Privacy

What Lako keeps

Lako is run by Hyun Wook Kim, a sole trader in New South Wales, Australia (ABN 25 778 059 003), called “Lako” or “we” here. This policy covers the website at lako.sh and the Lako app. We keep:

• Your account: your name, your email address, and how you sign in (an email link, Apple or Google). From Apple or Google we get your name and email address, and from Google also a link to your profile picture. If you use Apple’s Hide My Email, we only see the relay address. With Apple or Google we also keep the sign-in tokens they give us, until you delete your account, and use them for nothing else. When you do, we use Apple’s to revoke Lako’s access. Google’s are deleted but not revoked: you can remove Lako in your Google Account.
• Your sign-ins: when you sign in, we keep the IP address and browser that session started from, for security. It goes when you sign out, or within a day of the session ending. To stop abuse, we also count sign-in emails each day by email address and by IP address (see How long it’s kept).
• Your plans: the plans you make or join, with their title, time, meeting point, notes and cover, and your reply (in or out).
• Your shots: the photos you add, and the time each one was taken.
• Lako Plus, once you start paying for it: the ID of the customer record Stripe makes when you first open its checkout (even if you don’t finish), the checkout you have open, and if you subscribe, the subscription’s ID, monthly or yearly, its status and renewal date. Your card details go to Stripe, never to Lako.
• How Lako is used, and errors: see Analytics and errors.
• Request logs: for each request, the kind of page, whether it worked, how long it took, your country and your Lako user ID. These logs hold no web addresses or IP addresses. Kept for 7 days.

We use this to run Lako for you: to sign you in, show your plans to the right people, keep Lako secure, and fix and improve it. We don’t use it for advertising, and we don’t sell it.

Emails: sign-in links. When a plan you’re in is called off, or a plan you’re part of changes time, we may email you; you can turn that off in Settings or from the email. Before an album with shots is deleted, everyone who’s in gets a reminder 14 days before (again if the date moves because the host’s Plus ends); where Lako Plus is sold, the host’s also mentions it.

Who sees what

Anyone with a plan’s link sees its title, the host’s name, when it is, its cover and how many people are in. Once you sign in to a plan you also see its meeting point, notes and who’s in. People who are in also see the album. The host sees everyone’s reply, including who said no.

The people who run Lako can see account and plan details such as names, email addresses, plan titles and times, to help with support. They see photos, notes and meeting points only when someone reports them.

When you report something, we keep the report (what it’s about, the reason you picked and any note you add) as a record of what we decided. When you block someone, we keep who you blocked, so their shots stay hidden from you; deleting either account deletes it.

Your shots

Location data, and any other camera details apart from the time, is removed from every shot when it uploads. Shots stay in the album until you or the host delete them, the plan is deleted, or the album expires (see How long it’s kept). Undo shows right after you delete a shot; after that it’s gone for good within two days.

Lako keeps no backup copies of shots, so keep your own copies of anything important: Save all in the album downloads every shot at once.

The plan’s cover is the one picture anyone with the link sees. That includes an album shot if the host picks it as the cover. Anyone who can see an album can save its shots, so once a shot is shared, copies may exist outside Lako.

Analytics and errors

To see what works and what breaks, Lako uses two services, both storing data in the European Union. Both get your Lako user ID, never your name or email address.

• PostHog (product analytics): what you open and tap in Lako, linked to your user ID; your device, browser and app version; and your country and region, worked out from your IP address, which PostHog doesn’t keep. On the website’s signed-in pages it may also record how you move through a page, with all text masked and photos hidden; those recordings are kept for 30 days. PostHog never gets your plans, notes, photos, names, email address or invite links.
• Sentry (error reports): when something crashes or fails, a report with the technical details, your device and app version, your user ID and how long things took. Sentry gets no content and no IP address. Kept for 90 days.

Turning it off: Settings › Privacy › “Share usage data to improve Lako”. When it’s off, Lako sends nothing more to PostHog about you. Error reports still go to Sentry, because we need them to keep Lako working. If you sign up from the European Union, the EEA, the UK or Switzerland, it starts off, and stays off unless you turn it on there.

Cookies

Lako’s cookies are its own, and only do these jobs:

• keep you signed in, for 30 days at a time;
• remember your light or dark choice (lako_theme, 1 year);
• remember you’ve already chosen your name, so Lako stops checking (lako_welcomed, 1 year);
• a sign-in in progress: the email address you asked for a link at (lako_signin, 1 hour), an Apple or Google sign-in started from the app (lako_app_social, 10 minutes), or one started on the website (its sign-in state, 10 minutes);
• remember the language you picked (lako_lang, 1 year);
• fill in the email address you last signed in with on this browser (lako_last_email, 180 days; signing out or deleting your account clears it);
• remember what you just did, for an hour at most: a reply you tapped before signing in, the message after an action, the invite link you just turned off, so you can turn it back on (lako_link_off, 5 minutes), the plan you were on when you went to pay (lako_plus_plan, 35 minutes), and that your latest change has been saved, so the next page shows it;
• if you aren’t signed in and aren’t in Europe, a random ID for analytics (30 days);
• shots you reported, so they stay hidden on this browser (lako_hidden, 90 days);
• prompts you closed, so they stay closed on this device (lako_prompts_…, 1 year).

