Privacy Policy

What we never do

Lammirian shows no ads and earns nothing from advertising. Our revenue is subscriptions and the partner commissions described in Partner links in scenario results. We do not sell your data, and we do not share it with advertisers. The AI providers that answer your requests keep nothing after answering: we use only endpoints with zero data retention, as AI processing explains. This holds for every kind of data in this policy, including what you connect from banks and other apps.

Who runs Lammirian

Lammirian is operated by Emil Kobekbayev, an individual developer in the Republic of Kazakhstan. He decides how your personal data is used and is responsible for it. When a company is registered to run Lammirian, we will name it here and tell you in the app.

For any privacy question or request, email support@lammirian.com.

Data we collect

• Account data. Authentication is handled by WorkOS (AuthKit). Depending on how you sign in, we receive details such as your email address, name, profile image, and the identifiers needed to connect your Lammirian account. Sign-in options include Google, Apple, and a one-time code sent to your email.
• Profile details. Your date of birth, gender, country, and city, and your answers on the Lifestyle tab of your profile: housing, work, household, children, car, pets, and travel. Lammirian guesses your country and city from your phone's region and time zone during setup, and you can change them. We use these details to tailor forecasts, what-if scenarios, and greetings.
• Lifestyle health answers. The Lifestyle tab also asks whether you smoke, whether you have health insurance, what diet you follow, and whether you exercise. We treat these answers as sensitive data. They are optional, and the app asks for your separate, explicit consent before saving them. We use them only to tailor forecasts, what-if scenarios and the assistant's answers to you. To do that they are sent to our AI providers, which keep nothing (zero data retention), and they are never used to train AI models. You can delete them, or withdraw your consent, at any time on the Lifestyle tab; withdrawing consent deletes the saved answers.
• Financial data you provide. This includes accounts, balances, transactions, categories, budgets, recurring items, plans, notes, and other information you choose to enter. The app also keeps local data so core features can work offline and sync when a connection is available.
• Connected-bank data. If you choose to connect a supported US bank through Plaid, Lammirian receives read-only account, balance, and transaction data. Plaid handles your bank credentials; Lammirian does not receive them.
• Photos and files. Receipt photos you attach to transactions and photos you send in chat are stored with your account until you delete them or the account. Files you attach in chat, such as PDF, text, CSV, Markdown, or JSON files, are stored with the text extracted from them. Bank statements you import as a PDF, CSV, or photo are deleted after they are read, and always within a day of upload.
• Messages and other content. Your assistant chats, group chats with agents, messages to our support team, transaction notes, split descriptions, scenarios, and the agents and skills you create.
• Connected-app data. On Pro and Max you can connect apps through plugins. Lammirian reads data from a connected app, such as emails or calendar events, only when the assistant needs it to answer one of your requests, and uses it only for that request. What the assistant reads can appear in its replies, which are saved in your chat history. The sign-in tokens for connected apps are stored encrypted on our agent runtime at Cloudflare, not in our main database. You can disconnect an app at any time in Settings → AI → Plugins. See Connected apps for the full list, how long we keep this data, and how to revoke access.
• Data shared with other users. When you use splits and friends, the people you split with can see the shared expense details and amounts owed between you, and may receive push notifications about them. If you create a public link for a split or event, anyone with that link can view the shared read-only details without creating an account. You can disable the link or replace it with a new one in Lammirian.
• Device and usage data. PostHog records which screens and features you open, app start and background events, and basic device information. We use it to find problems and spot patterns, for example an issue that affects only one region. These events are pseudonymous, not anonymous. They carry a random app user key that we create for your account, along with your country, plan, currency, and language, but not your name or email address. Before you sign in, PostHog uses a random device ID. We do not use PostHog to track you across other apps. We also store your device push token so we can deliver notifications you have enabled.
• Approximate location. Lammirian does not ask for location permission and does not collect your precise location. PostHog derives an approximate location, such as your country and city, from the IP address your phone connects from, and stores it with your analytics events.
• Crash data. Sentry receives technical diagnostics when the app fails, including device, operating-system, app-version, and error details, plus performance traces for some sessions. Crash reports carry the same pseudonymous app user key. This helps us find and fix crashes.
• Turning off analytics. When you turn off Share diagnostics in Settings → Other → Diagnostics, the app stops sending events to PostHog and Sentry.

