Version 1.0 Beta · June 2026
Data controller: Basile Grimaud
Contact: hello@withlarry.app
Service: Larry, available at withlarry.app
This policy explains what personal data we collect, why, and how you can control it. It applies to all users — authenticated accounts and guests.
2.1 Data you give us directly
| Data | Why we collect it |
|---|---|
| Email address | To send you a magic link to sign in |
| Display name | To identify you within your trip groups |
| Avatar photo | Optional, shown to group members |
| Trip details | Project names, dates, places, transport, budgets, comments you create |
| Invite links | To let you share projects with your group |
2.2 Data collected automatically
| Data | Why we collect it |
|---|---|
| Session cookies | To maintain your session and language preference |
| IP address | Collected by our infrastructure providers for security and abuse prevention |
| Usage events | Anonymised feature usage to improve the product |
2.3 Data we do NOT collect
We do not collect payment information (Larry is free during beta). We do not track your location unless you voluntarily enter an address. We do not sell your data to third parties. We do not serve advertising.
We use your data to operate the Service, authenticate you, show you your projects, and enable collaboration with your group. We also use anonymised data to improve the Service, fix bugs, and understand which features are used. If you opt in, we may send you product updates by email.
We use the following third-party services to operate Larry. Each acts as a data processor under our instructions:
| Provider | Purpose | Location |
|---|---|---|
| Supabase | Database, authentication, file storage | EU (Ireland) |
| Vercel | Web hosting and serverless functions | EU / US |
| Anthropic | AI-powered listing analysis (description text only, no personal data) | US |
| Mapbox | Maps and geocoding (coordinates, addresses) | US |
We do not share personal data (name, email, photos) with Anthropic or Mapbox. When listings are analysed by AI, only the listing's description text is sent — no user information.
Supabase and Vercel are GDPR-compliant and offer EU data residency. Our Supabase instance is hosted in EU West (Ireland).
Active accounts: data is retained for as long as your account exists.
Deleted projects: project data is deleted immediately upon hard delete; archived projects retain data until you choose to delete them.
Guest sessions: stored locally on your device; cleared when you clear your browser cookies.
Magic link emails: Supabase retains email send logs for 30 days for deliverability purposes.
As a user in the European Economic Area, you have the right to access, correct, delete, and export your personal data. You may also object to certain types of processing or withdraw your consent at any time.
To exercise any of these rights, email us at hello@withlarry.app. We will respond within 30 days.
You also have the right to lodge a complaint with your national data protection authority. In Portugal: CNPD (Comissão Nacional de Proteção de Dados) at cnpd.pt.
| Cookie | Purpose | Duration |
|---|---|---|
| larry_locale | Stores your language preference (en/fr) | 1 year |
| larry_guest | Maintains your guest session for a project | Session |
| Supabase auth cookies | Maintains your authenticated session | Session / 7 days |
We do not use advertising or tracking cookies.
We take reasonable measures to protect your data. All data is transmitted over HTTPS. Passwords are not used — authentication is via magic links only. Row-Level Security (RLS) ensures users can only access their own data. File uploads are stored in access-controlled Supabase Storage buckets.
Larry is not intended for users under 16. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us and we will delete it.
We may update this policy as the Service evolves. We will notify registered users by email before material changes take effect. The current version is always available at withlarry.app/privacy.