Privacy policy

Last updated: 13 October 2026 · Version 1.6

1. Who we are

LottaLou is built and operated by Anne Albert, trading as annealbert.dev, a sole proprietorship (eenmanszaak) registered in the Netherlands.

• Controller: Anne Albert (annealbert.dev)
• Address: Dreischorstraat 26D, 3086 PB Rotterdam, the Netherlands
• KvK number: 76456080
• Email: [email protected]

We are the controller for the personal data described here. We are not required to appoint a Data Protection Officer and have not appointed one; privacy questions go to the address above.

2. What this covers

This policy covers the LottaLou mobile app for iOS and Android, this website at lottalou.com, and the email we send you. Third-party services we rely on are listed in section 6; where you leave our app for a service of their own (the App Store, Google Play), their privacy policy applies to that part.

3. What we collect

Account

• Email address and, if you set one, your name and profile picture.
• There is no password. You sign in with a one-time code we email you, which we store only as a cryptographic hash until it is used or expires — or with Sign in with Apple or Sign in with Google, in which case we keep the identifier and email address they return (with Apple, possibly a private relay address, and a token that lets us withdraw the app's access to your Apple ID when you delete your account).
• Your signed-in sessions: when each started and was last used, and the app version, build and platform (iOS or Android) it was used from.
• Your subscription status and its expiry date.
• Your time zone, and whether you have finished onboarding.
• Usage counters we need to enforce plan limits — recording seconds used, transcription and AI requests per day.

Journals

• The journal's settings, such as its name, type, cover and transcription language.
• For a child journal: the child's name and date of birth, both of which you enter yourself.

Entries

• The recording itself, the transcript of it, the tidied version, and the title.
• The date, time and length of the recording.
• Milestones and life events you choose to record — a first, a quote, a celebration — and anything else you decide to put in an entry.
• Photos you attach.

Sharing

• Who is a member of which journal, in what role, and who invited them.
• Invitations you create — either addressed to an email address you type in, or as a shareable link that anyone holding it can redeem until it expires.

Technical

• Crash and error reports: what went wrong, where in the code, the app version, the device model and your account identifier. These are configured to exclude request bodies, cookies, headers and device names, and long values are truncated. Errors on our server are reported the same way, with internal record identifiers but none of your content.
• Server logs for each request our backend handles — the account identifier, what was asked for, whether it succeeded and the size of an uploaded recording — kept for security, abuse prevention and working out why something broke.
• If you allow notifications: a push token for each of your devices, the device's platform and name, and which kinds of notification you have switched on or muted per journal; and a record of each notification we send you, including its text, so the same one is not sent twice.
• Standard hosting logs at our providers, including IP address.

What we do not collect

• No advertising identifiers, no third-party analytics, and no behavioural tracking SDK is present in the app.
• No location data. We never ask for the location permission.
• No contacts. Invitations use email addresses you type in yourself; we do not read your address book.
• No payment card details. Purchases are handled by Apple or Google, and we only receive the resulting subscription status.

Permissions the app asks for

• Microphone — to record an entry.
• Camera — to take a photo for an entry.
• Photo library — to attach pictures you already have.
• Notifications — to tell you about activity in the journals you share, remind you to record, and let you know about your plan. You choose which kinds you get in the app's settings, and refusing the permission costs you nothing else.

Each is asked for at the point it is needed, and each can be withdrawn in your device settings.

On Android the app also declares a set of lower-level permissions that the audio-recording library needs in order to work — audio settings and keeping the screen awake. They are used for recording and nothing else. Google Play lists them in full on the app's page.

What is stored on your phone

So the app opens instantly and works without a signal, a copy of your recent journal data — entries, titles, transcripts and member lists — is cached in the app's own storage on the device for up to seven days, along with anything you entered during setup, until setup is finished. Photo books and journal books you save in the app are kept on the phone until you delete them or delete your account. A recording, and any photo you attach while offline, is kept in the app's storage only until it has been uploaded with its entry, and is then deleted from the phone. All of it is removed when the app's data is cleared or the app is deleted.

4. Data about children

LottaLou is a journal about children, written by adults. The account holder must be 18 or over. There are no accounts for children and the app is not directed at them.

