Privacy Policy

01Our approach

This policy applies to the LRM Labs mobile apps — currently Ntervals and Fastn, and any future LRM Labs app — and to this website (together, the "Services").

LRM Labs builds apps that keep your data on your device. Your workouts, fasts, notes, weight entries and settings are stored on the device, not on a server we run. There is no account to create and no sign-in. Most of what you do in an app is simply never visible to us.

This policy explains the limited information that is involved anyway — mainly to process purchases and to answer your emails — and the rights you have over it. It is written to be read; the App Store "privacy label" and the Google Play "Data safety" section for each app summarise the same practices.

02Who is responsible

The organisation responsible for your personal information (the "controller" under the GDPR, and the "business" under California law) is LRM Labs.

Privacy contact: support@lrmlabs.app.

03Categories of information we handle

Across the Services, the categories of personal information that may be involved are:

Identifiers — a random, app-generated identifier used by the subscription provider; your email address if you contact us.
Commercial / transaction information — which subscription or unlock you purchased, and its status (held by the app store and the subscription provider, not by us in a way that identifies you).
Internet or device information — app version, platform and operating-system version, and country, as seen by the app store and the subscription provider during a purchase.
Health and wellness information — the fasting times, weight entries, water intake, workout history and similar data you create in an app. This stays on your device (see “Health and wellness data” below).
Customer records / communications — the content of any support email you send us.

We do not collect precise or approximate geolocation, contacts, photos, biometric identifiers, government IDs, or browsing history across other sites or apps.

04What we do and don’t collect

Data you create in an app

Ntervals: your workouts, timer presets, session history and streaks. Fastn: your fasts, chosen protocol, streaks, and any optional weight and water entries and notes. This data is stored only on your device. We cannot see it and it is not sent to us. The apps do not read from or write to Apple Health or Google Fit.

Purchase and subscription data

When you buy a subscription or an unlock, our subscription provider (RevenueCat) processes a random app-user identifier, the purchase receipt from Apple or Google, your platform and app version, and your country. This lets the app unlock paid features and restore purchases on a new device. We see subscription status, never your name or payment card. Payment is handled entirely by Apple or Google.

Support correspondence

If you email us or use the contact form (which opens your own email app), we receive your message, your email address and whatever you choose to include. We use it only to help you and to keep a record of the exchange.

Notifications

If you enable notifications, they are scheduled and shown by your device. We do not operate a push server and do not send you notifications remotely. You can turn them off in your device settings at any time.

Research feed in Fastn

Fastn’s Discover tab can show recently published fasting studies. To load them, the app asks PubMed — a public database run by the U.S. National Library of Medicine (NIH) — for recent publications on a fixed set of fasting topics. The request contains nothing about you or the data you keep in the app, and nothing is sent to LRM Labs. As with any internet request, PubMed’s servers see your IP address, under their own privacy policy. Opening a study takes you to PubMed in your browser. Without a connection the feed is simply empty, and the rest of the app works as usual.

Diagnostics

We do not embed a third-party analytics or crash-reporting SDK in the apps. If your device sends Apple or Google aggregated, non-identifying crash and performance reports, that happens under your operating-system settings and their policies, and we only ever see anonymised summaries in the developer console. There is no advertising SDK.

Artificial intelligence

No current LRM Labs app uses artificial intelligence or sends your data to an AI service. If a future app or feature does, we will disclose it in the app and update this policy to explain what is processed, by whom, and your choices.

05How we use information, and our legal bases

We use the limited information described above only to:

provide the apps, unlock features you have paid for, and restore purchases;
respond to your support requests and feedback;
keep the Services secure and detect and prevent fraud or abuse;
comply with legal obligations.

Where the EU or UK GDPR applies, our legal bases are: performance of a contract (providing the app and processing your purchase); our legitimate interests (keeping the Services secure, answering support, understanding aggregate stability); consent (where asked, for example an optional notification permission granted at the operating-system level, which you may withdraw at any time); and compliance with legal obligations.

We do not use your information for advertising, we do not build advertising or behavioural profiles, and we do not sell or rent personal information.

We share personal information only in these limited ways:

Service providers acting on our instructions: RevenueCat (subscription management) and our email provider (support correspondence). They may process the data only to provide their service to us, under contract.
App stores: Apple and Google act as the sellers of subscriptions and process the payment; they are independent controllers of the data they collect, under their own privacy policies.
Legal reasons: to comply with applicable law, legal process or a government request; or where we believe in good faith it is necessary to protect the rights, safety or property of users, the public or LRM Labs, or to investigate fraud.
Business transfer: if LRM Labs is ever involved in a merger, acquisition, financing or sale of assets, information may transfer as part of that transaction, subject to this policy.

We do not sell personal information, and we do not "share" it for cross-context behavioural advertising, as those terms are defined under California law. We have not done so in the preceding 12 months and have no plans to. Where required, we honour opt-out preference signals such as the Global Privacy Control.

