Legal

Privacy Policy

Effective 2 September 2026. Last updated 2 September 2026. Version 2.0.

1. Scope and application

1.1 This Privacy Policy (the “Policy”) governs the processing of personal data in connection with the website published at izzylifeapp.com and its subdomains (the “Site”), operated by IzzyLifeApp (“we”, “us” or “our”).

1.2 The Site is an informational publication. It describes our company and the applications we are developing. It provides no accounts, no registration, no login, no payment facility, no newsletter, no comment facility, no upload facility and no form of any kind.

1.3 This Policy does not apply to the applications IzzySpells or IzzySteps. Those are separate software products which, when released, will process data on your device and will each publish a separate privacy policy addressing that processing. Nothing in this Policy describes, limits or authorises the behaviour of either application.

1.4 This Policy does not apply to any third-party website reached by following a link from the Site. See section 15.

2. Definitions

2.1 In this Policy, the following terms have the meanings given below. Terms defined in the GDPR and not defined here carry their GDPR meaning.

“Personal data”

Any information relating to an identified or identifiable natural person, as defined in Article 4(1) of the GDPR.

“Processing”

Any operation performed on personal data, as defined in Article 4(2) of the GDPR, including collection, storage, use, disclosure and erasure.

“Controller”

The party that determines the purposes and means of processing, as defined in Article 4(7) of the GDPR. For the processing described in this Policy, the controller is identified in section 3.

“Processor”

A party that processes personal data on the controller's behalf, as defined in Article 4(8) of the GDPR.

“GDPR”

Regulation (EU) 2016/679 (the General Data Protection Regulation) and, where applicable, the UK GDPR as incorporated into the law of the United Kingdom by the European Union (Withdrawal) Act 2018.

“CCPA”

The California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act of 2020 (the “CPRA”).

3. Identity and contact details of the controller

3.1 The controller responsible for the processing described in this Policy is:

Controller

IzzyLifeApp

Location

Florida, United States of America

Contact for all privacy matters

admin@izzylifeapp.com

3.2 No Data Protection Officer has been appointed. Our processing does not meet any of the conditions in Article 37(1) of the GDPR that would require one. Enquiries should be directed to the address above, which is monitored by the controller.

4. Personal data we do not collect

4.1 The Site does not collect personal data from you directly. This is a consequence of how it is built rather than a policy commitment alone: there is no input field, no form control and no submission endpoint anywhere on the Site into which personal data could be entered.

4.2 Specifically, and without limitation, we do not:

• operate user accounts, profiles, logins or authentication;
• request or store your name, postal address or telephone number;
• request or store payment card or financial information;
• operate a mailing list, newsletter or marketing list;
• create, purchase, enrich or maintain any profile, segment or audience relating to you;
• use automated decision-making or profiling within the meaning of Article 22 of the GDPR;
• process any special category data within the meaning of Article 9 of the GDPR; or
• sell, rent, license or otherwise trade personal data.

4.3 The Site enforces a Content Security Policy that restricts scripts and network connections to its own origin. No third-party analytics, advertising or tracking code can execute on the Site, and no outbound data connection to any third party can be initiated by it. The single exception is the loading of typeface files, which is disclosed in section 5.3.

5. Personal data processed when you visit

5.1 Although we collect nothing from you directly, delivering a web page involves processing that is technically unavoidable. This section describes it in full.

5.2 Server request data

Serving a page requires a web server to receive and answer a request. Our hosting provider necessarily processes the information contained in that request, which typically comprises the originating IP address, the resource requested, the date and time of the request, the HTTP status returned, and the user agent string sent by your browser. This is processed by the provider for the purposes of delivering the page, maintaining service availability, and protecting the service against abuse. We do not use this information to identify you, do not analyse it for any commercial purpose, and do not combine it with any other source. The provider may set a strictly necessary technical cookie for the same operational purposes; see section 6.2.

5.3 Embedded typefaces

The Site loads two typeface families from Google's font services at fonts.googleapis.com and fonts.gstatic.com. When your browser requests those files, it connects directly to Google's servers, and that connection necessarily discloses your IP address and user agent to Google. We do not control, receive or have access to that data. Google's handling of it is governed by Google's own privacy policy and not by this Policy.

We consider this the only third-party data flow arising from your visit to the Site, and we disclose it because it is one — notwithstanding that we obtain nothing from it and that its purpose is purely typographic. If you wish to avoid it, blocking requests to those two hostnames will prevent the fonts from loading; the Site is designed to remain fully legible and fully functional without them.

