Privacy Notice

Version 1.23 · Last updated October 29, 2026

This notice explains how Levra handles personal data in everything it runs: the web app at www.levra.ch/app, this website including the waitlist, the Levra iOS app and its Share Extension, and the Levra Chrome extension. It follows the Swiss Federal Act on Data Protection (FADP, SR 235.1), its Ordinance (DPO, SR 235.11) and, for storage on your device, Art. 45c of the Telecommunications Act (TCA, SR 784.10). The waitlist and the Chrome extension also have short notices of their own; they describe the same processing as this one.

1. Who is responsible

Levra (Einzelunternehmen von Tarek Wady)
Solothurn, Switzerland
hello@levra.ch

Write to this address about anything in this notice. We have not appointed a data protection advisor (Art. 10 FADP).

2. What we collect, why, and how long we keep it

Your account

What you put into Levra

• notes: title, text, voice transcripts and the AI-written title and summary (section 3);
• photos, voice recordings and videos. Photos you add in the web app or take for a note are converted before upload, which removes information embedded in the file. Videos, animated GIFs, photos the web app cannot convert, and photos you share into Levra from another iOS app, are stored as they arrive — including embedded information such as the place they were taken, if the file contains it. For videos we also store the file name, length and size, plus a still image and a short preview loop your browser makes from the video. When you drag or paste a picture or video from a web page, we also store the address it came from;
• PDFs you add to a canvas, with the text printed in them, which your browser reads out page by page so it can be searched. The text is deleted with the file;
• references: the link you save, and the title, description, site name, author and preview image we fetch from that page; for an ordinary website, a picture of the page (section 4);
• canvases and how you arranged them; the names of your workspaces, projects, folders and canvases; and, where you record them, the reasons for creative decisions.

Why: this is the product. We store it, show it to you, and show it to the people you work with in Levra.

Kept: until you delete it, or until you delete your account (section 6). In the web app, deleting a reference, canvas or folder first moves it to the trash: for 30 days anyone who could have deleted it can restore it, and sees who deleted it and when; then it is erased. "Delete forever" in the trash erases it at once. The stored file of an erased item is removed the next time the person who uploaded it opens the web app. Notes, and anything you delete in the iOS app, are deleted at once, without a trash.

Who can see it: you, and the members of the workspace and project it is in, according to the roles and project access that the workspace's administrators set. Anyone who can see content can also download it with the export in section 6. You always keep access to the references you saved yourself, even after you leave a workspace or project. Your folders are yours alone: nobody else sees them, their names, or what you filed in them. While a canvas is open, the other people on it see your display name, your cursor and your changes as you make them; we keep a short-lived copy of recent changes, deleted after an hour, so their screens can catch up.

Nothing in Levra is published to the open internet, with one exception: the preview image we fetch for a reference is kept in a public store under an unlisted, unguessable web address that does not identify you. Anyone who has that exact address can open the image. It is removed by our periodic clean-up after the reference is erased, and at once when you delete your account — unless the reference stays with a workspace (section 6).

Invitations

When a Levra member invites you, we store your email address, the workspace and its name, the role you are offered, and who invited you, so that we can show you the invitation and the workspace has a record of it. To limit abuse we also keep a keyed pseudonym of your address (not the address itself) for two days.

We send you one invitation email through our email provider, Resend (section 4). It names the workspace, the person who invited you, the role you are offered and, if they wrote one, their note to you; we do not keep the note ourselves. No Levra account is created for you: if you do not have one, you create it yourself with the invited address, and the invitation waits for you in the app. The workspace's owners and administrators see your address and whether you have answered, and can resend or withdraw the invitation. We process your address without your involvement because a member asked us to invite you; you can decline, and ask us to delete everything, at any time.

Kept: an unanswered invitation expires after 14 days. The invitation record is deleted 90 days after it was accepted, declined or expired.