That said, the content is largely personal data about a child: their name, date of birth, photographs, voice recordings, quotes and milestones — plus whatever else you choose to write down. A journal is free-form, so some of what ends up in it may count as health data under the GDPR, which is a special category requiring extra care. We do not ask for it; the point is that if you record it, it is treated with that care.

You provide this data as the child's parent or legal guardian, or with that person's permission, and you are responsible for having the authority to do so — including for anyone else who appears in a photo or recording. We process it only to provide the journal to you and the people you have invited. We never use it to train AI models, we never use it for advertising, and we never sell or rent it. Where a provider processes it on our behalf, we select the service and the plan so that their terms forbid them from training on it either.

Because these are children's photographs, media is held in private storage and is reachable only through signed links that expire after one hour.

5. Why, and on what legal basis

6. Who processes it

We use a small number of providers to run the service. They act on our instructions under a data processing agreement, and each receives only what its job requires.

We do not sell personal data and we do not share it with advertisers or data brokers. Each provider above is used on a plan whose terms prohibit it from using customer content to improve or train its own models.

Beyond this list, we disclose data only where the law requires it, or where it is necessary to establish or defend a legal claim.

7. Recordings and AI

This is the part people ask about, so here it is in detail.

• The app asks before anything you record is sent. The first time you tap a microphone, it explains that third-party AI services turn your recording into text, and asks for your permission. Until you say yes, nothing you record is sent and photo-book captions are not suggested. A "not now" is not final: any microphone asks again.
• The recording is sent for transcription when you finish it — over an encrypted connection, through our own server, to Soniox. That happens before you decide whether to keep the entry, so discarding one afterwards does not undo the transcription.
• We keep the recording with its entry, so you and the people you share the journal with can listen back to it. It is stored in the same private storage as your photos, and deleted when you delete the entry or your account. The copy held by Soniox is deleted as soon as the transcript comes back, or within two hours if the app is closed before then, and the copy on your phone once the recording has been uploaded.
• What the AI provider gets is text. Once an entry has been transcribed, the transcript — not the audio, not your photos, not your account details — is sent to Google's Gemini API to suggest a title and to take out filler words and false starts. Both run automatically, on every entry. For a child journal the child's name goes with it, so the name comes back spelled the way you spell it. When you make a photo book, an entry's title and text are sent the same way to suggest a caption.
• The original transcript is kept with the entry, alongside the tidied version the app shows you, as the record of what you actually said. It is included when you ask us for a copy of your data.
• No training. We do not use your recordings, transcripts or photographs to train models, and the providers above are used on plans whose terms forbid them from doing so.
• AI is not perfect. Transcription and tidy-up can get words wrong. Check anything you care about, and correct it — the entry is editable.

8. Sharing and invitations

A journal is private until you invite someone. You can invite them in two ways: by email address, which we store and send the invitation to, or as a shareable link. A shareable link is a bearer link — anyone who has it can join the journal until it expires — so send it only to the person it is meant for.

Once someone accepts, they become a member: they can read the journal's entries, photos and recordings, and add their own. An entry its author marks private is visible to that author only.

Members can see each other. Everyone in a journal can see the name and profile picture of every other member.

Only invite people who would expect to be invited. Members can see the content shared with them, including photographs of your child, and what they do with it afterwards is outside our control.

An invitation sent by email shows the recipient who sent it — your name, or the first part of your email address if you have not set one.

You can remove a member or revoke an invitation at any time; invitation codes and shareable links also expire on their own.

Exporting a journal — as a photo book, or as a PDF or Word document — builds the file on your device, with any photos embedded in it, and hands it to your phone's share sheet. Where it goes from there — email, a cloud drive, a print shop — is your choice, and outside our control.

9. Transfers outside the EEA

Some providers listed above are established in, or process data in, the United States. Where personal data leaves the EEA, we rely on the European Commission's Standard Contractual Clauses, on an adequacy decision such as the EU–US Data Privacy Framework where the provider is certified under it, or on both. You can ask us for details of the safeguards in place for a specific provider.

