LEELALUPrivacy
Privacy, in plain words
Last updated: October 3, 2026
This policy covers leelalu.com and the LEELALU app.
This policy covers three different things, and it says which is which. The first is leelalu.com: an introduction to LEELALU, a library of reviewed guides, free tools, and a waitlist. The second is the waitlist itself. The third is the LEELALU app, which is open by invitation to a handful of families while we test it, and which holds a family's own record. Here is everything each one collects, where it goes, how long it stays, and who can read it.
Who we are.
Leelalu, Inc., 1301 N Broadway STE 93372, Los Angeles, CA 90012. Write to hello@leelalu.com and a person answers.
LEELALU is a consumer family-care app, not a clinic or healthcare provider. This policy describes how we handle your data, including the health information described in our Consumer Health Data Privacy Policy.
Where the product actually is today.
LEELALU is an invited beta on iOS, distributed through Apple's TestFlight. A stranger cannot sign up. There are four ways in and no fifth: the public gate is open, which today it is not; your account is on our internal testing list; the email address you sign in with is one we wrote down when we invited you; or somebody already inside a family sent you an invitation and you redeemed it. Nothing here is charged. There is no payment path in the app at all, so we hold no card details and no payment records.
Signing in.
You sign in with your email address and a one-time code. There is no password, so there is no password for us to hold or to lose. Your email address lives with our database and authentication provider and is used to send you the code, to recognise your account, and to reach you about the beta. The list of addresses we invited is stored where no interface can read it: the table has row-level security enabled and no read policy, so only a trusted internal function can consult it.
You can also use the app signed out. In browser practice mode, your care log stays in this browser; signed-out native care entries stay on your device. Typed questions to Lu are sent to LEELALU and may be processed by OpenAI, even when you are signed out. Guest conversations are not saved in your Lu history. Use fictional details when trying the demo. Family accounts are currently available by invitation.
What the waitlist collects.
The waitlist asks for your email address and your consent, nothing else. With it we record the consent time, the policy version (waitlist-2026-08-v1) and which page you joined from. No due date, no stage, no child's name, no browser language.
How the waitlist form reaches us.
When you press Join, a form delivery service (Web3Forms) relays your entry to our inbox. Your email address passes through that service on the way to us. It exists to deliver the entry; the list itself lives with us.
The website's analytics.
Every page of this website, this one included, uses cookieless analytics: a PostHog script served from our own domain, which counts page views with no cookie, no stored identifier and no autocapture. Our guide, tool and blog pages also carry Vercel's performance beacon, which measures loading speed. The counts themselves are sent to PostHog, which therefore sees the page you looked at and the network address you looked at it from. Neither receives your email, any date you typed, or anything you wrote. Every script a page here runs is served from our own domain, never from somebody else's.
Free tools and date calculators.
Our free tools include date calculators (wake windows by age, a contraction timer, a due-date week calculator). Dates you type into a calculator are processed in your browser and may be kept in your browser's local storage so the tool remembers you. They are not sent to us.
The data map
Everything an invited family's account can hold.
This table is the whole inventory, kept in step with the file our release checks read. If something is not in this table, the app does not collect it. Every row of every table below is isolated by row-level security in the database itself, so one family's record is unreachable from another family's session, and inside your family the roles, the visibility scope and the access window you set decide who sees what.
| What | Where it goes | How long | Who can read it |
|---|---|---|---|
| Your email address and the one-time codes you sign in with | Our authentication and database provider | While your account exists | You, and our team for support |
| The address we invited, plus who invited it and a short note | Our database, in a table with no read policy at all | Until we clear the list | Nobody through any interface; one internal function consults it |
| Your family circle, its name, and the seats in it: role, capabilities, visibility scope, access window, status | Our database | While the family exists | The family's adults; a caregiver sees the family only inside their own access window |
| Confirmed facts about an adult: the name you want used, a due date, a birth date, feeding mode, solids status | Our database, one active fact per kind, superseded rather than overwritten | While the family exists, or until you remove the fact | Your family, by the visibility you set |
| The child as a person: a record identifier, a creation time, a guardian, a household. No name, no birth date, no due date | Our database, which refuses the three identity kinds for a child at the table itself | While the family exists | Your family |
| Care events: feeds, sleeps, diapers, times, and a short note you type | Our database | While the family exists, or until you remove the entry | Your family, by role and access window |
| Tasks, the family calendar, care plans and handoff summaries, including the free text in them | Our database | While the family exists | Your family, by role and access window |
| The family chat: message text, and a reference to any photo or video attached | Our database; the file itself rides the Vault | While the family exists. Deleting your own message blanks the text and leaves a visible mark | Every active member of your family, the caregivers you invited included |
| The Family Vault: the words of a moment, and photographs and video | Our database for the words, our provider's media storage for the files | While the family exists, or until you remove the item | Exactly the audience you set per item: only you, owners only, active caregivers, chosen members, or the whole family |
| Your saved conversations with Lu when signed in: your question and Lu's reply | Our database, in your private Lu history | Until you delete the conversation. Guest and Temporary Chat conversations are not saved in Lu history. Switching a saved chat to Temporary deletes its saved history when the change succeeds. Provider processing and retention are separate, as described below | You alone. No owner, guardian or caregiver read path exists |