No advertising cookies, and nothing that follows you to other sites.

Who else handles it

These companies handle data for us, only to provide their service:

• Cloudflare runs Lako: hosting, the database, photo storage and email. It runs worldwide, so data may be handled in any country where it operates, including the United States.
• Apple and Google, if you sign in with them.
• PostHog and Sentry, in the European Union (see above).
• Stripe (United States), for people who start paying for Lako Plus: their email address and Lako user ID from us when they open its checkout, and the payment details they give Stripe directly. Never anything about their plans.

So your information may be stored or handled outside Australia and New Zealand, in the European Union, the United States and other countries where Cloudflare operates. We otherwise share it only when the law requires us to, or to protect people from harm.

If you’re in the European Union, the EEA or the UK, your information also goes to Australia, where we run Lako. Where Cloudflare, PostHog, Sentry or Stripe handle it outside those places, our data processing agreements with them include the European Commission’s Standard Contractual Clauses (with the UK’s addendum), or the company is certified under the EU–US Data Privacy Framework. You can ask us for a copy of these safeguards at support@lako.sh.

How long it’s kept

• Your account, until you delete it. A sign-in’s IP address and browser, until you sign out or within a day of the session ending.
• Daily counts that keep Lako within its limits (sign-in emails by email address and by IP address, plans and uploads by user ID): 30 days. Deleting your account deletes the counts under your email address and user ID; those under an IP address stay until the 30 days are up.
• Plans, while they exist, and their albums as below. When a host deletes a plan, its shots are deleted straight away. The plan’s name, the deletion date and who was invited are kept for 180 days, so old links can say what happened; the host’s name is too, until they delete their account.
• Albums, until 90 days after the plan ends, unless the host has Lako Plus, which keeps them while it lasts and for 90 days after it ends. Everyone who’s in (except anyone we’ve banned) is emailed 14 days before an album with shots is deleted. If that email goes late, the album waits until 14 days after it. If someone’s address refuses it for all 14 days, the album goes without it.
• Lako Plus: the customer ID until you delete your account, and a checkout while it’s open. A subscription (Stripe’s subscription and customer IDs, monthly or yearly, status and dates) is kept as the record of what was billed; deleting your account unlinks it from you. Stripe keeps its payment records under its own rules.
• Analytics and recordings, as above; request logs, 7 days.
• Backup copies of the database (account and plan details, not shots), which can include something you deleted: up to 5 weeks.
• Reports, until 180 days after we close them. If a shot with an open report is deleted from its album, we keep its files for review until we close the report, for up to 30 days. Other deletions aren’t held: deleting the plan, the album expiring, or its uploader removing their shots from a plan or with their account deletes it straight away. A shot we hold because the law requires us to keep it stays until we release it, whatever else is deleted.
• If we ban an email address from Lako, a scrambled form of it (a hash, not the address itself) and our reason, even after its account is deleted, so it can’t sign up again.

Deleting your account

Settings › Delete account, on the web or in the app, deletes your name, email address and replies, and signs you out everywhere. Plans you host are deleted for everyone, with their albums, and your name comes off the records of plans you deleted. It cancels Lako Plus straight away and deletes your customer record at Stripe. For shots you added to plans you joined, you choose: delete them too, or keep them in those albums without your name (they show as “Former member”).

Deleting your account also deletes what PostHog holds about you, your events and any recordings, within 30 days: nothing more is sent, and we ask PostHog to delete the rest straight away. Until PostHog confirms it, we keep your user ID (a random ID, not your name or email address) only to finish the job. Error reports hold only your user ID and expire after 90 days. Payment records stay with Stripe under its own rules. Can’t sign in? Write to support@lako.sh and we’ll delete your account for you.

Your rights

Wherever you are, you can ask for a copy of what Lako holds about you, ask us to correct it, or ask us to delete it, by writing to support@lako.sh. We reply within 30 days.

Complaints

If you have a complaint about how we handle your information, write to support@lako.sh. We reply within 30 days. If you’re not satisfied with our answer, you can go to the Office of the Australian Information Commissioner (Australia) or the Privacy Commissioner (New Zealand), as below.

Australia

We handle your information under the Privacy Act 1988 and the Australian Privacy Principles. If you’re unhappy with how we handle a complaint, you can contact the Office of the Australian Information Commissioner (oaic.gov.au).

New Zealand

You have the rights to access and correct your information under the Privacy Act 2020. You can complain to the Privacy Commissioner (privacy.org.nz).

European Union, EEA and UK

Under the GDPR (and the UK GDPR), Hyun Wook Kim is the controller. We use your information to provide Lako to you (contract), to keep it secure and working, including error reports and request logs (legitimate interests), and for analytics only with your consent, which you can withdraw in Settings at any time. You can also ask us to restrict or stop using your information, or to send it to you in a portable format. You can complain to your local data protection authority.

Contact

Email support@lako.sh about anything in this policy, including a request to see, correct or delete what we keep, and a person will reply.

If we change this policy, we’ll update the date at the top, and tell you in Lako or by email before a significant change takes effect.