Plans and payments

Every account has a plan (section 3 of the terms). For it we store: your plan and, for Pro, the subscription's status, period, renewal date and whether it is cancelled; any free period of Pro you were given; how much of your AI usage you have used, as one entry per AI request (which feature, how much it used, when); whether extra usage is on, your prepaid balance, what you bought and what you spent; and Stripe's identifiers for you as a customer and for your subscription.

When you buy, you pay on Stripe's own page, not in Levra. Stripe receives your email address and our identifier for your account, and collects your name, payment details, billing country and, where you give one, your tax number and billing address. We never see your full card number. Stripe tells us what you bought, whether a payment succeeded, and the amounts.

Free months. So that each person has one free first month (terms 3.8), when one starts we keep a one-way fingerprint (a SHA-256 hash) of your email address, written without capitals or a "+" tag, and of the card's fingerprint that Stripe gives us. We cannot turn either back into your address or your card; we can only tell whether the same one comes back. These are kept after you delete your account, without your account identifier, because their only purpose is to recognise a second free month (our legitimate interest in preventing abuse, Art. 6(1)(f) GDPR).

Why: to provide the plan you chose, to keep AI usage within it, to charge you, and to keep the accounts the law requires. Kept: the plan and usage entries for the life of the account. Invoices and payment records are accounting records: we and Stripe keep them for 10 years (Art. 958f of the Code of Obligations), also after you delete your account.

Invitation links

If you share your invitation link, we store the link's code and, for each person who joins through it or through a workspace invitation, who invited whom, when, whether the new member has started their free month or paid for the first time, and the reward that followed. When someone opens your link and enters their email address before creating an account, we keep that address with the link so the sign-up lets them in. Kept: the link and who invited whom, for the life of the accounts concerned; an address entered through a link, until the account is created with it, and at most 30 days.

Applications

If you apply for access, you create an account first (see “Your account”) and put references with notes on one canvas. When you send it, we store the time and the status of your application, and the canvas and its references can be seen by the Levra team who decides. We send you an email when it arrives and one with the decision, written by us or a standard one. If you tick “send me levra updates” when you apply, we record which consent text you agreed to; you can withdraw it at any time (Art. 6(1)(a) GDPR). Kept: while you apply, the account and the canvas are yours as described above; if we accept you, they simply become a normal account; if we decline, the account, the canvas and everything on it are deleted 30 days after the decision, or sooner if you delete the account yourself.

Waitlist

If you join the waitlist we store your email address, a one-time confirmation code (only as a hash), the time you signed up and confirmed, and the status of your entry. We use them to confirm your address and to let you in. When we let you in, your address goes on the list of addresses that may create an account, and we send you one email saying so. If you tick "send me levra updates" when you join, you also get occasional Levra emails: we record which consent text you agreed to and when, send updates only after you confirmed your address with our link (double opt-in), and put an unsubscribe link in every one. Unsubscribing keeps your place on the waitlist. The legal basis for the updates is your consent (Art. 6(1)(a) GDPR); you can withdraw it at any time. Details are in the waitlist notice. Instead of your IP address we store a salted one-way hash of it for at most two days, so one person cannot submit the form a thousand times. The spam check on the form is Cloudflare Turnstile, which loads when you open the waitlist page (section 4).

Kept:

• the confirmation code is voided when it expires, 24 hours after we send it;
• an address that is never confirmed is deleted 90 days after sign-up;
• a declined entry is deleted 30 days after sign-up, or right away if we decline it later than that;
• once you have been let in, the entry is deleted 12 months after you confirmed your address;
• a confirmed address waiting for access is kept until we let you in, or until you ask us to remove it;
• your address stays on the list of addresses that may create an account until you delete your Levra account, or until you ask us to remove it.

Product analytics

In the web app, only if you say yes. Levra asks once, with a cookie banner. One answer covers the public pages and the web app on that browser; once you are signed in, it is kept with your account, so you are not asked again on another device. Until you answer, and if you answer no, the web app loads no analytics, stores nothing for it on your device and sends nothing — product analytics and session replay below start only after a yes.

