion of your account and associated data. Submit a request to info@lifestreamdynamics.com.
• Portability — receive your data in a structured, machine-readable format. Use the in-app export feature.
• Restriction — request that we restrict processing of your data in certain circumstances.
• Objection — object to processing based on legitimate interests.
• Withdraw consent — opt out of analytics and crash reporting at any time in Settings → Privacy & data. Withdrawal does not affect the lawfulness of prior processing.

To exercise any right, contact us at info@lifestreamdynamics.com. We will respond within 30 days. We may need to verify your identity before fulfilling a request.

9. Children's Privacy

Lifestream Learn is not directed at children under the age of 13 (or under 16 where applicable law requires a higher age for consent). We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, please contact us at info@lifestreamdynamics.com and we will delete it promptly.

10. Cookies and Tracking

The Lifestream Learn mobile application does not use browser cookies. The web landing page at this domain does not set tracking cookies or load third-party analytics scripts. We do not use cross-site tracking technologies.

11. International Data Transfers

Your data is stored and processed on servers located in Canada. If you access the service from outside Canada, your data may be transferred to and processed in Canada. By using the service, you consent to such transfer. Where required by applicable law, we implement appropriate safeguards for international transfers.

12. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated by updating the effective date at the top of this page and, where practicable, by in-app notification. Continued use of the service after the effective date of a revised policy constitutes acceptance of the updated terms. If you do not agree to a material change, you may delete your account before it takes effect.

13. Contact

For privacy questions, data requests, or complaints, contact us at:
info@lifestreamdynamics.com

If you are located in the European Economic Area and are not satisfied with our response, you have the right to lodge a complaint with your local data protection supervisory authority.