| The facts you switched on for Lu, on the What Lu Remembers screen | Our database, and from there into a Lu request as quoted data | Until you switch the fact off | You and your family, by the visibility you set |
| Your consent answers, each with the exact text you read, a fingerprint of that text, its version, its language and the app build | Our database | Kept as the record of what you agreed to | You and our team |
| Outing Mode: an outing, its viewers, and, only while you choose live location, raw route points | Our database, raw points in a short-retention store with no interface view | Raw points and unkept routes: 30 days at most, purged by a daily job. Sooner if you stop or delete | The adult on the outing and the viewers they picked |
| Push registration: the notification token your phone issues, and the platform | Our database, and Expo's push service to deliver | Until you sign out or turn notifications off | Our sending job |
| Queued notifications, carrying a generic line and never message text | Our database | 30 days, then purged | Our sending job |
| Audit rows: who did what, when, to which kind of thing | Our database, under an allowlist that admits no free text | While the family exists; content-free rows survive an erasure as its record | Our team |
| Lu safety records, when the safety ledger is switched on: a response identifier, which route answered, the policy and model version, which sources were cited, the language, and whether it was an emergency | Our database | 90 days, then purged by a daily job | Our team |
| Server logs for the Lu endpoint: a request identifier, the route taken, a rule identifier when something was withheld | Our hosting provider's logs | Per our hosting provider's retention | Our team |
Your child, and the honest version of it.
The child's structured person record does not contain a name, birth date or due date; the database rejects those identity fact types for a child. Dates entered in stage settings are stored locally: in browser local storage on the web, and through the phone's secure storage in the native app. The app sends a coarse stage label, such as "child age 3 months", rather than automatically including those exact dates in a Lu request.
Your family's free text can still contain names or dates if you type them. When you save a care note, task, handoff summary, chat message or Vault moment to the shared record, that text is held on our servers. A typed Lu message is also sent for processing, including identifying details you put in it; the structured-field restrictions do not remove them. Please leave out identifying details you do not need to share. Entries keyed to a child are removed when that child's record is erased, while a Vault moment is erased with its author or with the whole family, so a moment whose words mention a child can survive that child's individual deletion. Family deletion covers those Vault items too, subject to the deletion and backup limits below.
Lu, and what leaves your device.
When you type a question to Lu, this is what travels: your message and the recent turns of that conversation, whether you are expecting or already a parent, whether it is night, the derived stage label described above, your language, and the facts you explicitly switched on for Lu. Those facts come from a short allowlist that carries no raw date for anybody, and there are hard limits on how many and how long they can be.
Names and exact dates are not automatically added from your child's stage settings. They can still be sent if you type them into your message or another text field included in a Lu request. This applies when you are signed out as well as signed in.
The Lu endpoint processes the request separately from the app's history storage. Some requests receive a fixed response without a model call, including matched emergency requests. Other requests are sent to OpenAI. We send those requests with the API storage setting switched off; this does not mean zero provider retention. OpenAI's published API policy says content is not used for training by default and abuse-monitoring content may be retained for up to 30 days, unless longer retention is legally required or reasonably necessary to protect its services or others from harm. We do not promise a zero-retention arrangement. See OpenAI's data controls. Our application logs for a Lu request record an identifier and the route, not message text.
When you are signed in with history enabled, your conversation is saved in your private Lu history until you delete it or switch it to Temporary Chat. Guest and Temporary Chat conversations are not saved in that history. These settings do not prevent LEELALU or OpenAI from processing a message you send, and they do not control provider retention. Nobody else in your family can read your private Lu history.
The family chat and the Vault.
Your family has one shared chat. There are no private side-channels, which is the point: what the family says lives where the family lives. Every active member reads and writes it, the caregivers you invited included. Deleting your own message blanks the text and leaves a visible mark rather than silently rewriting your family's history. Photographs and video you attach are Vault items shared with the whole family, and they travel through the same audited pipeline as everything else in the Vault. A push notification about a new message carries a generic line and never the text.
Every other Vault item carries its own audience, chosen by you when you save it: only you, owners only, active caregivers, specific people, or the whole family. An item set to private is not visible to the rest of the family, including other family owners. Your export includes only records you are authorized to access. Removing a photograph removes the file itself within ten minutes, and on the ordinary path within the same request as your tap. Nothing about a face is ever measured or matched, and no Vault item is ever given a public link.
Consumer health data.
Some of what this app holds is health data about you and your child: a pregnancy stage, feeds and sleeps, a question you asked at three in the morning. Washington's My Health My Data Act, and the similar Nevada law, cover exactly this kind of information, and Washington's reaches its residents wherever the company operates. We treat that as our standard everywhere rather than only for people in those states, and we have written it out separately, as those laws expect.
