Privacy
and data

1. Controller and contact

The data controller is Aurian, Levels' independent creator and publisher. To exercise a right, report a data issue or ask a question, email levels@lesommet.app.

2. Data we process

• Account: Firebase identifier, email address if you create an account, display name and language.
• Game: daily and Vision goals, history, XP, streak, levels, items, Home, programs, mentor and settings.
• Social features: public mark and display name, accepted relationships, messages, Jousts, Rope Teams, reports and jury reliability.
• Attestations: photos you choose, declared measurement, related contract, votes and verdict. The jury receives a view without your identity.
• Technical: app version, synchronization times, network state, browser, platform and installed or webview mode, push token if notifications are enabled, and logs needed for security and failures. An unhandled exception may automatically send its sanitized message, function, filename without its URL, line and column. The Levels record then stores no UID, email address or full stack.
• Beta feedback: the message you send and optional reply address. Neither the form nor automatic traces add your goals, progress, messages or evidence.
• Optional usage measurement: screen and action events, without the text of your goals. It starts only after you select “Accept”.

3. Purposes and legal grounds

• Providing the account, saving the game, synchronizing devices and operating gameplay: performance of the requested service.
• Preventing duplicate rewards, abuse and progress overwrites, and investigating failures: legitimate interest in securing Levels and player data.
• Push notifications, mentor emails and Google Analytics measurement: your consent. These options can be disabled and Analytics can be refused without losing a feature.
• Answering feedback or a data request: handling your request.

4. AI and personal content

When you request an answer from the Mentor, Voice, Plan or Road, the relevant parts of your game and your text are sent through OpenRouter to the selected model. Every request requires a provider that does not collect data and supports zero data retention (“ZDR”).

If you use server transcription, audio is sent to OpenAI for transcription and then discarded by Levels: Levels does not store it. An attestation photo may be sent to OpenAI when no juror has examined it within the set time, or when a moderator requests pre-analysis. The AI receives only the proof and its contract, never your identity; it decides only clear-cut cases, any doubt goes to a human arbitrator, and a rejection can be appealed to them.

Even so, do not enter secrets, detailed health data, addresses, passwords, faces or identity documents in goals, messages or evidence.

5. Recipients and services

Only Levels and authorized moderation personnel access data when needed. Technical providers are:

• Google Firebase and Google Cloud: authentication, Firestore database, evidence storage, server functions, hosting and notifications.
• Google Analytics: usage measurement only after consent. Levels does not set an account identifier for it.
• OpenRouter and the selected model provider: AI text responses, with data collection denied and ZDR required.
• OpenAI: audio transcription and visual review of an attestation, when no juror has examined it in time or when a moderator requests it.
• Resend: requested letters and technical emails.
• Google Fonts: website font delivery.

Some providers operate outside the European Union. Their contractual transfer mechanisms and safeguards then apply. Levels sends only what the requested feature needs.

6. Retention

• The game and account are kept while the account is in use or until deletion is requested.
• Recovery versions expire after 45 days; dated daily safety snapshots rotate over approximately 15 days.
• Evidence, verdicts, security messages and reports are kept as needed for jury review, disputes, abuse prevention and ranking integrity, then deleted or anonymized when no longer needed.
• Beta feedback and minimal technical traces are kept long enough to fix and follow up on the issue; you may request their deletion.
• Providers may apply different periods to their own technical logs and backups.

7. Local storage and Analytics

Levels uses browser storage and IndexedDB for sign-in, offline recovery, language, preferences and protection against progress loss. These are necessary for the service. Google Analytics is separate and optional: its storage remains denied before you choose. You can change your choice under Settings → Help → Optional usage measurement.

8. Your rights

Depending on your situation, you can request access, correction, erasure, restriction, objection and portability. You may withdraw consent at any time without retroactive effect. Reasonable account verification may be required so your game is not disclosed to someone else.

You may also complain to the CNIL. Sweet Jones' school, whose tone is explicitly adult, remains restricted to people aged 18 or over.