We record how Levra is used: pages viewed, clicks, and events such as "canvas created" or "reference added", together with your account identifier (a random ID, not your email or name), the identifiers of the workspace and canvas you are in, your IP address, your browser and device type, and the version of the app. The iOS app records only such events — no screens and no clicks.

We do not send your content. The web app masks all text and element attributes before a click is recorded, so canvas names, reference titles and teammates' addresses never become part of an analytics event. Errors: if the web app runs into an error or crashes, we record the technical error message and where in the code it happened. Before it leaves your browser we remove email addresses, quoted values and the query part of web addresses from the message, but it may occasionally still contain a fragment of your content, such as a canvas name. If the iOS app crashes, it sends a crash report with the same kind of information the next time you open it. We use errors and crash reports only to fix them.

Session replay. If you said yes, we record how a session moves in the web app, on its sign-in page and on the public pages of levra.ch: where the boxes of the page are, where you move the pointer, what you click and scroll, and how long pages and requests take (the address without anything after the “?”). Every word on the screen is replaced by asterisks before it leaves your browser, what you type is never recorded, and pictures, videos, previews and drawings are replaced by grey boxes — so a recording shows the layout of Levra, never your canvases, references, notes or anyone's name or address. A recording made before you sign in carries a random identifier; once you sign in on that browser it is linked to your account identifier. Nothing is recorded before you say yes, and nothing in the iOS app. We watch recordings, and may let PostHog's AI features go through them, only to find where Levra is confusing or broken. Turning analytics off stops recording too. Kept: 30 days.

AI and connected assistants. When an AI feature runs (a summary of a phone note, a code card, a drawing turned into a picture or a 3D scene) or an assistant such as Claude reads Levra through its connection, our servers tell PostHog which feature or tool it was, which AI model answered, how many tokens it used, how long it took and whether it failed. Never what you asked, what the AI answered, or what the assistant searched for or read. If you said yes to analytics, the AI records also carry your account and the workspace and canvas you used, so we can see what AI costs per account; without that yes they carry no account identifier, and assistant records never do.

Purchases. When a plan or extra usage is bought, our servers tell PostHog what was bought, for how much and whether it started with free time. Never your payment details, billing address or invoices. With your yes to analytics this record carries your account; without it, none.

You can change your answer at any time in Settings → Preferences → product analytics in the web app (or, before you have an account, by deleting this site's data in your browser, after which the banner asks again); turning it off stops collection on that browser and deletes what PostHog stored there. In the iOS app, analytics is on until you turn it off on the account screen. One gap, stated plainly: the switch on iOS does not yet reach the Share Extension. Saving something through the share sheet still records one event — your account identifier and whether you saved an image, a video or a link.

Kept: 12 months.

Website analytics

On the public pages of levra.ch — the home page, the waitlist and the page for ETH students (/eth) — we count visits without cookies. We record the page, where you came from (the referring website and any campaign tag in the link), the clicks you make on the page together with the text of what you clicked (never what you type into a form, such as your email address on /eth), your browser, operating system and device type, and two events: that the waitlist form was sent and that an address was confirmed — never the address itself. Nothing is stored on your device for this.

To tell visitors apart without a cookie, PostHog computes a one-way hash on its servers from your IP address, your browser's identification string and a random value that changes every day, and then discards the IP address. The same person is therefore counted as a new visitor each day, and we cannot recognise you or link a visit to an account or a waitlist entry. This is how these pages count until you answer the cookie banner, and after a no.

If you accept the cookie banner, PostHog keeps a random identifier for this browser in a cookie and in browser storage (ph_…, see section 7), the same visit data is recorded against it, and the visit is recorded as a session replay, masked exactly as described under "Session replay" above. If you later sign in to Levra on the same browser, these visits are linked to your account identifier.

Kept: 12 months.

