Privacy & Data Handling

The short version

Larkwell helps you plan your day with AI. We collect only what we need to run the product, we never sell your data, and you can export or delete everything at any time from Settings → Your data & privacy.

What we store

• Account basics: your name, email, and a one-way hashed password (we never store your password in plain text).
• Your content: tasks, projects, areas, agents, skills, notes/memories, and chat messages.
• Connections you choose to add: calendar authorizations and messaging keys.

How we protect your data

We apply layered safeguards to protect your information, including sensitive data such as access tokens:

• Encryption in transit: all traffic between your device and Larkwell is encrypted using HTTPS/TLS.
• Encryption at rest for secrets: your calendar authorization tokens and any messaging keys are encrypted with a dedicated application key and decrypted only in memory when needed.
• Password protection: passwords are stored only as one-way salted hashes — never in plain text, and never visible to us.
• Access controls & isolation: your data is scoped to your own account; secrets are never shown back in full or written to logs; repeated failed logins are rate-limited.
• Payment isolation: card details are handled entirely by Stripe (a PCI-DSS Level 1 certified provider); we never see or store your card number.
• Data minimization: we collect only what is needed to run the product.

AI processing & your Google data

Larkwell uses third-party AI providers (accessed through a managed AI gateway) to generate plans, replies, task breakdowns, and summaries. We send only the minimum context needed — your own Larkwell content, such as the tasks and notes you create — to produce your result. Our AI requests run on the providers' business/API tiers under terms that do not use API inputs to train their models.

Your Google Workspace data is strictly isolated from AI. We do not send your Google Calendar event details — titles, descriptions, attendees, or locations — to any AI provider. When the planner schedules around your commitments, only anonymous busy time ranges (containing no event content) are used. In accordance with the Google API Services User Data Policy (Limited Use), Google user data — whether raw, aggregated, or derived — is never used, transferred, or sold to create, train, or improve any foundational or generalized machine-learning or AI models.

Google Calendar data & Limited Use

If you choose to connect Google Calendar, Larkwell requests access to your calendars solely to show your existing commitments inside the app and to add the focus blocks and tasks you plan. We only read and write events on your behalf and never sell or transfer this data to third parties for advertising, and we do not use it to train AI models. You can disconnect at any time from Settings, which revokes Larkwell's access and removes the stored authorization. Larkwell's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Your rights & controls

• Export: download all your data as JSON from Settings.
• Delete: permanently remove your account and all associated data immediately from Settings.
• Access & correction: view and edit your content in the app at any time.

These controls reflect a GDPR/CCPA-style baseline. Questions? Reach us via the in-app “Send feedback”.

Security & access

Passwords are hashed, sessions are protected, and repeated failed logins are temporarily rate-limited. Data is transmitted over encrypted connections (TLS).

Who runs Larkwell & how to contact us

Larkwell is built and operated by an independent solo developer. If you have any questions about your privacy, want to exercise your data rights, or need help, email us at support@larkwellapp.com and we'll get back to you. For general inquiries, press, or partnerships, reach us at info@larkwellapp.com. You can also reach us anytime via the in-app “Send feedback”.