This policy explains what Delulu Lab collects, why, and what you can do about it. It is written to be read, not to be survived.
Who we are
Delulu Lab is operated by Albatross Community Labs LLC, 1501 South Greeley Hwy, Ste C #1173, Cheyenne, Wyoming 82007, United States. For privacy questions, contact hello@delululab.app.
If you are in the EU/EEA or the UK, we are the "data controller" for the information described here. If you are in Türkiye, we are the "veri sorumlusu" under KVKK.
What we collect
Information you give us
- Email address and password. Used to create your account and sign you in. Passwords are handled by our authentication provider and stored hashed — we never see or store your actual password.
- Your Reality Description, Anchor Phrase and chosen symbol, and the emotions you select.
- Check-ins — a 1–10 score and an optional note.
- Signs you log.
- Journal entries and reflections.
- Messages you send to Spark, the in-app AI coach.
- Your practice activity — which meditation sessions you complete and when, your streak, and the embodiment ratings you give after a session.
- Your settings — reminder times, notification preferences, caption and sound preferences, theme.
If you join the early-access list on our website, we collect the email address you enter, and nothing else. That form is separate from the app: it does not create an account, and you can be on the list without ever using Delulu Lab. Reply to any email from us, or write to hello@delululab.app, and we will remove you.
Information created automatically
- Basic technical data needed to run the service, such as timestamps on your entries and sessions.
- Server logs. Our backend logs that a request happened, along with your account identifier, the AI model used, and token counts. We do not log the content of your messages or your journal entries.
What we do NOT collect
- We do not use advertising trackers, and we do not sell your data to anyone.
- We do not collect your contacts, photos, precise location, or health-app data.
- We do not build advertising profiles about you.
Where your data is stored
Your account and everything listed above is stored with Supabase, our hosting and database provider. Access is restricted by row-level security, meaning your data is technically reachable only by your own authenticated account.
Audio recordings you make in "Message to Future You" are stored only on your own device, in your browser's local storage. They are never uploaded to our servers. This has a consequence worth understanding: they do not sync between devices, and if you delete the app or clear its data, those recordings are gone permanently and we cannot recover them.
Spark, the AI coach
Spark is an AI feature. It is not a therapist, counsellor, doctor, or any kind of licensed professional, and nothing it says is medical, psychological, or clinical advice.
How it works, plainly. When you send Spark a message, the following is sent to OpenAI, which provides the underlying language model:
- your message
- your recent conversation with Spark (the last 20 messages)
- a summary of your current app data — your Reality Description, Anchor Phrase, emotions, your three most recent check-ins, Signs and reflections, and your progress statistics
This is what lets Spark give answers relevant to your actual practice instead of generic ones.
What this means for you. Personal reflections you write in Delulu Lab may be sent to OpenAI to generate Spark's replies. OpenAI processes this data as our service provider. Per OpenAI's API policy, data sent through the API is not used to train their models.
If you would rather this did not happen, do not use the Spark tab. The rest of the app works fully without it.
Your conversations with Spark are stored in your account so the thread is there when you return. You can delete the entire conversation at any time using "new chat" in the Spark screen.
Why we are allowed to use your data
If you are in the EU/EEA, the UK, or Türkiye, our legal bases are:
- Performance of a contract — we need your data to give you the service you signed up for.
- Your consent — for notifications, and for using the Spark AI feature. You can withdraw either at any time.
- Legitimate interests — keeping the service running, secure, and free from abuse.
Some of what you write may reveal information about your mental or emotional state. Where that counts as a special category of personal data, we rely on your explicit consent, given by choosing to write it in the app. You can withdraw that consent by deleting the entries or your account.
Sharing
We share your data only with the providers needed to run the service:
| Provider | What they receive | Why |
|---|---|---|
| Supabase | Your account and app data | Hosting, database, authentication |
| OpenAI | Your Spark messages and the app-data summary described above | Generating Spark's replies |
| Vercel | Standard technical request data | Serving the app |
| Netlify | Your email address, if you join the early-access list, plus standard technical request data | Serving our website and receiving that form |
| Apple / Google | Purchase and subscription data, if you subscribe | Processing payments |
We do not sell your personal data. We do not share it for advertising.
International transfers
Our providers may process your data outside your country, including in the United States. Where required, these transfers rely on Standard Contractual Clauses or an equivalent safeguard.
How long we keep things
- While your account exists: we keep your data so the app works.
- When you delete your account: your data is deleted from our systems. This is immediate and permanent, and cannot be undone.
- Backups: may persist for a short period before being overwritten.
Your rights
You can:
- See your data — Settings → Export my data gives you everything in a file.
- Correct it — edit your anchor, reality, and entries directly in the app.
- Delete it — Settings → Delete account removes your account and everything in it. You can also delete individual entries, or your whole Spark conversation.
- Withdraw consent — turn off notifications, or stop using Spark.
- Object or restrict — contact us at hello@delululab.app
- Complain — to your local data protection authority. In Türkiye that is the KVKK; in the EU, your national authority; in the UK, the ICO.
To delete your account without opening the app, email hello@delululab.app from your registered address and we will delete it within 30 days.
If you are in California
Under the CCPA/CPRA you have the right to know what personal information we collect and why, to request deletion of it, to correct it, and to opt out of its "sale" or "sharing". We do not sell or share your personal information, and we do not use it for cross-context behavioural advertising. We will not discriminate against you for exercising any of these rights. To make a request, email hello@delululab.app.
Children
Delulu Lab is not intended for anyone under 16. We do not knowingly collect data from children. If you believe a child has created an account, contact us and we will delete it.
Security
Data is encrypted in transit. Access is restricted per account by row-level security. Our AI provider key and all server-side secrets are held on the server and are never present in the app you download.
No system is perfectly secure, and we cannot guarantee absolute security.
Changes
If we change this policy in a way that materially affects you, we will tell you in the app before it takes effect.
Contact
hello@delululab.app — privacy questions, data requests, account deletion.