Privacy policy

Last updated: 15 October 2026

Larbin is a personal assistant operated by Yann Jaffrennou (“I”, “me”) for personal use, available as a Telegram bot. This policy explains what data Larbin handles, why, where it is stored and how to get it deleted. Contact: cloud@yannjaffrennou.com.

Who uses Larbin

Larbin is not a public service. It works for its owner and for a small number of people the owner explicitly adds as contacts. Anyone else who writes to the bot only receives a short automatic reply with their Telegram ID; their message is not processed further or stored beyond technical logs.

Data Larbin handles

• Messages sent to the bot on Telegram (text, images and voice messages), and Larbin's replies. Voice messages are transcribed to text; only the text is kept, never the audio.
• Notes and records the owner asks Larbin to keep: reminders, personal notes, activity and sleep data, time tracking and places stayed, and specialists' data (the specialists the owner chose, their goals, plans and progress).
• Web browsing done on the owner's request: the pages Larbin visits and what it does there are recorded in an audit log. The browser keeps no cookies or history between sessions. When the owner takes over the browser through a private link, what they type is passed straight to the page and is neither logged nor shown to the AI model.
• Google Calendar data, only for Google accounts the owner connects: the list of calendars, event details (title, time, location, attendees, description) and free/busy information.
• Technical data: Telegram user IDs used to recognise the owner and contacts, and server logs (timestamps, errors).

How Google user data is used

Larbin requests access to Google Calendar so its owner can ask questions about their schedule, find free time, and create events. Specifically:

• Calendar data is read only when needed to answer a request from the owner (for example “what's on this week?”), or to compute free slots.
• Events are created only on the owner's request, and only in accounts the owner has connected with write access. Some accounts are connected read-only, in which case Larbin cannot change them.
• Contacts of the owner can only learn free/busy windows, never event details.
• To produce a reply, the relevant calendar information is sent to the AI model provider (Anthropic, see below) together with the owner's message.

Larbin's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. In particular, Google user data is:

• used only to provide the assistant features described above to the owner;
• never sold, never used for advertising, and never used to determine creditworthiness or for lending;
• never used to develop, improve or train generalized artificial intelligence or machine learning models;
• not read by any human, except with the owner's explicit consent, when needed for security purposes or to comply with the law, or when aggregated and anonymised for internal operations.

Service providers

• Telegram carries the messages between users and the bot, under Telegram's privacy policy.
• Anthropic provides the AI model (Claude) through its API. Messages, and the data needed to answer them (including calendar information when relevant), are sent to Anthropic to generate replies. Anthropic does not train its models on data sent through its commercial API by default. See Anthropic's privacy policy.
• Google Cloud hosts the server and its storage, in the European Union (Belgium).
• Google provides the Calendar API for connected accounts.
• Mistral AI (France) transcribes voice messages: the audio is sent to its API, which returns the text. See Mistral's terms and privacy policy.
• Websites visited by Larbin's browser on the owner's request receive what any browser sends (the server's IP address, the pages requested, and what the owner asked Larbin to type, such as a search).

No other third party receives the data, and no data is sold. Calendar data is never sent to Mistral AI.

Storage and retention

Conversation history, notes and records are stored on a private server in the European Union. Calendar events are not copied into a separate database; details can still appear in the conversation history or in notes when they were part of a request. Data is kept for as long as the assistant is in use, and deleted when no longer needed or on request.

Security

The server is only reachable through encrypted connections, access is restricted to the operator using SSH keys, and Google access tokens are stored as server secrets, outside the code repository.

Your rights and how to revoke access

• You can revoke Larbin's access to a Google account at any time from your Google Account permissions.
• You can ask for a copy of your data, its correction or its deletion by writing to cloud@yannjaffrennou.com. Requests are handled within 30 days.
• If you are in the European Union, you also have the right to lodge a complaint with your data protection authority (in France, the CNIL).

Website

This website uses no cookies, no analytics and no third-party resources. The web server keeps standard access logs (IP address, page, time) for security, for a limited time. The live view page, used only by the owner, keeps its temporary access link in the browser tab's session storage, which is cleared when the tab closes.

Children

Larbin is not intended for anyone under 16.

Changes

This policy may be updated; the date at the top shows the latest version. Significant changes affecting Google user data will be reflected here before they apply.