6. Cookies, analytics and advertising

6.1 The Site sets no cookies of its own. It operates no analytics of any kind, including but not limited to visitor counters, session recording, heat mapping, tag management and conversion tracking. It carries no advertising, no advertising identifiers, no tracking pixels, no web beacons and no social media embeds. It performs no cross-site or cross-device tracking, and does not respond to or set any advertising-related identifier.

6.2 Our hosting provider may set a cookie that is strictly necessary for the delivery and security of the Site. A cookie of that description is exempt from the consent requirement in Article 5(3) of Directive 2002/58/EC (the ePrivacy Directive) and its national implementations, because it is used solely to carry out the transmission of a communication or to provide a service you have requested.

6.3 Because the Site deploys no non-essential cookies and no tracking technologies, it presents no cookie consent banner. The absence of a banner reflects the absence of anything requiring consent.

7. Correspondence

7.1 The only circumstance in which we come to hold personal data about you through the Site is if you choose to write to us. Sending a message to admin@izzylifeapp.com discloses to us your email address, any name or signature you include, and the contents of your message.

7.2 We process that data solely in order to read and respond to your message and to keep a record of the correspondence. We do not add your address to any mailing list, because we operate none. We do not use it to market anything to you, and we do not disclose it to any third party except as described in section 9.

7.3 In common with substantially all email, a message in transit to us is carried, and on arrival stored, by a mail service provider acting as our processor. That provider's processing is governed by its own terms in addition to this Policy.

8. Lawful bases for processing

8.1 Where the GDPR applies, we rely on the following lawful bases under Article 6(1):

• Server request data (section 5.2) — Article 6(1)(f), legitimate interests. Our legitimate interest is in delivering the Site you requested, keeping it available, and protecting it from abuse. We consider the impact on you minimal: the data is not used to identify you, is not enriched, and is not used for any secondary purpose.
• Embedded typefaces (section 5.3) — Article 6(1)(f), legitimate interests, being the presentation of the Site in its intended typography. We record that the appropriate basis for third-party font loading has been the subject of adverse judicial comment in at least one EU member state, and that self-hosting would remove the question entirely.
• Correspondence (section 7) — Article 6(1)(f), legitimate interests, being our interest and yours in our answering the message you sent. Where your message concerns a prospective agreement, Article 6(1)(b) may apply in addition.

8.2 You have the right to object to processing carried out on the basis of legitimate interests. See section 12.

9. Recipients and international transfers

9.1 We disclose personal data to no third party for any commercial purpose. The only parties involved in the operation of the Site are:

• our hosting provider, which serves these pages and processes the request data described in section 5.2;
• Google, in respect of the font requests described in section 5.3, which Google receives directly from your browser rather than from us; and
• our mail service provider, in respect of any correspondence described in section 7.

9.2 We may additionally disclose personal data where we are required to do so by law, by a court of competent jurisdiction, or by a regulator acting within its powers.

9.3 International transfers. We are established in the United States, and the providers identified in section 9.1 operate infrastructure in the United States and elsewhere. If you access the Site from the European Economic Area, the United Kingdom or Switzerland, personal data described in this Policy is therefore transferred outside that territory. Each provider publishes the transfer mechanism on which it relies, which may include the European Commission's Standard Contractual Clauses or certification under the EU–US Data Privacy Framework. We do not restate those mechanisms here, because they are the providers' to determine and to change.

10. Retention

10.1 We hold no database of visitors and therefore retain nothing in respect of a visit to the Site beyond the operational logs held by our hosting provider under that provider's own retention schedule.

10.2 Correspondence is retained for as long as is necessary to deal with the matter it concerns and to keep a reasonable record of it afterwards. We do not publish a fixed retention period for correspondence, because we are not willing to state a period we cannot undertake to honour precisely.

10.3 We will delete correspondence on request. If you have written to us and wish the message erased, write to the address in section 3.1 and we will delete it, subject only to any record we are required by law to keep.

11. Security

11.1 The Site is served exclusively over HTTPS and asserts HTTP Strict Transport Security, so traffic between your browser and the Site is encrypted in transit. It applies a Content Security Policy and related response headers that restrict the sources from which content may load and prohibit the Site from being framed by another origin.

11.2 The most substantial security measure available to us is that the Site holds nothing. A publication with no database, no accounts and no stored personal data presents no store of personal data to be breached.

11.3 No method of transmission over the internet is entirely secure, and email in particular is not a secure medium. Please do not send us sensitive information by email.

