Privacy

Lavndr reads only what you connect, upload or enter. It does not sell your data, show ads, or give data to data brokers. You can download your data and delete your account in Settings.

• Account — Your email, name and photo from Google or Apple sign-in, or what you enter. A password is kept only as a one-way hash. If you joined by an invite link, whose link it was.
• Oura and Apple Health — Body data: sleep, heart rate, activity, workouts and more. The health data notice has the full list.
• Calendar — Google Calendar, Outlook or a calendar link, read-only. For each event: its title, start and end, who organized it, and the names, email addresses and replies of the people invited. Not descriptions or locations. In the iPhone app, Apple Calendar is read on the phone instead, the same fields from the calendars you leave in, and only after you allow it.
• Spotify — Your display name, playlists and recently played tracks, and the plays in a history file you upload. Lavndr removes songs from your playlists or Liked Songs only when you pick them and confirm. It does not control playback.
• Last.fm and ListenBrainz — The plays on the account whose username you give. If you sign in to Last.fm from Lavndr, Last.fm gives Lavndr a key to read your listening history; it is stored encrypted and removed when you disconnect.
• Check-ins — Your scores, your habits, the names of people you say you saw, and your journal, written or spoken. Speech is turned into text. The audio is not kept, with one exception: if Lavndr asks whether it may keep your recordings and you say yes, your voice and its words are stored from then on, to train and improve Lavndr. They are stored encrypted, and the founder holds the key. You can stop or delete them in Settings, Voice.
• A journal you bring in — When you bring in a journal, the file is read on your device; only each entry's day, time and words are sent to Lavndr and kept as your own entries. Photos and recordings in it are never opened or sent, no AI reads them unless you ask, and you can remove an import whole.
• Things you add — Tasks in Plan, imported check-in history, statements about yourself pasted from another AI assistant, and your questions to Atlas and Ask with their answers.
• On the iPhone — Lock Lavndr and whether the widget shows details are settings kept on the phone; Face ID and the passcode are checked by iOS, and Lavndr never sees them. The widget and Siri show a copy of your morning's line kept on the phone. Reminders the app schedules itself are set on the phone from a list Lavndr sends it, and an answer you type into one is sent to Lavndr as a check-in answer.
• Home location — The place set in Settings, used only for weather. Lavndr does not track where you are.

• When something breaks — Lavndr records where and how often, linked to your account, and the days you opened it, never what you wrote or said, and deletes it after 30 days.

Sources shown as coming soon collect nothing.

Findings and patterns, your best days, a model of you (what Your manual shows), experiment results, a lifestyle score, a mood signal from your music, and your reading (the notes Atlas keeps on your journal and what it noticed in them). All of it is in your download and is deleted with your account.

Once you have tapped energy, confidence or stress on 14 days, Lavndr also reads where they are likely to land today from your devices' numbers, flags when the next few days look likely to run low, and checks each read against what you later tap. Before that it says only where your sleep, heart rate, meetings and listening sit against your own usual.

One exception. Every day Lavndr forecasts your next day and later checks the forecast against what happened. While this is being tested you are not shown your forecasts, the founder can see them, and they are not in your download. They are deleted with your account.

• Vercel — Runs the app. Holds an Apple Health export until it has been read, and your recordings if you said yes to keeping them.
• Neon — Holds the database.
• Anthropic — AI, and only once you have allowed it. The next section says what it gets.
• Deepgram — With AI allowed and voice on: your voice while Lavndr is listening, and the text Lavndr speaks. Your voice goes from your browser to Deepgram, or through Lavndr's server on its way there; Lavndr keeps the words, and the audio only if you said yes to keeping your recordings. Where Deepgram cannot be reached, your browser's own speech recognition is used.
• Resend — Your email address and the emails Lavndr sends you. The morning email includes last night's sleep.
• Apple, Google or Mozilla — With reminders on in a browser: each reminder, as a message only your device can read. In the iPhone app, a reminder Lavndr's server sends goes through Apple's push service as plain text, which Apple can read: the reminder's one line. Reminders the app schedules on the phone do not pass through Apple. Lavndr keeps the address your device gives it for this.
• Last.fm, MusicBrainz and ReccoBeats — Artist names and Spotify track ids, with nothing that says whose they are.
• Open-Meteo — Your home coordinates.

AI is off until you allow it. The first time you do something that needs it, Lavndr asks, naming Anthropic and Deepgram and what each receives, with two choices: Allow and Not now. Nothing of yours goes to either before you choose Allow. After Not now, Lavndr does what it can work out itself and tells you AI is off for the rest; it asks again only when you next do something that needs AI, at most once a visit.