Server logs

Our hosting and database providers record the usual technical data of each request — IP address, time, address requested, status and browser type — to run the service and defend it against abuse. Kept: at most 7 days.

Messages to us

If you write to us, we use your message and address only to answer you, and keep them as long as the matter requires.

When you delete your account

We keep a record that a deletion happened: the account identifier, your email address, the number of files removed and the date. Your email address is erased from it after 12 months. We keep the rest permanently, because it is our only proof that we did what you asked.

3. Artificial intelligence

Levra uses AI in two places: titles for voice notes on iOS, and the AI actions on a canvas in the web app. Nothing is sent to an AI service unless you start it. Separately, you can let an AI assistant of your own use your Levra (below).

Voice notes (iOS). When you save a voice note and have allowed it, Levra writes a title, a summary and tags for it. A photo note gets a stock title on your phone.

• Speech recognition runs on your device. Your audio recording never leaves your phone for this. If your device has no on-device speech model for your language, the note is not transcribed — we never fall back to a server.
• The title and summary are written by an AI service in the United States. We send it the transcript of the voice note only — never the recording, and never a photo. Our contracting partner is Anthropic Ireland, Limited; the request is processed by Anthropic, PBC in the United States. Anthropic may not use it to train AI models. It deletes the data within 30 days, unless a request is flagged for violating its usage policy, in which case it may keep it for up to two years.
• Your choice: the app asks you once, before the first voice note that would be sent, whether it may write titles with this service. Nothing is sent until you allow it, and you can withdraw the permission at any time under account → ai titles for voice notes. Without it, the title is the first sentence of the transcript, made on your phone. Text notes, photo notes, references and videos never reach an AI service, unless you send words from them yourself with fix spelling (below).

AI on a canvas (web app). These run only when you press the button or send the request yourself, one request at a time:

• Writing or changing code. When you describe what a code card should be, we send the card's current code, what you typed and any reference pictures you added to that request (at most four, made smaller first) to Anthropic. It sends back the new code, which replaces the old one; you can undo it. Our contracting partner is Anthropic Ireland, Limited; the request is processed by Anthropic, PBC in the United States, on the same terms as voice note titles above: no training on it, deleted within 30 days unless flagged for violating its usage policy, then kept for up to two years.
• Turning a drawing into 3D. The drawing is sent as a picture, with the short hint you may add, to Anthropic on the same terms. Anthropic writes code for an interactive 3D model, which appears beside the drawing as a new code card.
• Improving a drawing. The drawing is sent as a picture, with the short hint you may add, to Google's Gemini service (Google Cloud EMEA Limited, Ireland, with Google LLC, USA). It returns a cleaner picture, which appears beside the drawing as a new photo; the drawing itself is not changed. We use Gemini only on Google's paid terms, under which Google does not use what we send to train or improve its products. Google keeps it for a limited time to detect abuse and then deletes it.
• Fixing spelling. When you select words in a document, on a PDF's page or in a note and press fix spelling, only the words you selected are sent to Anthropic, on the same terms. They come back corrected and replace your selection; you can undo it. We do not keep the words, and these requests are not part of the results that learn what you keep, below.

Results that learn what you keep. For each of these requests we keep, for your account only: what you typed, which AI model answered, whether it worked, and what you then did with the result (deleted or undid it, asked again, or built on it; anything else counts as kept). Your next requests send a short summary of this along to the same provider (the wording of a few earlier requests and whether you kept their result), so results lean toward what you keep and you need fewer tries. Nobody else in your workspace sees these entries; we look at them only as totals, such as how often results are kept, never at what you typed. They are deleted after 12 months or with your account, and they are part of your data export (section 6). The drawing, the code and the pictures you sent are not kept beyond the result you see on the canvas, which is saved like anything else you put there. We also keep a count of requests per account, deleted after two days, to limit how many can be made. Whatever you put in a request goes to the provider: leave out anything you do not want to share with it.