AI processing

Lammirian's AI features include assistant chat, voice transaction parsing, photo/receipt analysis, note analysis, and what-if scenarios. Some of them run on cloud AI. Before the first cloud AI request, the app asks your permission and lists who receives the data. Nothing goes to a cloud AI provider until you allow it, and you can withdraw permission in Settings → Other → Diagnostics. AI that runs on your phone, such as Apple's on-device model on iPhone or Gemini Nano on Android, does not send your input to any AI provider.

When you use a cloud AI feature, your prompt and the context needed to answer it, such as the transactions and account details involved, go through our backend and OpenRouter to the model provider. When you ask the assistant to use an app you connected, what it reads from that app, such as emails, calendar events, files, or notes, goes the same way. These companies receive that data:

• OpenRouter, which routes each request to a model.
• Microsoft Azure, which runs the OpenAI GPT models.
• Amazon Bedrock or Google Vertex AI, which run Anthropic's Claude models: the assistant on the Free and Plus plans, the backup for the GPT models, and the second try at reading an imported statement.
• TypeSafe, which decides which model answers a chat message (details below).
• Parallel and Exa, which run web searches.

Our backend and our agent runtime tell OpenRouter to use only provider endpoints that do not train on your data and do not keep it after answering (zero data retention). If a model has no such endpoint, the request fails instead of going to a provider that keeps data.

When you dictate a transaction, a chat message, or a split, your phone's speech recognition, Apple's on iPhone and Google's on Android, turns your speech into text, and Lammirian receives the text. Depending on your phone and its settings, Apple or Google may process the audio on their servers under their own privacy policies. Lammirian never receives the audio and does not keep it.

When the assistant searches the web for you, the search query goes through OpenRouter to Parallel, or to Exa if Parallel fails. Your chat message, a few recent turns of the chat, and your country, city, currency, and language are sent to TypeSafe, which decides which AI model should answer. TypeSafe does not receive your transactions, balances, or name.

A what-if scenario may include a summary of your financial data. It may also use public web research when current outside information would improve the result. Public data services, such as the World Bank, Eurostat, FRED, Adzuna, and Travelpayouts, receive only search terms like a country, a city, a job title, or a flight route and dates. They do not receive your name, email address, or account details. Public research is combined with your request to produce the scenario; it does not make your private financial data public.

Partner links in scenario results

A what-if scenario can suggest offers, such as flights found through Travelpayouts. Some of these are partner links: if you open one and buy something, we may earn a commission from the seller or the partner network. We use partner services to find you the best deal, because a search of the whole market is not something we can build ourselves yet. Offers are ordered by price, cheapest first, and our commission does not change that order. We look up an offer by the route and dates in your scenario, not by who you are. Once you open a partner link, the partner's site handles your visit under its own privacy policy, and it may use cookies to record that the visit came from Lammirian.

Connected apps

On Pro and Max you can connect Gmail, Google Calendar, Google Drive, Google Sheets, Google Docs, Google Slides, Outlook Mail, Outlook Calendar, OneDrive, Notion, Trello, Airtable, Todoist, and Granola. Lammirian uses what it reads from a connected app only to answer the request you made. That data never goes into the AI-improvement records described below, and, like all your data, it is never used for advertising and never sold.

Our main database keeps what an app returned only while the request that asked for it is running. When the request ends, we replace it with a short note naming the app and the action, and we do the same with the details of any app action the assistant asked you to approve. An hourly check does this for anything older than 24 hours that was missed. Disconnecting an app removes what it returned in earlier requests, cancels its actions still waiting for your approval, and deletes its sign-in token. Deleting a conversation deletes its assistant requests along with their app records and approvals.