12. Your rights under the GDPR and UK GDPR

12.1 Where the GDPR or UK GDPR applies to you, you have the rights set out in Articles 15 to 22, namely the rights of access, rectification, erasure, restriction of processing, data portability, and objection, together with the right not to be subject to solely automated decision-making.

12.2 In practice, because the Site collects nothing from you directly, most of these rights have little to operate on. The exception is correspondence under section 7: that is personal data, we hold it, and you may exercise any applicable right in respect of it by writing to the address in section 3.1.

12.3 We will respond to a request under this section within one month of receipt, as required by Article 12(3), and may extend that period by two further months where the request is complex, in which case we will tell you within the first month. We do not charge a fee for a request unless it is manifestly unfounded or excessive.

12.4 We may ask you for information sufficient to satisfy us of your identity before acting on a request, in order to avoid disclosing personal data to the wrong person.

13. Notice to California residents

13.1 This section supplements the remainder of this Policy and applies to California residents to whom the CCPA applies.

13.2 Categories of personal information collected. In the twelve months preceding the date of this Policy, the only category of personal information within the meaning of Cal. Civ. Code § 1798.140(v) that has been processed in connection with the Site is internet or other electronic network activity information, comprising the request data described in section 5.2, together with identifiers and electronic network activity information contained in any correspondence you choose to send under section 7.

13.3 We have not sold or shared personal information. We do not sell personal information and we do not share it for cross-context behavioural advertising, as those terms are defined in Cal. Civ. Code § 1798.140(ad) and (ah). We have not done so in the twelve months preceding the date of this Policy. Because we do not sell or share personal information, we do not offer a “Do Not Sell or Share My Personal Information” link; there is nothing for such a link to opt you out of.

13.4 Sensitive personal information. We do not collect or process sensitive personal information as defined in Cal. Civ. Code § 1798.140(ae), and therefore do not use or disclose it for any purpose requiring a right to limit under § 1798.121.

13.5 Your rights. Subject to the CCPA, you have the right to know what personal information we have collected about you and the sources, purposes and recipients of it; the right to delete personal information; the right to correct inaccurate personal information; and the right not to receive discriminatory treatment for exercising any of these rights. To exercise a right, write to the address in section 3.1. You may use an authorised agent, in which case we may require proof of that authorisation.

13.6 Shine the Light. We disclose no personal information to third parties for their own direct marketing purposes, and therefore have nothing to report under Cal. Civ. Code § 1798.83.

14. Children

14.1 The Site is a corporate publication. It is not directed to children, is not designed to appeal to children, and offers nothing to a child that a child could use.

14.2 Because the Site collects no personal data from any visitor of any age, it collects none from children. We have never knowingly collected personal data from a child through the Site. If you believe a child has sent us personal data by email, write to the address in section 3.1 and we will delete it.

14.3 This section concerns the Site only. The applications described on the Site are intended in part for use by children and by adults supporting them. Obligations arising under the Children's Online Privacy Protection Act, Article 8 of the GDPR and equivalent provisions will be addressed in the separate privacy policy published for each application, and are not addressed here.

15. External links

15.1 The Site contains links to resources not under our control. We are not responsible for the content, security or privacy practices of any such resource, and this Policy does not apply once you leave the Site. We encourage you to read the privacy policy of any site you visit before providing personal data to it.

16. Changes to this Policy

16.1 We may amend this Policy from time to time. The amended version will be published at this address and the effective date, last-updated date and version number at the head of the document will be revised accordingly.

16.2 Where an amendment materially affects the processing of personal data we already hold about you, we will take reasonable steps to bring it to your attention. We maintain no notification list, because we maintain no list of any kind; your continued use of the Site after an amendment is published constitutes your awareness of it.

17. Status of this document

18. Governing law, complaints and contact

18.1 Governing law. This Policy and any dispute arising out of or in connection with it are governed by the laws of the State of Florida and the federal laws of the United States of America, without regard to conflict of law principles. Nothing in this section deprives you of the protection of any mandatory provision of the law of your country of residence, or of your right to bring proceedings before, or complain to, the authorities of that country.

18.2 Complaints. If you are dissatisfied with how we have handled your personal data, we would prefer that you tell us first, so that we have the opportunity to put it right. You are not obliged to do so. You may complain directly to a supervisory authority: in the United Kingdom, the Information Commissioner's Office; in the European Economic Area, the supervisory authority of the member state of your habitual residence, place of work or the place of the alleged infringement; and in California, the California Privacy Protection Agency or the Office of the Attorney General.

18.3 Contact. All questions about this Policy, and all requests to exercise a right under it, should be sent to admin@izzylifeapp.com.