Who is responsible
Lapsa is made by ZypiqLabs in Karachi, Pakistan. ZypiqLabs decides how your data is used and is responsible for it. Questions about this policy or your data go to zypiqlabs@gmail.com or +92 330 0829563.
What Lapsa collects
Your account
Your name, email address and password. The password is never stored as written: only a bcrypt hash of it is kept. Lapsa also keeps your main currency, time zone, the hour you want reminders, how many days ahead you want them, and whether email and push reminders are on.
What you enter
The subscriptions you add: name, price, currency, billing cycle, dates, free trial end, notice period, category, website, notes, the payment method label you type, and, for a shared plan, how many people share it and your share. Also the charges you mark as paid and the price changes Lapsa records when you edit a price. Please do not type card numbers into the notes or payment method fields: Lapsa never needs them.
Reminders and devices
The reminders Lapsa has raised for you and the announcements it has sent. If you use the mobile app, the push token that Firebase Cloud Messaging issues to that install, the platform, the app's language and its version number. If you create a calendar feed, the secret link that feed answers at.
Activity
When your account was created and when it was last used, so we can count how many people actively use Lapsa. Our servers also log each request (IP address, time, address requested, browser or app version) to keep the service secure and fix faults. These logs are overwritten after a short time, normally within a few weeks.
Usage statistics in the app
The mobile app uses Google Analytics for Firebase to count users and see which parts of the app are used: app opens, screens viewed, sign-ups, sign-ins, and that a subscription was added. These events never include the name, price or any detail of a subscription. Google also records the device model, operating system, app version, an app-instance identifier, and an approximate location (country and city) derived from the IP address. Events are linked to your Lapsa account ID, never to your email. Advertising ID collection is switched off. You can turn usage statistics off in the app under Account › Preferences.
On the website
The website and web app store your sign-in session, language and light or dark theme in your browser's local storage, which they need to work. They set no advertising or tracking cookies and run no analytics.
What Lapsa does not collect
No bank or card login, no access to your bank account, no contacts, no precise location, no photos or files. Lapsa does not sell personal data, share it for advertising, or show ads.
Why it is used
- To run the service: work out renewal and cancellation dates and show your totals.
- To remind you on your phone, by email and by push, at the hour you chose.
- To keep accounts secure: sign-in, password reset codes, abuse prevention.
- To understand, in aggregate, how many people use Lapsa and which features matter.
- To tell you about the service itself, such as a new feature or a change to these terms.
If you are in the European Economic Area or the United Kingdom, the legal bases are the contract with you (running the service and reminders), our legitimate interests (security, aggregate statistics, service announcements), and your consent where the law asks for it.
Who processes it for us
- Hetzner Online GmbH runs the servers that hold the database, in Germany.
- Google (Firebase) delivers push notifications and provides the app's usage statistics.
- Our email delivery provider sends reminder emails and password reset codes.
Each processes data only to provide its service to us. We may also disclose data when the law requires it. Because ZypiqLabs works from Pakistan and Google may process data in other countries, your data can be accessed from outside your own; we rely on these providers' standard contractual safeguards for that.
How long it is kept
Account data is kept for as long as you have an account. When you delete your account it is removed from the live database at once, and the nightly backups that still hold a copy are replaced within 14 days. A push token is deleted when you sign out, delete your account, or when Firebase reports that the app was removed. Server logs are overwritten within weeks. Usage statistics are kept by Google Analytics for at most 14 months.
Your choices and rights
- See and take your data: Account › Export and calendar downloads your subscriptions and payments as spreadsheets, or everything as JSON.
- Correct it: edit your profile and subscriptions at any time.
- Delete it: delete your account in the app or on the web; here is how.
- Fewer messages: turn email or push reminders off, or mute "News and updates" in your phone's notification settings.
- Stop usage statistics: switch them off under Account › Preferences in the app.
You can also ask us by email for access, correction, deletion, restriction or a copy of your data, or object to how it is used. We answer within 30 days. If you are in the EEA or UK you may complain to your data protection authority.
Children
Lapsa is not meant for children under 13, or under the age of digital consent where you live, and we do not knowingly collect their data. If you believe a child has an account, email us and we will delete it.
Security
Everything travels over HTTPS. Passwords are hashed with bcrypt, and sign-in refresh tokens and reset codes are stored only as hashes. Sign-in and reset attempts are rate limited, and backups are checked every night. No system is perfectly secure, but these are the protections in place.
Changes to this policy
When this policy changes, the date at the top changes with it. If a change is significant, we will say so in the app before it applies.