Our agent runtime deletes the working data of a request, including what it read from your apps, 1 day after the request ends. It keeps the request's status and the assistant's final reply for 3 days. A request that hands work to another agent can run for up to 48 hours before it ends.

The assistant's replies are saved in your chat history and can quote or summarize what it read from an app. They stay there until you delete the conversation, even after you disconnect the app.

For Google apps, Google requires this statement: "The use of information received from Google Workspace scopes will adhere to the Google User Data Policy, including theLimited Use requirements." You can also remove Lammirian's access from your Google Account at myaccount.google.com/permissions.

For Microsoft apps, you can remove Lammirian's access at Microsoft as well as in the app. For a personal account, go to account.microsoft.com/privacy/app-access. For a work or school account, go to the My Apps portal at myapps.microsoft.com.

Help improve AI

The Help improve AI setting in Settings → Other → Diagnostics is off by default. We collect nothing for it unless you turn it on. While it is on, we keep a record of your AI interactions and may use it to evaluate and improve Lammirian's AI, including training models that only Lammirian uses. We never use these records to train open-source models, and we do not sell or publish them. A record holds your message, the recent conversation, the assistant's reply, the names of the model and tools it used, token counts, and timing. Images and audio are left out. We also record whether you accepted, rejected, or regenerated an AI result, which fields you changed after the AI filled in a transaction from voice, a receipt, or a note, and your thumbs-up or thumbs-down ratings with any reason you type.

Some things never go into these records. Data from banks you connect through Plaid is never used. When the assistant reads a connected app, the app content is replaced with a note that it was left out, and so is every reply the assistant wrote after reading it. What the assistant remembers about you and your profile details are cut from the instructions stored with a record. We do not record memory updates, chat and scenario suggestions, or the queries the assistant sends to web search.

Records carry your internal Lammirian user ID, not your name or email address. We do not remove personal details from the text of your messages, so a record can contain anything you wrote or the AI replied.

While this setting is on, changing a transaction's category also counts as your vote for that merchant's category in your country. We keep one vote per person for each merchant and country. Other people see only the leading category, and only after at least 5 people have voted and at least 60% of them agree. Income, transfers, transactions from Plaid, and merchant names that look like a person's name or contain contact details are never counted.

Turning off Help improve AI stops new records and deletes the ones we already have for you: your interactions, corrections, and ratings. It also removes your merchant category votes. After that, a thumbs rating you give is still saved, without a reason, so the app can show it. Deleting your account deletes all of these records and votes too.

From these records we may keep aggregated, de-identified statistics, such as how many requests asked for a kind of task or how often the AI picked each category label. These statistics contain no message text and cannot be linked back to you, so they stay after your records are deleted. The standard instructions Lammirian sends to the model are stored once, separately, with no user ID and none of your memory or profile details.

Android notification access

On Android, Lammirian can capture transactions from bank push notifications. This feature is disabled by default and requires your explicit permission. When enabled, matching notifications are parsed locally on your device. Notification access is optional and can be turned off in Android settings.

Subscriptions and payments

Lammirian offers paid subscriptions billed through the App Store or Google Play. RevenueCat helps manage subscription status. Apple or Google processes the purchase through the App Store or Google Play, so Lammirian does not receive your full payment-card details. Those companies handle payment information under their own privacy policies.

Why we are allowed to use your data

We rely on these legal bases, depending on the data and where you live:

• Contract. We need your account, financial, and profile data to provide the app you signed up for: sync, forecasts, splits, the assistant, subscriptions, support, and account deletion.
• Consent. We ask first before we send data to cloud AI, keep Help improve AI records, save Lifestyle health answers, connect a bank through Plaid or an app through a plugin, read Android notifications, send push notifications, or transfer your data abroad. You can withdraw consent at any time in the app or by email. Withdrawing it stops further use but does not undo processing that already happened.
• Legitimate interests. We use product analytics and crash reports to find and fix problems, check that requests come from a genuine copy of the app to prevent abuse, and keep the aggregated, de-identified statistics described above. You can turn off analytics and crash reports in Settings.
• Legal obligation. We keep records the law requires and answer lawful requests from authorities.

