1. Who we are

Larlebee is run by Elijah Okokon, an individual, for now. He decides how your information is used, which makes him responsible for it under data protection law (the “controller”). When this policy says “we” or “us”, it means him and anyone working on Larlebee with him.

For anything about your privacy, write to privacy@larlebee.com, or use the request form below.

2. What we will never do

Show ads, or let anyone pay to reach your family.
Sell your information, or share it for advertising.
Use your family’s records to train artificial intelligence, or let the companies that help us do so.

3. What we collect

Your account

Your name, and the phone number or email address you sign in with. A password, if you set one, is stored only in a form that can’t be read back.
The date you agreed to our terms, and settings you choose (such as simpler screens or notifications).

What your family records

The family tree: people’s names, nicknames, dates and places of birth and death, relationships, photos of them, and other details relatives add.
Stories, recordings, interviews, heritage, titles, events, photos and messages that members add.
Family contributions: who pledged or paid what towards a family fund, as recorded by the family. No money moves through Larlebee, and we never ask for card or bank details.
Time capsule letters, sealed until the day they open.

When you use Larlebee

One sign-in cookie, which keeps you signed in. We use no advertising or tracking cookies, and no analytics service. The app also remembers one setting (data saver) in your browser.
Your internet (IP) address, used briefly to stop abuse such as repeated sign-in attempts. Our web server’s logs, which include IP addresses, are kept for a short time for security.
If you turn on notifications, the address your phone’s notification service gives us.
Records of the texts and emails we send you (for example, sign-in codes and family news), so we can see they arrived.

Photos

When a photo is uploaded, Larlebee rebuilds it and keeps only the picture. Hidden details a phone adds, such as the place it was taken, are removed.

4. People in the tree who aren’t on Larlebee

A family tree is about many people who never signed up: grandparents, cousins, children, in-laws, and those who have died. Relatives add them because they are family. We know that this is information about you that you didn’t give us yourself, so:

Only members of that family can see the tree. It is never public, and search engines can’t reach it.
Phone numbers and addresses can be kept to the closest relatives, and anyone can be hidden from particular relatives.
You can ask us to correct or remove what a family has recorded about you, or about your child, whether or not you have an account. Use the request form. We will check with the family where it is fair to, and we will tell you what we did.
We may keep a person’s place in the tree (their name and how they connect) where removing it would break the record of who is related to whom, but we will remove the other details you ask us to.
A family can send news (such as a funeral or reunion) to relatives who aren’t on Larlebee, by text or email, only after a member records that the relative agreed to it, and who recorded it and when. Every message names the family and tells you how to stop them: reply STOP to a text, or use the link in an email.

5. Why we use your information, and the law that lets us

To run Larlebee for you and your family: your account, your family’s tree, messages and the rest. This is necessary to provide the service you asked for (our contract with you).
To keep Larlebee safe: stopping abuse, investigating reports, and backups. These are our legitimate interests, and yours.
To hold records about relatives who aren’t members: the legitimate interest of families in keeping their history, balanced by the protections in section 4.
For things you choose to switch on, such as notifications or asking Bee: your consent, which you can withdraw at any time in the app.
When the law requires it, such as answering a valid court order.

Family records can include sensitive information, such as a person’s religion, ethnicity or the cause of a death. Families choose to record these. We use them only to show them to that family, and we treat them with extra care.

6. Who can see what

Your family: the relatives your family has let in see the family’s tree, messages, photos and stories, within the privacy choices each person makes.
Someone you’re seeing or engaged to: only if you both accept, your partner’s name and family name are shown to nobody, your close family or your whole family: each of you chooses for your own side only. Nothing else is shared between your families until you marry, and ending it deletes it.
Families joined by marriage can read each other’s tree and heritage. Photos and conversations stay with each family.
Guests invited to one event see that event and its guest book, nothing else.
Everyone, on our world globe, only if your family’s admins turn it on: your family’s hometown, and the towns where its members live, as lights on a map, never names. A town is shown only where at least 3 members live, and a country only where at least 5 do (fewer aren’t shown). It is updated once a day. Children, people who have died, anyone without a birth date on their profile, anyone who keeps their contact details to close family or has hidden from a relative, and families with fewer than 5 established members aren’t counted.
The Larlebee team sees people’s details only when it has to: to answer a report, a request or a support question. Every look is recorded with who looked and why, in a log that can’t be quietly changed. The team signs in with two-step verification.
The authorities, only when the law requires it, and we will tell you unless the law forbids us.

7. Companies that help us run Larlebee

These companies process information only on our instructions, to provide their service to us:

Namecheap (USA): the server Larlebee runs on, in Los Angeles. Your family’s records are stored there.
Cloudflare (USA, worldwide network): runs our domain and protects the team’s admin area; keeps our off-site backups in private storage (Cloudflare R2), which it encrypts (photos and recordings we encrypt ourselves first); and forwards email sent to our addresses.
Resend (USA): sends our emails, such as sign-in codes, safety alerts and family news.
Africa’s Talking (Kenya, operating in Nigeria and across Africa), once we switch on text messages: sends our SMS, such as sign-in codes and family announcements.
Anthropic (USA): the AI behind Bee. When someone asks Bee a question or asks it to draft something, the family records that person may see are sent to Anthropic to write the answer. For the Sunday email, Bee is sent the names and birth years of adults in the tree, and how many stories and photos were added (never the stories themselves), to write a short note. When a family adds a language, the app’s own words (no one’s information) are sent to be translated. Anthropic does not use any of it to train its AI, and keeps it only for a limited time, for safety checks.
Google (USA), through Firebase Cloud Messaging: delivers notifications to the Android app, if you turn them on. Apple, Google and Mozilla do the same for browsers. Only a short preview is sent.

