Privacy Policy

Account information. Your email address and name; optionally your home city (which we turn into approximate coordinates), phone number and time zone.

Trips and bookings. Everything you or your fellow travelers add: trip names, dates and destinations, flights, stays, tickets, reservations, rental cars, notes, to-dos, costs, confirmation numbers and contact numbers, and the names of travelers you add.

Email you connect or forward. If you connect Gmail or Outlook, Larkfolk searches your mailbox for messages that look like travel bookings (using sender and subject), reads those messages, and extracts the booking details. We store the extracted booking details, plus a record of each message we read (its sender's domain, subject, date and a reference to it) so we don't read it twice. We do not store the full text of your emails. Messages you forward or copy to your private Larkfolk address are handled the same way.

Photos. A profile photo and trip header photos, if you add them. We re-encode every photo when it's uploaded, which removes hidden data such as the location it was taken. Photos are visible to the people on your trips (and a trip's header photo to anyone with its view-only link). Trips without a photo may get one of the destination from Wikimedia Commons, credited to its photographer.

Text you paste. When you paste a confirmation, we read it to extract the booking and then discard the text.

Questions you ask. Messages you send to Ask are processed to answer you. Your chat history is kept in your browser on your device, not on our servers.

Sign-in and security data. Passkey public keys (never your biometrics), active sessions with the device type, and a security log of sign-ins and sensitive actions in which IP addresses are stored only as one-way hashes.

What we don't collect. We don't use your device's location, we don't use advertising or analytics trackers, and we refuse to store payment card, passport or government ID numbers: if pasted or emailed text contains them, we reject it or strip them out.

• To run Larkfolk: show your trips, build timelines, find bookings in your email when you ask, answer your questions, and share trips with the people you choose.
• To add useful context: weather and alerts for trip places, maps and directions.
• To send you sign-in links and invitations you or others request.
• To keep Larkfolk and your account secure, prevent abuse and enforce limits (including each person's monthly AI allowance).
• To comply with the law.

We don't sell your personal information, share it for cross-context behavioral advertising, or use it to train AI models.

When you connect Gmail we ask for read-only access, and when you connect Outlook we ask for permission to read mail. We use that access only to find and read travel bookings for you, as described above. We never send email from your account, change or delete your mail, or let people read your mail, except where you direct it, where it's needed for security, or where the law requires it.

Larkfolk's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We do not use Gmail data for advertising, and we do not use it to develop, improve or train generalized AI or machine-learning models.

You can disconnect a mailbox, or delete everything Larkfolk has read from your email, at any time from Settings → Email sync. Disconnecting also asks Google or Microsoft to revoke Larkfolk's access.

Reading booking emails, pasted confirmations and answering questions in Ask are done with Claude, an AI model provided by Anthropic, PBC. We send Anthropic only what's needed for the task: the email or text being read, or your question along with the trip details needed to answer it. Under Anthropic's commercial terms, content sent through its API is not used to train its models.

AI can make mistakes. Larkfolk shows you what it found before anything is added (unless you turn on automatic adding for trusted senders), and you should double-check important details like dates, times and terminals with the original confirmation.

People you choose. Members of a trip see it according to their role. Viewers don't see confirmation numbers, costs or contact numbers unless you share them on that booking. If you turn on a view-only link, anyone with the link can see the trip's schedule and places (never confirmation numbers, costs, phone numbers, notes or who's going). Invitations go to the email addresses you enter.

Service providers who process data for us under contracts that limit its use:

• Anthropic (AI processing, as described above)
• Google and Microsoft (only to read the mailboxes you connect)
• Resend (sending sign-in and invitation emails)
• Mailgun (receiving mail sent to your Larkfolk forwarding address)
• Our hosting and database providers
• Open-Meteo and the U.S. National Weather Service (weather for trip places, by coordinates)
• Photon by komoot (turning booking addresses into map coordinates; only venue and hotel addresses, never yours)
• OpenFreeMap (map images, loaded directly by your browser, so it sees your IP address)
• Wikipedia and Wikimedia Commons (finding a photo of a trip's destination; only the destination name is sent)

Directions open in Google Maps, Apple Maps or Waze when you tap them; those apps' own policies apply there.

Legal and safety. We may disclose information if required by law or valid legal process, or to protect the rights, safety and security of our users, the public or Larkfolk.

Business changes. If Larkfolk is involved in a merger, acquisition or sale of assets, your information may transfer as part of it, subject to this policy.

• No passwords: you sign in with a passkey or a single-use link that expires in 15 minutes.
• Confirmation numbers, phone numbers, mailbox addresses, email access tokens and everything extracted from your email are encrypted in our database (AES-256-GCM).
• Sign-in links, invitations and share links are stored only as one-way hashes.
• Every request is checked against your role on that trip; people who aren't on a trip can't tell it exists.
• Traffic is encrypted in transit (HTTPS), and the app sends strict browser security headers.

No system is perfectly secure. If we learn of a breach affecting your information, we'll notify you as the law requires.

• Your account and trips: until you delete them or your account.
• Email you connect: booking details and read records until you delete them (Settings → Email sync → delete everything read from your email) or delete your account.
• Pasted text: not kept after it's read.
• Sessions: they end after 7 days unused, or 30 days at most. Sign-in links expire after 15 minutes.
• Security logs: kept as long as needed to protect the service; when you delete your account they're no longer linked to you.

When you delete your account, shared trips you own pass to another member so they don't lose them; trips no one else is on are deleted.

From Settings you can update your profile, download all your data (Settings → Your data), disconnect mailboxes, delete everything read from your email, and delete your account.

Depending on where you live, you may also have the right to access, correct, delete or port your personal information, to object to or restrict certain processing, to withdraw consent, and to complain to your data protection authority. California and other U.S. state residents have the right to know, delete and correct personal information and not to be discriminated against for exercising these rights; we don't sell or share personal information as those laws define it. To make a request, email privacy@larkfolk.app. We'll verify the request comes from you (or your authorized agent) and respond within the time the law requires.

Legal bases (EEA/UK). We process your information to provide the service you signed up for (contract), to read your email only with your permission (consent, which you can withdraw by disconnecting), to keep the service secure and improve it (legitimate interests), and to meet legal obligations.

Larkfolk uses one essential cookie to keep you signed in and one to remember your light or dark theme. Your browser also stores your Ask chat history and a few display preferences on your device. We don't use advertising or third-party tracking cookies.

Larkfolk isn't for children. You must be at least 13 years old (16 in the EEA and UK) to create an account. If you believe a child has given us personal information, contact us and we'll delete it. Adults can add children as travelers on a trip by name; that information belongs to the adult's trip.

Larkfolk and its service providers may process information in the United States and other countries whose data-protection laws differ from yours. Where the law requires, we use appropriate safeguards such as Standard Contractual Clauses.

We'll update this policy as Larkfolk changes. If a change is significant, we'll tell you in the app or by email before it takes effect. See also our Terms of Service.