Privacy policy

Version 7 November 2026 · Applies to the Inglenook Android app (nl.stormlantern.inglenook), the hubs under hub.inglenook.nl and this website. This is a translation of the Dutch privacy policy; where they differ, the Dutch text applies.

In short

Inglenook is in a closed alpha. Each household has its own hub. It runs at Stormlantern, in Google Cloud in the Netherlands, for that household only.
Inglenook listens only after you tap to talk in the app, and only until the conversation is over.
We do not keep audio. Only when you report a conversation yourself with "Dit ging mis" ("That went wrong") is that conversation's audio kept.
For every conversation the hub keeps a text record (30 days) and a short summary (90 days).
Inglenook uses your calendar only to answer your questions, in your conversations.
We sell nothing, show no ads and train no AI models on your data.

1. Who is responsible

Inglenook is made by Stormlantern. Stormlantern is responsible for the data in this policy (the "controller" under the GDPR).

Stormlantern, sole proprietorship (eenmanszaak), Chamber of Commerce (KvK) 42122520
Privacy questions and requests: privacy@inglenook.nl

This policy fits the alpha tester agreement, which you see in the app before you start. Where one is stricter than the other, the stricter applies.

2. How Inglenook works

You talk to Inglenook through the app on your Android phone. The app sends your voice to your household's hub. The hub passes it on to Gemini, Google's speech model, and plays the answer. When needed, the hub looks something up: the weather, a place, a route, your calendar or something on the web.

During the alpha your hub does not run in your home but at Stormlantern, in Google Cloud in the europe-west4 region (the Netherlands). Every hub has its own storage and its own service account, separate from other households'.

Inglenook hears everyone in the room. What a housemate or visitor says while a conversation is open therefore also goes to the hub and to Gemini. Tell the people you live with.

3. What data, why and for how long

Your voice

What: The sound from your microphone, only while a conversation is open. There is no wake word: Inglenook listens only after you tap to talk in the app.
Why: To understand you and answer. The audio goes through the hub to Gemini in Google Cloud, called in europe-west4.
How long: The hub never writes audio to storage, except for a conversation you report (see "Reported conversations"). So that you can still report a conversation, the hub holds the audio of the last conversation in memory, at most its last 10 minutes, until 10 minutes after it ended or until the next one starts. Then it is gone. Google keeps what the model receives in memory for at most 24 hours: to resume an interrupted conversation (the hub turns this on) and as a cache. Google may log requests to the model to detect abuse.

The record of a conversation

What: For every conversation the hub keeps a text record: what was said and heard, and what Inglenook did, such as what she looked up and what that returned. For web searches it holds the search queries and the websites of the sources. The hub removes coordinates from the record; of your phone's location it holds only whether there was one and how many kilometres from home, rounded. In the alpha app (the version from Google Play) your phone also sends events for every conversation: the state of the connection, error messages, what was on screen, what was played and the app version. They contain no text from the conversation and not where you are.
Why: To find out what happened when something went wrong, and to run the service.
How long: 30 days. Then the hub deletes the record automatically. The record reaches us only if you report the conversation (see "Reported conversations").

Summaries

What: After a conversation a Google language model (Gemini, in Google Cloud's EU region) writes a short summary. The hub keeps it, with who took part and when.
Why: So that you can see in the app what a conversation was about, and so that Inglenook knows in a new conversation what you talked about in the last 3 hours. Only your own conversations are used this way, never a housemate's.
How long: 90 days after the conversation. Then the hub deletes the summary automatically.

Your name, voice and agreement

What: The name Inglenook calls you, the voice you choose, and when and which version of the alpha tester agreement you accepted.
Why: To call you by your name, in the voice you chose, and to know whether reported conversations may be sent to us.
How long: Until you change them in the app or ask us to delete them. If you leave the household, we delete them within 30 days. If the household stops, we delete everything of the household within 30 days.

Home

What: The point on the map your household sets as home, precise, and the name of that place. Your phone finds the point and looks up the place name with Google (through Android). It goes to the hub only once you confirm. Everyone in your household uses the same home.
Why: For the weather at home and travel times to and from home.
How long: Until someone in your household changes it, or you ask us to delete it. If the household stops, we delete it within 30 days.