8. Information crossing borders

Families live in many countries, and Larlebee’s server is in the United States. So your information is stored in the USA and may be handled in other countries where the companies above work. Where the law where you live requires it (for example in the UK, the EU and Nigeria), we rely on safeguards such as the standard contract terms those companies offer for international transfers.

9. How long we keep things

Your account: until you delete it.
Family records: while the family uses Larlebee, unless they are removed sooner.
When you delete your account (in the app: Me → Delete my account; on the website: My profile → Delete my account): you are signed out on every phone and computer at once, and the account is deleted 14 days later. Signing in again before then keeps it, so a mistake, or someone else using your phone, can be undone. Then your sign-in, your messages, posts and comments, and your RSVPs are deleted. You can also clear your private details (photo, phone, location, biography, occupation, birthplace) from your place in the tree. Your name and place in the tree stay, because they are part of your relatives’ history. Stories, photos and heritage you added stay with the family, no longer linked to your account; you can delete your own before you go. Sealed time capsule letters you wrote are deleted.
Backups: daily copies are kept for 14 days on the server and 30 days in our off-site backup, so deleted things disappear from backups within 30 days. Deleted photos and recordings are kept in the off-site copy for 45 days, so a mistake can be undone.
The words of texts and emails we sent: 30 days. Sign-in codes stop working after 10 to 15 minutes.
Sign-ins: on the website you stay signed in for 30 days; in the app, for 90 days from when you last opened it (a year at most); a phone a relative set up stays signed in for a year. For each sign-in we keep the kind of device, the country it was made from and when it was last used, so you can see where you’re signed in; this goes when the sign-in ends.
Safety records: a record of account locks (when, and whether from the lock page or by a relative), kept with your account. Changes to a phone number are kept for 8 days, so “This wasn’t me” can undo them.
The family’s admin log (what its admins changed: roles, the head, treasurers, the invite link and similar): kept while the family uses Larlebee, for its admins. Accounts in it are named only while they exist; after you delete yours, it shows “someone who has left”.
The record of what the Larlebee team looked at and did: kept permanently, so it can always be checked.

10. How we keep it safe

Everything travels encrypted (HTTPS).
Photos and recordings are encrypted by us before they leave the server for our backup, and everything in the off-site backup is encrypted where it is stored.
Passwords are stored as one-way hashes; most people sign in with a one-time code instead.
You can see every phone and computer signed in to your account, and sign any of them out. Each new sign-in is told by email (with a “This wasn’t me” button) and on your other devices.
A phone or computer that has only just signed in can’t change your phone number or password, or who runs your family or its money, until it has proved your email or a day has passed.
Anyone can lock an account at larlebee.com/lock if a phone is lost or stolen. Coming back takes a code by email or text and a code from a relative who has spoken to you.
An account that opens far more than anyone would in a day is slowed down, and you and your family’s admins are told.
The team’s admin area is separate from the app, behind its own sign-in with two-step verification, and every action is logged.

No system is perfectly secure. If a breach puts your information at risk, we will tell you and the authorities as the law requires.

11. Your rights

Wherever you live, you can:

See what we hold about you, and download a copy: Profile → Your data → Download my data.
Correct it: edit your own profile, or ask us.
Delete it: Profile → Delete my account (it’s deleted 14 days later; see section 9), or ask us.
Object to how we use it, or ask us to limit it while a question is sorted out.
Withdraw consent for anything that relies on it, such as notifications.
Complain to the data protection authority where you live (see section 13).

We answer within a month, and usually much sooner. We may need to check it’s really you, or that you may act for the person the request is about. These rights are free.

12. Children

You must be 18 or older to create a Larlebee account yourself.
Younger family members join only through a parent or guardian, who sets up their phone with a code from their own account and can remove it at any time. They need no email address or password.
Relatives often record children in the family tree. Their details are kept to close family, and a parent or guardian can ask us to correct or remove them using the request form.
If we learn that a child has set up an account on their own, we will close it.

13. Where you live

Nigeria

The Nigeria Data Protection Act 2023 gives you the rights in section 11. You can complain to the Nigeria Data Protection Commission (ndpc.gov.ng).

United Kingdom and European Union

UK and EU data protection law (the GDPR) gives you the rights in section 11, and the legal bases we rely on are listed in section 5. You can complain to the Information Commissioner’s Office in the UK (ico.org.uk) or to the data protection authority in your EU country.

United States

We do not sell or share personal information, as those words are used in US state privacy laws, and we do not use it for targeted advertising. Anyone in the US can use the rights in section 11. Children under 13 use Larlebee only through a parent or guardian, as section 12 describes.

Canada

Canadian privacy law (PIPEDA) gives you the right to see and correct your information, and to withdraw consent. You can complain to the Office of the Privacy Commissioner of Canada (priv.gc.ca).

Everywhere else

The rights in section 11 are for everyone. Write to us if the law where you live gives you others.

14. Changes to this policy

If we change this policy in a way that matters, we will tell members in the app before it takes effect. The date at the top shows the current version.

15. Ask us to remove or correct something

For anyone, with an account or not. If you’re on Larlebee you can also change your own profile, download your data, or delete your account from your profile.

How Larlebee looks after your family’s information.