Settings, AI turns it off or on again. Off takes effect at once: nothing more is sent, by you or by any scheduled job. Lavndr keeps the time you allowed it and which wording you were shown.

With AI allowed, your words and records go to Anthropic when you use a feature that needs it:

• Atlas and Ask — Your question, the earlier turns, your name, and what the answer needs from your records, your own entries among them. Atlas writes at most 40 answers a day with AI. When a question needs your journal read, the entries Atlas has not read yet are sent, a few days at a time, and it keeps notes on each with your own words quoted; this happens only because you asked.
• Talking check-in — What you say, the names of your habits, and that day's numbers.
• Plan — What you type to add tasks.
• Imports — A spreadsheet's column names and up to three sample values. A pasted reply from another AI assistant, when Lavndr cannot read it without help.

One thing is sent without you asking, and only with AI allowed. When a chapter on your Life page needs a name, a daily job (or the first working-out of your Life page) sends that chapter's top artists, listening hours, share late at night, and calendar events per month. Artist names alone may also be sent to sort them into genres. No scheduled job sends your journal or your check-ins anywhere.

What you ask Atlas, what it answers and your reading are kept with your account. The admin section does not show them. Turning AI off does not delete your reading; Settings, AI has Delete what Atlas has read, which does.

Off unless you say yes. Setup asks once, with Yes and Not now; Settings, Voice & AI, Learning from everyone turns it on or off at any time. With it on, Lavndr's own code, on Lavndr's own servers, learns from many people's numbers how signals like sleep and meetings tend to move energy, confidence and stress, and uses that to make your reads better before it knows you well.

• What is shared — For each day you tapped energy, confidence or stress: those scores as whole numbers, and how far your sleep, heart rate overnight, steps, meetings, new artists played and daylight were from your own usual, rounded to half steps, and whether it was a weekend. No hours, counts or other raw numbers, and no dates: days are numbered from the first day you shared.
• What is never shared — Your name, email, contacts, the names of people or places, event titles, what you write or say, transcripts, and anything from Apple Health.
• How it is kept — Apart from your account, under a code made from your account with a secret key that is not in the database, and encrypted. No page, admin screen or request reads it; only the job that learns from it does. As with everything else, whoever runs Lavndr holds the keys.
• What comes out — One shared model, trained only once at least 50 people take part. It is used only to improve Lavndr's own reads. It never says anything about another person or a small group, and it is not sold or given to anyone else.
• Turning it off — Takes effect at once: nothing more is shared, and what you shared is deleted before the next time the model learns. Deleting your account does the same.

Lavndr commits publicly to keep what is shared in this de-identified form and not to try to identify anyone from it, and would require the same in writing of anyone who ever handled it for Lavndr.

While Lavndr is in testing, the founder can open an admin section that shows your numbers and habits: your name, email, time zone and join date; your connections and whether they work; your sleep and heart rate; your check-in scores; your habits by the names you gave them; your listening totals and genres; how many days of data you have; your findings, best-day summary and forecasts. It does not show your journal or anything else you write or say, the names of people, your calendar, or what you ask Atlas.

Only named administrator accounts can open it, with their password entered again every 15 minutes. Every view is recorded in a log that cannot be edited, and Settings shows how many times your account was opened and when. That log is kept after an account is deleted: an account id and a time, nothing else about you.

The admin section is not the only way in. Whoever runs Lavndr holds the keys to the database, where everything is stored, your journal included. That access is not limited or recorded by the admin section.

• Your data — Kept until you delete your account.
• Detailed body readings — May be reduced to hourly averages once they are 30 days old.
• Check-ins — Can be changed on their day and the day after (7 days on the Check-ins page). Then they stay as they are.

• Download — Settings, Account, Download your data: a .zip of JSON files, without tokens or your password. Your forecasts are not in it yet.
• Disconnect — Removes Lavndr's saved access, so nothing new is read. What was imported stays. To end access at the provider too, remove Lavndr in the provider's own settings.
• Email and reminders — The morning email and the weekly summary each carry a link that turns them off. So does Settings, which also turns reminders on and off.
• Delete — Settings, Account, Delete account. It happens at once. How to delete says what goes and what is kept.

Connections use HTTPS. Access tokens for Oura, Google Calendar, Outlook, Spotify, Last.fm and ListenBrainz are encrypted with a key kept apart from the database. Passwords are kept as a one-way hash. A test on every change checks that one account cannot read another's data. No system is perfectly secure.

Lavndr is not for anyone under 16.

If this policy changes, the date at the top changes.

neildiasti@gmail.com