AI assistants you connect. You can connect an AI assistant you use, such as Claude, to your Levra account. Nothing is connected unless you allow it on Levra's own consent page. Once connected, the assistant can search and read, as you, the canvases, documents, PDF text, notes and references you can open in workspaces that allow AI assistants, and add new canvases, notes, documents, saved links and pictures there where you can edit (a picture it saves is a copy kept in your Levra storage), and change the text of documents and sticky notes and add to a reference's note there; what it adds or changes is yours, like anything you write yourself. It cannot delete or share anything. What it reads goes to that assistant's provider under your own agreement with that provider, not ours: Levra sends nothing there on its own, and the provider's terms decide how it is kept and used. AI assistants are allowed in a workspace until one of its owners or admins switches them off under workspace settings → general → ai assistants; from then on, no member's assistant can read or add to that workspace. You can disconnect an assistant at any time under account → connected assistants, which ends its access at once.

Levra makes no decisions about you based solely on automated processing (Art. 21 FADP).

4. Who receives data

We do not sell your data and do not use it for advertising. Apart from the people you work with in Levra (section 2) and authorities where the law obliges us, only the service providers below receive it. They process it on our behalf, for the purposes in this notice.

Payments. Stripe also uses payment data as its own controller, under its own privacy policy, to prevent fraud and to meet its legal duties as a payment provider, for example anti-money-laundering checks. Its payment page sets its own cookies on Stripe's domain for this.

Sign in with Google. If you use it, Google (Google Ireland Limited / Google LLC, USA) handles the sign-in as its own controller under its own privacy policy, and tells us your Google identifier, name, email address and profile picture.

Apple distributes the iOS app. The app sends no Levra data to Apple.

Saving a link. Our server — not your browser — opens the page you saved to read its title and preview image; that site sees a request from our server, not from you. For YouTube, TikTok and X links our server asks that platform (Google, TikTok, X) for the title and preview and sends it the link, but nothing about you. Where we could not copy a preview image, Levra shows it from the site that hosts it: whenever that reference is displayed, your browser loads the image from there, which tells that site — wherever in the world it is — your IP address and browser type, as visiting it would.

Pictures of websites. A reference to an ordinary website is shown as a picture of the page. We do not take that picture ourselves: when the web app shows a website reference that has no picture yet, our server sends the saved address to Microlink, which loads the page in its own browser and returns the image; we then store it with the reference. Microlink receives the web address and nothing else — not your name, your account or your IP address. Links to social platforms are never sent. We use Microlink's free service and have no contract with Microlink yet; until we do, it is not bound by a data processing agreement with us.

Playing a video reference. A reference saved from a YouTube link shows as a still picture, and the player is not loaded until you press play. When you do, the video is loaded from Google's youtube-nocookie.com player inside Levra: from that moment Google (Google Ireland Limited / Google LLC, USA) sees your IP address, your browser and which video you played, as its own controller under its own terms. Nothing plays by itself, and you can open the video on youtube.com instead. A TikTok reference works the same way: when you press play, the video loads in TikTok's own player from tiktok.com, and TikTok (TikTok Technology Limited, Ireland) sees your IP address, your browser and which video you played, under its own terms. Levra never downloads or copies the video. A reference saved from an X post shows the post's words and picture in Levra's own design; nothing of X's is loaded to show it. A video in it plays only when you press play: it then streams from X's video servers (video.twimg.com), and X (X Corp., USA, and Twitter International Unlimited Company, Ireland) sees your IP address, your browser and which video you played, under its own terms. Levra never downloads or copies the video.

Previewing code. A code card or code block can show a live preview of the code in it. When that code uses a software package Levra does not include, your browser loads the package from esm.sh, a public service that hosts open-source packages. esm.sh then sees your IP address, your browser type and the names of the packages — never the code itself, your name or your account. The preview runs walled off from the rest of Levra and can reach no other site.

