Privacy Policy

Effective date: September 17, 2026 · Last updated: September 17, 2026 · Lowkey Enterprises, Inc.

Introduction

Lowkey Enterprises, Inc. ("LOWKEY," "we," "us," or "our") provides the LOWKEY mobile application and related services (collectively, the "Services"), using a baseline detection algorithm and notification system that passively notices behavioral patterns using objective data you authorize us to collect from your device as a user of the application (a "Subscriber"). When statistical deviations from your established baseline are detected, you receive a notification first. You may optionally designate other connections as recipients through an invite-only and acceptance process (your "Connections") to receive escalation notifications. This Privacy Policy explains how we collect, use, store, and protect your information. This Privacy Policy is incorporated into, and forms part of, our Terms of Service (the "Terms"), which govern your use of the Services. Capitalized terms used but not defined here have the meanings given in the Terms.

Core Principle: Your privacy is a core priority. We collect only what's necessary to detect pattern deviations and send alerts to you. We process sensitive data on your device whenever possible, and we do not sell your personal data. Except as described in this Privacy Policy, no personal information is shared with your connections unless you specifically choose to share it.

Information We Collect

Data You Provide

Account Information: Name, email address, phone number, and date of birth.
Connections Information: Contact information for your chosen connections.
User Preferences: Notification settings, pattern tracking preferences.

How We Differentiate Data (Raw Data vs Summary Metrics vs Insights)

To protect your privacy, LOWKEY distinguishes between high-granularity "raw" signals from your device, daily totals ("Summary Metrics"), and the higher-level context we use to help you and your connections understand meaningful changes ("Contextual Insights"). Metrics are not published in push or email notifications.

Raw Sensor Data: High-frequency heart rate timestamps, raw accelerometer pings, and exact GPS coordinates. We do not share raw sensor data with your connections or any third party.
Summary Metrics: Daily totals such as insights and deviations in number of steps, total hours slept, and number of house exits. You may choose to share certain summary numbers with your connections (where the product offers that control).
Contextual Insights: Percentage changes, baseline deviations, and pattern alerts (for example, "Steps decreased by 30%," your usual step count is 6,000 steps or between 6,000 and 7,000, "Your sleep consistency has increased this week."). This is the primary type of context connections receive to help them check in, without exposing granular data.

Data We Collect Automatically

Health and Activity Data (via Apple HealthKit):

We may collect and analyze any HealthKit data types you authorize (read access, and where applicable write access) to support non-diagnostic baseline detection and to look for patterns that may indicate improvement or decline over time.
Examples include steps, heart rate, active calories, exercise minutes, walking and running distance, flights climbed, sleep and HRV, plus other categories that may be present depending on your devices and connected apps.
This data is aggregated hourly and stored securely.
You control HealthKit permissions through iOS Settings.

Motion Data:

Phone pickup patterns detected through iOS motion sensors.
Used to understand engagement patterns.

Location Pattern Data:

LOWKEY works from locations you define, such as home. When you create one, its coordinates are calculated on your device and sent to our servers, where they are stored with an anonymized label (for example, "Home"). After that, we record only when you enter or leave the locations you defined. We do not collect or store a continuous record of your movements, and we do not know where you go when you are not at one of your own defined locations.
When you are fully away from home for 24 hours or more, that day is treated as a travel day. Your time-at-home data for that day is set aside from your BDS and from your baseline, so a trip does not register as a change in your routine or affect what LOWKEY learns as normal for you. There is no travel, vacation, or illness setting to turn on.
Geofencing Notice: LOWKEY does not use geofencing to identify, track, or advertise around any health care facility or other in-person location. Our geofencing features are used solely for your baseline location-pattern detection, only at your direction and with your consent, and we do not use them for advertising or marketing purposes.

Usage Data:

App interaction patterns, feature usage, alert responses.
Technical data: device model, iOS version, app version (for troubleshooting only).

How We Use Your Information

Pattern Detection: Analyze patterns to detect deviations from your personal baseline.
Notifications: Notify you when pattern deviations are detected. If you have chosen connections, they receive notifications only if you have specified them.
Service Improvement: Improve algorithm accuracy and app functionality.
Research and Development: De-identified data and aggregated population trends may be used to improve and develop the Services, including the accuracy of our baseline detection algorithm. We use health data obtained through Apple HealthKit only to provide and improve health and wellness features of the Services, and, where we conduct medical research, only with your separate consent. We do not use HealthKit data, or any other health data, for advertising or use-based data mining.
Support: Respond to your questions and technical issues.
Safety and Security: Prevent fraud and maintain service security.