Read the Consumer Health Data Privacy Policy.
There are no analytics in the app.
The app names a closed list of events it would count, and today none of them go anywhere: there is no transport, so nothing leaves your device. When that changes, this page changes first, the list of events is published with it, and your question to Lu, your notes, your dates and your child are not on that list and will not be.
During TestFlight beta testing, Apple automatically collects crash logs and usage information and shares them with us. Testers cannot opt out of this collection while using TestFlight. See Apple’s TestFlight privacy notice for details about this data and any feedback you send.
Who processes data for us.
The services below process data for the functions described here. OpenAI's processing and retention are described in the Lu section above.
- Supabase hosts the database, authentication and media storage. Your record, your files and your email address live here.
- Vercel hosts this site and our server endpoints, including the one Lu answers through, and keeps the request logs for it.
- OpenAI processes some Lu requests, including guest requests, under the API data controls and retention described above.
- Expo issues the push token your phone uses, delivers our notifications to Apple and Google, and serves the app's over-the-air updates, which means it sees your device asking for one.
- Apple distributes the beta through TestFlight and automatically shares beta crash logs and usage information with us, as described above.
- Web3Forms relays waitlist entries from the website to our inbox.
- PostHog counts page views on the pages of this website. It never sees your family record, your account or anything you typed into the app.
If billing ever opens it will run through Apple, and this page will name that before anyone can pay. We will publish a new version of this list before adding anyone to it.
Getting your record out.
You can export from inside the app at any time. The archive is assembled with your own visibility, which means it can never contain a row you could not already see, and it is built and handed to your device in one go rather than queued for a worker. No export file is left sitting in storage anywhere: there is nothing to expire and nothing to leak. The archive lists every photograph and video with its details; the files themselves stay in the Vault, where you can save them.
Deleting, and how long it really takes.
Deletion works from inside the app. What happens next depends on what you are deleting, and these are the timings our code actually keeps.
Your own record.
Filing starts a grace period of 14 days in which one tap takes it back. After the grace, an erasure job that runs once a day removes your facts, your care entries, your consents, your tasks, your calendar items, your handoffs, your notes shared with Lu, your private Lu conversations and messages, your notification settings, your push tokens and your Vault items, and severs and deletes your sign-in account.
The whole family.
Filing freezes the family at once: no new writes, no sync, no AI, export only. The family's record is erased after a 30 day window that exists so everybody in it can take their copy first, and the same daily job does it.
What remains, and why.
A bare identifier with a deletion mark stays where your family's own record still points at it, because erasing that would erase your family's history rather than yours. The executed deletion request itself stays, because it is the legal record that the erasure happened. Audit rows stay, and they are content-free by construction. Tasks you created and calendar entries where you were the assigned caregiver stay with the family, because they are the family's workflow. Nothing in that list contains your words.
Backups, said plainly.
Our database provider keeps point-in-time backups, which is what makes a bad day survivable. We have not yet run a restore drill, and we have not yet built the step that would re-apply your deletion to a restored copy. Until both exist we will not print a backup window here, and we will not tell you your record is gone from every backup the moment it is gone from the live system. The executed deletion request is the durable record that would drive that re-deletion, and building the drill is on our list rather than in this sentence.
If you would rather write to us.
Email hello@leelalu.com and we will do it for you. We will answer within 30 days, and in practice much sooner: there are a handful of families in the beta today.
Correcting and limiting.
Facts are corrected by confirming a new one, which supersedes the old rather than editing it in place, so your record never quietly changes under you. You can take any fact away from Lu on the What Lu Remembers screen, and the change binds the very next answer: if a reply was already in flight when you revoked, it is thrown away rather than shown.
Deleting your waitlist data.
One email to hello@leelalu.com deletes your waitlist data within 7 days. Every waitlist email also includes a way to leave the list.
Children.
The site and the app are for parents and the other adults a family invites. We do not knowingly collect anything from children, a child never talks to Lu or to any free-form AI, and Lu is instructed to decline if a child is on the device. The child in a family's record is a subject the adults write about, with no name and no date on our servers. If we ever build a surface for children themselves, it will follow COPPA and stricter rules of our own, published before it launches rather than after.
Payments.
Billing is closed and checkout is closed. There is no payment path in the app, nobody has ever been charged, and we hold no payment records at all. If paid membership opens later, this page changes first and names the payment processor before anyone can buy.
What we never do.
We do not run ads. We do not sell your data. We do not share it with advertisers, and there is no advertising pixel or cross-context tracker anywhere on this site or in this app. We do not use your family's content to train AI models. These are founding vows of the company, not settings toggles, and they do not change without the founder saying so in public.
Changes to this policy.
When this changes in a way that matters, the date at the top changes with it, and anything you had already consented to gets a new version and a fresh ask rather than a quiet edit.
Questions? hello@leelalu.com. A person answers.