Your phone's location

What: If you have allowed the app to use your location, it sends where your phone is, precisely, each time it connects to the hub. Only while the app is in use; the app does not ask for background location. If you refuse, Inglenook still works, and asks where you are when she needs to.
Why: As the starting point of a route or travel time ("should I leave yet?").
How long: The hub holds the location in memory while the connection is open, and does not store it. The record holds only how many kilometres from home you were, rounded.

Places you mention

What: The places your household looks up: the name, Google's place id and how often. No coordinates.
Why: So that Inglenook understands "the baker" or "grandma" straight away next time.
How long: Until you ask us to wipe them. If the household stops, we delete them within 30 days.

Searching the web

What: For questions about the news, opening hours and the like, Inglenook can search with Google Search ("Grounding with Google Search" in Vertex AI). The model writes the search query from the conversation.
Why: To answer questions Inglenook does not know herself.
How long: The record keeps the queries and the sources' websites for 30 days. Google keeps the queries for up to 3 days.

Weather, places and traffic

What: For the weather the hub sends the coordinates of your home, or of the place you ask about, to Open-Meteo, rounded to about a kilometre. For a route or travel time it sends start and end, precisely, to Google Maps Platform. It looks up a place with Google Maps Platform by the name as Inglenook heard it. Roadworks and traffic jams come from a public feed of the NDW (the Dutch national road traffic data portal); nothing about you is sent with that.
How long: The hub does not keep these answers, except what is in the record (30 days) and the summary (90 days). Open-Meteo keeps its server logs, which may contain those rounded coordinates, for up to 90 days.

Your phone and your access

What: A phone joins the hub with a one-time invitation link, which someone in your household makes in the app. After that the phone has a key of its own. The hub keeps only a hash of it, with a label for the device and when it joined. The key itself is stored encrypted on your phone.
How long: An invitation works once, for at most 7 days. The device stays known until someone in your household removes it in the app, or we revoke it, for instance for a lost phone. Removing it in the app only signs the phone out; your name, summaries and calendar link stay until you ask us to delete them (see "Having your data deleted").

Reported conversations (alpha diagnostics)

What: When you report a conversation with "Dit ging mis", the hub makes a bundle of it: the record, the audio if it was still held (at most 10 minutes), your phone's events and your note.
Why: To find out what went wrong and fix it.
Who: The two people who build Inglenook. They use Claude, by Anthropic, as a tool to read the record.
How long: On the hub, 30 days. If you accepted the alpha tester agreement, the hub sends the bundle to us. We keep it for 30 days and delete it then, or sooner if you ask. Without your agreement nothing is sent to us.

Technical logs

What: The hub keeps a log: ids of devices, people and conversations, the kind of event, how long something took, how it ended and error messages. No conversation text, no search queries, no names and no coordinates. An IP address appears only for a connection the hub refuses. In addition Google Cloud keeps a request log of every request to the hub, with your phone's IP address.
Why: To find faults and prevent abuse.
How long: 30 days, Google Cloud Logging's default.

On your phone

The app keeps your access key (see above) and, in the alpha, a conversation's events until they reach the hub. No audio. The app contains no analytics, no ads and no third-party crash reporting, does not read your Google account's email address, and makes no backup to Google Drive.

This website

This site sets no cookies, uses no JavaScript and loads nothing from other sites.

4. Legal basis

Contract (Article 6(1)(b) GDPR): what is needed to make Inglenook work: conversations, your name and voice, home, location, calendar, search, the record, summaries and your access.
Consent (Article 6(1)(a) GDPR): alpha diagnostics, that is, reported conversations, with audio, being sent to us. You give this consent in the app and can withdraw it at any time.
Legitimate interest (Article 6(1)(f) GDPR): technical logs for security and fault-finding, and what housemates and visitors say while a conversation is open.

In addition Android (microphone, location) and Google (your calendar) ask for your permission themselves. You may refuse; Inglenook can then do less.

5. Your Google Calendar

You can link your own Google Calendar to Inglenook in the app. You don't have to.