Service providers

These companies process data for us to run Lammirian. They act on our behalf, and we do not sell your data to them or anyone else. Each of them is bound by a data processing agreement or terms that require it to protect your data with the same or equal protection as this policy.

• Convex stores your synced data and files and runs our backend.
• WorkOS handles sign-in and holds your email address and name.
• OpenRouter passes AI requests and web searches to the companies listed in AI processing: Microsoft Azure, Google Vertex AI, Amazon Bedrock, Parallel, and Exa.
• TypeSafe picks which AI model answers a chat message.
• Cloudflare runs the assistant's agent runtime. It stores connected-app sign-in tokens and the assistant's cloud browser profile, both encrypted.
• Plaid connects US banks, read-only, on paid plans.
• RevenueCat tracks your subscription status.
• PostHog receives product analytics.
• Sentry receives crash reports and performance traces.
• Expo delivers push notifications through Apple's and Google's push services.
• Resend sends email for us. Today it sends our support inbox a notice with the ticket number, your plan, and the subject when you write to support, never the message itself. If we turn on sign-in links by email, it will also receive your email address to send them.
• Vercel hosts this website, including the pages that open shared split links and links into the app. It receives the usual request data from visitors, such as IP address and browser type.
• Travelpayouts returns flight prices and partner links for what-if scenarios. It receives the route, dates, and currency of a trip, not your identity.
• Apple and Google handle Sign in with Apple, Sign in with Google, store purchases, and the checks that a request comes from a genuine copy of the app.

Where your data lives

Your synced data is stored with our backend infrastructure provider, Convex, in the United States, and is protected in transit and at rest. Most of our service providers also process data in the United States. Sentry stores crash reports in the European Union, in Germany. Our AI, analytics, and crash providers process only the data described above.

If you use Lammirian from Kazakhstan or another country, your personal data is transferred to and processed in the United States, where data-protection law may differ from yours. We transfer it only with your consent. When you continue past the app's welcome screen, you agree to this policy and to this transfer. If you do not agree, do not create an account, or delete it.

Retention and account deletion

We keep personal data while your account is active and as needed to provide the service, resolve security or billing issues, and meet legal obligations. Data stored locally remains on your device until the app or its data is removed.

A transaction you delete goes to Recently deleted in the app, where you can restore it for 30 days. After 30 days, or when you choose Delete now, it is removed for good. Deleting your account removes Recently deleted right away.

Convex makes a daily backup of our database, and we keep each backup for 7 days. Data you delete, including a deleted account, leaves our backups within 7 days.

When you delete your Lammirian account, we delete the personal data tied to it from our active systems, including all of your Help improve AI records, merchant category votes, and Lifestyle health answers. We also delete your WorkOS identity, your RevenueCat customer record, and your PostHog person profile, and we remove your connected banks at Plaid. Analytics events already recorded stay in PostHog under your pseudonymous app user key, and crash reports stay in Sentry until its retention period ends. Store purchase records may also be kept by Apple or Google under their own retention rules.

Our account deletion page explains how to delete your account in the app or by email, lists what we delete and what we keep, and shows how to delete part of your data without deleting the account.

Your choices and rights

You can review and change information in the app, delete transactions, chats, and other items, delete your Lifestyle health answers, disconnect a linked bank or a connected app, revoke Android notification access, turn off analytics, withdraw permission for cloud AI, turn off Help improve AI and delete its records, or delete your account. Depending on where you live, you may also have rights to access, correct, export, restrict, or delete personal data, to object to certain processing, and to complain to your data-protection authority.

To make a privacy request or ask a question, email support@lammirian.com. We may need to verify that the account is yours before completing a request.

Children

Lammirian is for adults. You must be at least 18 to use it, and it is not intended for children. We do not knowingly collect data from anyone under 18. If you believe someone under 18 has created an account, contact us and we will delete it.

Changes to this policy

We may update this policy as Lammirian changes. If an update materially changes how we use personal data, we will provide notice in the app or by another reasonable method.