Privacy by Design

On-Device Processing:

Location calculations happen entirely on-device.
Only anonymized pattern IDs are transmitted.

Minimal Data Collection:

We collect only what's necessary for the service to work.
No advertising IDs or cross-app tracking.
No device fingerprinting.

Aggregation:

Health data is aggregated hourly, not stored second-by-second, and is stored on our secure servers rather than in iCloud.
Push and SMS notifications to your connections contain only high-level Contextual Insights. Notifications containing metrics reside inside the app.

We Do Not Sell Your Personal Data. We do not sell your personal information, including your name, email, phone number, GPS coordinates, raw health metrics, and any data that identifies you to advertisers, data brokers, insurance companies, or other third parties.

Limited Sharing:

Your connections: Receive only notifications with high-level context when patterns are concerning. They do not see GPS coordinates, or detailed activity logs.
Service Providers: We use trusted third-party services for hosting, notifications and analytics. These providers are bound by strict data protection agreements and cannot use your data for their own purposes.
Legal Requirements: We may disclose information if required by law, court order, or to protect safety in emergency situations.

Business Transfers: In connection with a merger, acquisition, financing, or sale of all or part of our business or assets, your information may be transferred to the successor entity, which will remain bound by protections consistent with this Privacy Policy.

Except as described in this Privacy Policy, we do not share your data with:

Advertisers or marketing companies.
Data brokers.
Insurance companies.
Employers.

Data Security

Encryption:

TLS 1.3 encryption for all data in transit.
AES-256 encryption for data at rest.
Secure authentication with JWT tokens.

Access Controls:

Row-level security ensures you can only access your own data.
Bcrypt password hashing.

Infrastructure:

SOC 2-aligned security architecture (not currently SOC 2 certified).
Automated backups with 7-day retention.

Your Rights and Controls

You have the right to:

Access: View all data we've collected about you.
Export: Download your data in a portable format.
Delete: Permanently remove your account and all associated data.
Data sources: You can change what LOWKEY collects at any time in your iPhone's settings, including turning off individual data sources such as location. Turning off a data source stops that collection and any insight that depends on it. LOWKEY also adjusts automatically when you are away: when you are fully away from home for 24 hours or more, that day is treated as an away day and your time-at-home data for that day is set aside from your BDS and from your baseline.
Control: Adjust what data is collected through iOS permissions and app settings.
Object: Opt out of optional data collection.

To exercise these rights: Email support@lowkeyprotection.com or use in-app settings.

Data Retention

Active accounts: Data is retained while your account is active.
Deleted accounts: All data is permanently deleted within 30 days of account deletion.
Backups: Deleted data is removed from backups within 7 days.

Children's Privacy

The Services are intended for Subscribers 18 and older, consistent with the eligibility requirements in our Terms. We do not knowingly collect information from anyone under 18. If you believe we've collected data from someone under 18, contact us immediately and we will delete it.

Third-Party Services

We use third-party service providers to help operate LOWKEY, including providers that support hosting, authentication, data processing, notifications, email, text messaging, payments, analytics, and customer support. These providers may process personal data only to provide services to LOWKEY and are subject to applicable privacy, confidentiality, security, and data-processing obligations. These services are carefully selected for their security and privacy practices. Personal health information is never sent to Firebase or analytics services.

Vendors included:

Supabase: Secure database and authentication.
Firebase Cloud Messaging: Push notifications.
Apple HealthKit: Health data access (governed by Apple's privacy policies). We use HealthKit data solely to provide and improve the health and wellness features of the Services, consistent with Apple's HealthKit requirements, and we do not share HealthKit data with third parties for advertising or use-based data mining.

Automated Decision-Making

LOWKEY uses baseline detection algorithms to detect pattern deviations from your personal baseline and generate notifications. This baseline detection approach may be referred to as BDS. These algorithms analyze some behavioral and physical data like steps, sleep, location patterns, and phone usage to identify meaningful changes.

Notifications and escalation: Notifications begin with you. A Heads Up notification goes to you and to no one else. For Check In and Be There notifications, you receive the alert first and have a short response window before anything is sent to your Connections. You may let LOWKEY know you are doing well to stop escalation up to three times total for the same continuing alert pattern, whether it remains at Check In, reaches Be There, or moves between the two. Changing levels does not reset the count unless you return to in range. The next qualifying alert is shared with your Connections. If you select "I need a hand," your Connections are notified immediately, including during recipient-local overnight quiet hours.