10. How long we keep it

• Your journals and entries — for as long as your account exists. That is the point of the product.
• Deleted entries — an entry you delete disappears from the app immediately, and its photos and recording are deleted from storage at the same moment. Its text is kept, marked deleted, until you delete your account.
• Your account — deleting it, from inside the app or at lottalou.com/account, removes your profile, the journals you own and every entry in them — including entries other members added — and the photos and recordings of everything it deletes. Where you have added entries to someone else's journal, you choose during deletion whether those go too; if you keep them, they stay in that journal, with their photos and recordings, and your name detached from them.
• On your phone — the cached copy described in section 3 clears itself after seven days; books you saved stay until you delete them. Deleting your account removes both from the phone, along with anything left over from an unfinished setup. All of it goes when you clear the app's data or delete the app.
• Backups — our database is backed up every night, encrypted before it leaves our server, and each backup is kept for 30 days before rolling off. So text you delete may survive in a backup for up to 30 days. Photos and recordings are not part of the database backup: when they are deleted from storage, there is no other copy.
• Sign-in records — a session that has ended is removed 30 days later, and a sign-in code a day after it expires.
• Notifications — the record of each notification we sent you, including its text, is kept until you delete your account.
• Crash reports — kept for up to 90 days.
• Records we must keep — invoices and tax records for the seven years Dutch law requires.
• Audio at our transcription provider — deleted as soon as the transcript comes back, and within two hours if the job is interrupted, for example because the app was closed before the transcript arrived.
• At our other providers — deletion in the app does not reach data already held by Google, RevenueCat, Sentry, Resend or Expo; each applies its own retention period. Ask us and we will pass on an erasure request where the provider supports one.

11. Security

• Everything travels over TLS.
• Photos, recordings and database backups are encrypted at rest in storage, and backups are encrypted before they leave our server.
• Photos and recordings sit in a private bucket. They are served through signed links valid for one hour, and are not publicly addressable.
• Database access is governed by row-level security and by authorization checks in each part of our server, so one account cannot read another's journals.
• Session tokens are held in the device's secure keychain or keystore.
• The keys for the services that see your content — speech-to-text and AI — exist only as server-side secrets. The app never holds them, and reaches those services only through our own server.
• The cached copy on your phone is protected by the operating system's own app sandbox rather than by separate encryption. If your device is unlocked, that cache is readable in the same way the app itself is.

No system is perfectly secure. If a breach occurs that is likely to present a risk to you, we will notify the Dutch Data Protection Authority within 72 hours and tell you directly where the law requires it.

12. Your rights

Under the GDPR you can ask us to:

• Access — give you a copy of your personal data.
• Rectify — correct anything wrong.
• Erase — delete your data ("right to be forgotten").
• Restrict — pause processing while a dispute is resolved.
• Port — hand over your data in a machine-readable format, or send it to another provider.
• Object — stop processing based on our legitimate interests.
• Withdraw consent — at any time, without affecting what was lawful before.

Email [email protected] and we will answer within one month. Deleting your account, which does most of this immediately, is available in the app's settings and at lottalou.com/account. If you can no longer sign in, email [email protected] from the address on your account and we will delete it for you.

If you think we have handled your data badly, you can complain to the Dutch Data Protection Authority (Autoriteit Persoonsgegevens, autoriteitpersoonsgegevens.nl) or to the supervisory authority where you live. We would rather you told us first.

13. This website

lottalou.com sets no cookies, runs no analytics and embeds no tracking pixels. Web fonts are loaded from Google Fonts, which means your browser makes a request to Google's servers and Google sees your IP address for that request.

If you join the waitlist, we store the email address you submit, the time you submitted it, and nothing else, in order to write to you once when the app is ready. We do not pass it to anyone. Ask us and we will delete it.

Our host, Cloudflare, keeps short-lived request logs for security and abuse prevention.

14. Changes

We will update this policy when the app changes. The date at the top always reflects the current version. For a change that materially affects you we will tell you in the app or by email before it takes effect; continuing to use LottaLou afterwards means the new version applies.

15. Contact

Anne Albert (annealbert.dev)
Dreischorstraat 26D, 3086 PB Rotterdam, the Netherlands
KvK 76456080
[email protected]