What access Inglenook asks for

You sign in with Google with your own account. Google then asks whether Inglenook may view and edit the events in your calendar (the scope https://www.googleapis.com/auth/calendar.events). Inglenook asks for this scope now so that you need not link again once she can create or move events for you. Today Inglenook only reads: she does not create, change or delete events. Before that changes, it will be in this policy.

What Inglenook reads

When you ask about your calendar, the hub reads the events in your primary calendar in the period you ask about: the title, start, end and location.

What Inglenook does with it

Only answer your questions about your day, in the conversation. For that, the events go to Gemini, Google's speech model in Google Cloud, which turns them into the answer. She may use an event's location to look up the travel time with Google Maps Platform.
Only your conversations use your calendar. Housemates do not get your calendar. Whoever is in the room when Inglenook answers does hear the answer.
No selling, no advertising, and no transfer to anyone other than the Google services that make Inglenook work, unless the law requires it.
No training. We do not use data from Google Workspace APIs, such as your calendar, to develop, improve or train generalized or non-personalized AI or ML models. Under its terms for Vertex AI, Google does not use our data to train its models.
Nobody at Stormlantern reads your events, unless they appear in a conversation you report yourself, or where security or the law requires it.

What is stored

The hub does not store your events. It stores the key Google issues to use your calendar (a "refresh token"), for you alone, on your hub's storage. That key is never in a log or record. What Inglenook says about your events is in the record (30 days) and may be in the summary (90 days).

Unlinking

When you unlink in the app, the hub revokes the key at Google and deletes it. You can also remove the access in your Google Account, at myaccount.google.com/connections.

Google API Services User Data Policy

Inglenook's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

6. Who processes the data for us

Google Cloud: the hubs (Cloud Run), their storage (Cloud Storage), the logs (Cloud Logging) and the models (Vertex AI: Gemini Live for conversations, Gemini for summaries).
Google Maps Platform: looking up places (the name as heard) and routes (start and end).
Google Search, through Grounding with Google Search in Vertex AI: search queries.
Open-Meteo (OpenMeteo GmbH, Switzerland): rounded coordinates for the weather.
Anthropic (Claude): the record of conversations you report, to read it for us. Only if you accepted the alpha tester agreement.

On your phone, Android uses Google's services to find your location, look up the place name of home and let you sign in with Google for your calendar. Google Play delivers the app.

We share your data with no one else, and do not sell it.

7. Where your data is

Your hub and its storage are in the Netherlands (europe-west4). The hub calls Gemini Live in europe-west4 and the summary model in Vertex AI's EU region. Google Search and Google Maps Platform may also process your data outside the EU. Open-Meteo is in Switzerland.

8. Security and who has access

All connections between the app, the hub and the services it uses are encrypted (TLS). Google Cloud encrypts all storage.
Every household has its own hub, storage and service account. One hub cannot reach another's.
Every phone has its own key, which your household or we can revoke. Repeated failed connections are locked out.
We run the hubs, so technically we could read conversations. We only look at conversations you report yourself.
A hub's storage keeps no versions and no trash: what is deleted is gone. We make no backups.

9. Your rights

You may access, correct, delete or port your data. You may object, or ask us to restrict what we do with it. You can change your name, your voice and home yourself in the app, and unlink your calendar there.

You withdraw your consent to alpha diagnostics with a message to us. We then send nothing more to us, and delete what we have.

Send your request to privacy@inglenook.nl. We answer within a month.

If you are not satisfied with how we handle your data, you can complain to the Dutch Data Protection Authority, the Autoriteit Persoonsgegevens.

10. Having your data deleted

The app cannot yet delete your data or your place in the household by itself. Until it can, it goes by message: see inglenook.nl/verwijderen for how, and what we then delete.

11. Children

The alpha is for adults. The app is not meant for children under 18. Inglenook does hear everyone in the room, children too. Do not report a conversation in which a child can be heard if you do not want to. If you think we hold a child's data, send us a message and we will delete it.

12. Changes to this policy

When this policy changes, we put the new version here, with a new date. Before we use your data in a new way, including data from your Google Account, we tell you in the app or by message, and ask for your agreement again.