Not real-time monitoring: The Services are not a real-time safety monitor. Signals may be delayed or incomplete due to data availability, device settings, or other technical factors.

Reliability and Data Availability: Some users will have less available signal (for example, phone-only users or missing HealthKit categories). When signal is limited, our system may suppress or adjust notifications to reduce false alerts. You can provide feedback on notifications directly in the app to improve accuracy for your unique patterns.

Algorithmic transparency (ADMT): Alerts are statistical deviations, not clinical diagnoses. You may adjust sensitivity or opt out of sharing Contextual Insights with connections at any time in Settings.

No solely automated decisions: We do not use solely automated processing to make decisions that produce legal or similarly significant effects concerning you. Our notifications are informational wellness signals only.

California Privacy Rights

For California Residents: Under the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA), California residents have the right to:

Request information about what personal data we collect and how we use it.
Request deletion of your personal data.
Opt out of the sale of personal data (though we do not sell personal data).
Not be discriminated against for exercising these rights.

To exercise these rights, email support@lowkeyprotection.com or use the in-app data controls in Settings.

Other U.S. State Privacy Rights

Depending on where you live, you may have additional rights under your state's privacy law, including Colorado (Colorado Privacy Act), Virginia, Connecticut, Utah, Texas, Oregon, Montana, Florida, Delaware, Iowa, Nebraska, New Hampshire, New Jersey, and other states with comprehensive privacy statutes. Subject to your state's law and applicable exceptions, you may have the right to:

Confirm whether we process your personal data and access that data.
Correct inaccuracies in your personal data.
Delete personal data we have collected about you.
Obtain a portable copy of your personal data.
Opt out of the processing of your personal data for targeted advertising, the sale of personal data, and certain profiling that produces legal or similarly significant effects.
Consent to, or withdraw consent for, our processing of sensitive data (including health data and precise geolocation). Where required, we process sensitive data only with your consent.

Sensitive data and opt-in consent: Certain data we process, such as health information and precise geolocation, is considered "sensitive" under many state laws. Where required, we obtain your consent before collecting or processing sensitive data, and you may withdraw that consent at any time by turning off the relevant data source in your iPhone's privacy settings, or by deleting your account. Your continued use of the Services, and your acceptance of this Privacy Policy or the Terms, do not by themselves constitute consent to process sensitive data or consumer health data; we rely on your separate, affirmative, opt-in consent for those purposes.

Universal opt-out mechanisms: We do not sell personal data or use it for targeted advertising, so there is nothing for a universal opt-out signal such as Global Privacy Control (GPC) to opt you out of. If that ever changes, we will honor recognized opt-out preference signals, including GPC, and update this policy.

How to exercise your rights: Email support@lowkeyprotection.com or use the in-app data controls in Settings. We will respond within the time required by your state's law (generally 45 days, with an extension where permitted). We may need to verify your identity before fulfilling your request. You may use an authorized agent to submit requests where the law permits, subject to verification.

Right to appeal: If we decline to act on your request, you may appeal by emailing support@lowkeyprotection.com with the subject line "Privacy Appeal." We will respond to your appeal within the time required by applicable law. If your appeal is denied, you may contact your state Attorney General to raise concerns.

Consumer Health Data (Washington, Nevada, and Similar Laws)

Because LOWKEY processes information relating to your physical and behavioral health, some of the data we collect may qualify as "consumer health data" under laws such as the Washington My Health My Data Act (MHMDA), Nevada SB 370, and comprehensive state privacy laws. This section supplements the rest of this Privacy Policy for residents of those states.

Depending on your jurisdiction, you may have rights to confirm whether we collect, share, or sell your consumer health data; to access it and receive a list of third parties and affiliates with whom it has been shared; to delete it; to withdraw your consent to its collection or sharing; and to correct inaccuracies. We collect, use, and share consumer health data only with your separate, affirmative, opt-in consent where required, to the extent necessary to provide the Services, or as permitted by law; we do not sell it or use it for advertising.

For the full detail, see our Consumer Health Data Privacy Policy.

Changes to This Policy

We may update this Privacy Policy to reflect service changes or legal requirements. We'll notify you of material changes via email or in-app notification and update the "Effective Date" above. Your continued use of the Services after changes take effect means you accept the updated Privacy Policy.

Contact Us

Questions about this Privacy Policy or our data practices?

Email: support@lowkeyprotection.com

Address: Lowkey Enterprises, Inc., 2525 Arapahoe Ave. Unit E4 #715, Boulder, CO 80302