07International data transfers

LRM Labs’ service providers may store and process data outside your country, primarily in the United States: RevenueCat (subscription status tied to a random identifier), and Apple and Google (payments and app distribution).

For transfers from the European Economic Area, the United Kingdom or Switzerland to countries without an adequacy decision, our providers rely on the EU–U.S. Data Privacy Framework (and its UK and Swiss extensions), Standard Contractual Clauses, or equivalent safeguards. By using the Services you understand that your subscription metadata and random identifier may be processed in those countries, whose data-protection laws may differ from your own.

08How long we keep information

On-device app data: kept until you delete it or uninstall the app. We hold no copy. Both apps also have an in-app reset that wipes local data (and any local backup file) immediately.
Subscription records at RevenueCat: kept while your subscription is active and for a limited period afterwards — up to around 7 years — for accounting, tax, fraud-prevention and dispute purposes.
App store transaction records: retained by Apple and Google under their own policies, typically about 7 years for tax purposes.
Support emails: kept for up to 24 months after the matter is resolved, then deleted, unless a longer period is needed for a legal claim.

09Security and breach notification

Keeping data on your device removes whole categories of risk. For the limited data that does leave your device, we use reputable providers, encryption in transit, access controls, and the principle of least privilege. No method of transmission or storage is completely secure, but we maintain reasonable safeguards appropriate to the low sensitivity and small volume of information involved.

If a security incident affecting your personal information occurs, we will notify you and any regulator or authority as, and within the time, applicable law requires.

10Children

The Services are not directed to children under 13, and we do not knowingly collect personal information from them (in line with the U.S. Children’s Online Privacy Protection Act and comparable laws). Fastn is not for anyone under 18. If you are a parent or guardian and believe your child has provided us with personal information, contact us and we will delete it.

11Health and wellness data

The fasting times, weight, water intake and workout history you record are health-related and may count as sensitive personal information under some laws. This data is created and stored on your device only. We do not receive it, we never sell or share it, and we do not use or disclose it for any purpose that would give rise to a right to limit its use under the CPRA. Any backup you make is exported by you to your own cloud storage; the apps never send this data to LRM Labs.

12Your privacy rights

EEA, UK and Switzerland (GDPR)

You have the right to access, rectify, erase, restrict or object to the processing of your personal information, to data portability (the apps provide this directly through their export feature), and to withdraw consent at any time without affecting prior processing. You may lodge a complaint with your local supervisory authority; a list of EEA authorities is at edpb.europa.eu.

California (CCPA / CPRA)

You have the right to know what personal information we collect and how we use and disclose it, to request deletion, to request correction, to opt out of the sale or sharing of personal information, to limit the use of sensitive personal information, and to not be discriminated against for exercising these rights. As stated above, we do not sell or share personal information, and we do not use sensitive personal information for purposes that trigger the right to limit. Under California’s "Shine the Light" law we also do not disclose personal information to third parties for their own direct-marketing use.

Other US states

Residents of states with comparable privacy laws (including Virginia, Colorado, Connecticut, Utah, Texas, Oregon and others) have similar rights to access, correct, delete and obtain a copy of their personal information, and to opt out of targeted advertising, sale and certain profiling. We honour these on the same basis.

How to exercise your rights

Email support@lrmlabs.app. We will verify your request, usually by confirming the email address associated with your correspondence or subscription, and respond within the time your law allows — within 30 days under the GDPR and within 45 days under California law, each extendable where permitted. There is no charge for a reasonable request. You may also use an authorised agent where the law allows.

13Automated decision-making and profiling

We do not carry out automated decision-making, including profiling, that produces legal effects concerning you or similarly significantly affects you.

14App store disclosures and tracking

Account and data deletion

There is no account to delete. Deleting an app removes all of that app’s data from your device; each app also has an in-app reset. To ask about anything held by RevenueCat against your random identifier, or in our support inbox, contact us and we will action it within the time your law allows.

Data-safety forms

The Apple "privacy nutrition label" and the Google Play "Data safety" section for each app reflect this policy. Where their fixed wording and this policy differ, this policy governs and we will correct the listing.

App Tracking Transparency

We do not track you across other companies’ apps or websites. The apps do not use the AppTrackingTransparency permission and do not access the advertising identifier (IDFA / Advertising ID).

15This website

This website is a set of information pages. It sets no advertising or tracking cookies and loads no third-party analytics. The only value stored in your browser is a small preference that remembers your light/dark theme choice. Because we avoid non-essential cookies, there is no cookie banner, and there is no cross-site tracking for a "Do Not Track" signal to affect.

The contact form on the support page does not send data to us or to any server. It assembles a message and opens it in your own email application, which you then choose to send. Links to third-party sites (such as the App Store or Google Play) are governed by those parties’ own privacy policies.

16Changes to this policy, and your consent

We will update this policy when our practices or the law change. Material changes will be signalled in the app or on this page, with the date below updated; where the law requires, we will seek your consent. By using the Services you consent to the processing of your information as described here, as amended from time to time.

17How to contact us

Privacy questions and rights requests: support@lrmlabs.app.