Countries outside Switzerland. Switzerland recognises the EU and the EEA as providing adequate data protection, and the USA for companies certified under the Swiss–U.S. Data Privacy Framework (Annex 1 DPO). Singapore and uncertified US companies are not on that list; for them, the transfer is based on the standard contractual clauses of the European Commission as recognised by the Federal Data Protection and Information Commissioner, with the adaptations Swiss law requires (Art. 16(2)(d) FADP). The table says which safeguard applies to whom.

5. Why we are allowed to do this

Swiss law does not require your consent for the processing described here. We process personal data to provide the service you use and to keep it secure and working, within the principles of Art. 6 FADP: only what we need, only for the purposes named above, and only for as long as stated. Where we do ask for your consent — the permission prompts for the microphone, camera or photos on your phone, for instance, or the yes to product analytics and session replay in the web app — you can withdraw it at any time.

6. Your rights

You can, free of charge:

• Find out what we hold about you (Art. 25 FADP). We answer within 30 days.
• Get a copy to take with you (Art. 28 FADP). Settings → Account → download my data in the web app gives you a machine-readable file with your account and the content you can access in Levra, including links to the files. The iOS app has no export — sign in to the web app to use it.
• Have wrong data corrected (Art. 32 FADP). Your display name can be changed in Settings; for anything else, write to us.
• Object to a processing, or have data deleted (Art. 30 and 32 FADP). Write to us and say which.
• Delete your account: Settings → Account → delete account in the web app, or "delete account" on the account screen of the iOS app. It is immediate and cannot be undone.
• Withdraw a consent you gave, and turn off product analytics in Settings.

What deleting your account removes: your account, profile and sessions; your folders; every workspace nobody else is a member of, your private projects, and shared projects nobody else has access to, with everything in them; and your files, except those kept below. What stays: notes, references, canvases and files you created in a project other people can open, which stay there for them, no longer linked to you; workspaces and projects you created that have other members (if you were the last owner, ownership passes to an administrator or, failing that, to the longest-standing full member); entries you made in other people's work, without your name; the free-month fingerprints described in section 2; preview clips that a teammate made from one of your videos, which are stored in their account until they delete them or you ask us to; the deletion record described in section 2; invoices and payment records, which we and Stripe must keep for 10 years (section 2, "Plans and payments"); and analytics events, which are not deleted automatically — they expire after 12 months, or we delete them sooner if you ask. Our database provider keeps backup copies, where it keeps any, for at most 7 days.

Write to hello@levra.ch. Before we act, we may ask you to confirm the request from the email address it concerns, so that nobody else can obtain or delete your data.

If you think we are not handling your data lawfully, you can also turn to the Federal Data Protection and Information Commissioner (FDPIC), Feldeggweg 1, 3003 Bern, www.edoeb.admin.ch, or enforce your rights in the civil courts.

7. Storage on your device (Art. 45c TCA)

Levra stores a little data in your browser. You can delete it at any time in your browser's settings; deleting the sign-in entry signs you out.

The Chrome extension keeps your sign-in in its own storage. The iOS app keeps your sign-in, your settings, and the analytics identifier and switch on your device.

The public pages of levra.ch (the home page, the waitlist and /eth) store nothing in your browser for analytics unless you accept the cookie banner; see "Website analytics" in section 2.

We use no advertising cookies and no cross-site tracking.

8. How we protect your data

Access to every row of data is enforced by the database itself, not by application code: you reach content only through the workspaces and projects you have access to, or because you created it. Data travels encrypted (TLS). Uploaded files sit in a private store and are served through signed links that expire after at most 7 days. Our server functions are rate-limited.

Levra accounts do not offer two-step verification yet. If you sign in with Google, your Google account's protection applies. If a breach of data security is likely to put you at high risk, we inform the FDPIC and, where needed, you (Art. 24 FADP).

9. Changes

We update this notice when what Levra does changes. The date at the top shows the version you are reading. If a change affects you significantly, we tell you in the app or by email before it takes effect.