Lobo — privacy notice

Last updated 11 August 2026 · back to Lobo

Lobo is a household assistant used through WhatsApp, operated by Elad Segev as an invitation-only pilot for friends and family. Contact: segev.ai.bot@gmail.com.

This notice is written to be read, not to be survived. If anything here isn't true of what Lobo does, that's a bug — please tell us.

What Lobo collects, and why

Data	Why
Family members' names, roles, phone numbers	To know who's who and reach the right person
Dates of birth or ages, if you give them	Birthday reminders; age-appropriate chores
Your messages to Lobo, and its replies	To do what you ask, and to remember the conversation
Reminders, chores, lists, occasions, calendar entries, contacts	The features themselves
Health-habit items (e.g. "drink water", a medication reminder)	Only if you opt in. Lobo tracks and reminds — never medical advice
Money information (bills, budgets, statements, card-charge texts)	Only for the household owner, and only if they use it
Photos and PDFs you send	To read them, or hold them for you
Google Calendar events, if you connect it	See the section below

Google Calendar

Connecting your Google Calendar is optional, and nothing about Lobo requires it.

What we ask for: the calendar.events permission — enough to read, add, change and delete events. It cannot create or delete whole calendars, or read your Google account settings. We also read your email address, so Lobo can tell you which account is connected.
What we do with it: answer your questions about your own schedule ("when am I free?"), and add or remove events when you ask.
Where it goes: events are fetched when needed and used to answer you. The connection itself (the credential Google issues) is stored encrypted with your family's key, on the operator's own machine. Nothing is sent to any third party, sold, or used for advertising.
Who else in your family sees it: nobody, unless you say so. Connecting your calendar is not the same as sharing it. You choose private (default — only you), busy (others learn only when you're occupied, never what it is), or full (others see details and can add to it), and you can change or withdraw that at any time. Nobody else can change your setting for you.
Turning it off: tell Lobo "disconnect my calendar", and/or remove access at myaccount.google.com/permissions. Either stops it.

Lobo's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Google Calendar data is never used to train or improve any AI model, never sold, and never used for advertising.

How it's protected

Encrypted from the start. Names, phone numbers, children's details, health items, money data, photos and your messages are encrypted with a key unique to your family. The master key is held outside the database.
Your family is walled off from every other family — enforced by the database itself, not only by the application.
Backups are encrypted too, and deleting your family destroys its key, which makes the data unrecoverable.

Who can see your data — the honest part

Your family

Through Lobo, with limits: money is owner-only, couple notes are parents-only, and children see less.

The AI model

To understand you and reply, your messages are processed by Google's Gemini model. Money analysis is anonymised — shop names are replaced with tokens — before anything is sent.

The operator

This is a hands-on pilot run by a person, so the operator can see your family's general information: your messages and Lobo's replies, names, reminders, chores, lists, occasions, calendar and saved contacts. This is to run the service, fix faults and decide what to build next.

Three things specifically put your words in front of him: the operator console (which by default shows only signals — when a message happened, how long it took, whether it failed — and requires a written reason, logged before the text appears, to show an actual message); a nightly error report containing a sample of a message where something looked wrong; and a weekly summary containing a real example of something a family asked for that Lobo couldn't do.

What the operator cannot see at all: your finance records, health records and stored files. These are encrypted under separate keys the console does not hold, so it physically cannot decrypt them — it can only count them ("12 documents stored") for health checks. That refusal is enforced in the code, not by a screen politely declining.

One honest caveat. That boundary protects the records. If you talk to Lobo about money or health in an ordinary message, those words are part of the message log like any other, and could appear in a logged reveal or a report sample.

Every such view is written to an access log. Your data is not anonymous to the operator, and it is not sold or used for advertising.

The messaging channel

Messages travel over WhatsApp, subject to Meta's own terms.

Children

A parent sets Lobo up and consents on behalf of the children. Facts about a child come from a parent; children choose their own preferences. Lobo keeps a safety floor no setting can loosen: nothing sexual around children, no slurs, never cruel to a child, and no medical, legal or financial advice.

How long it's kept

For as long as your family uses Lobo. Documents that led to something — a bill, an appointment, a task — are kept with the original for about a year so you can check where a reminder came from; documents that led to nothing are discarded within days. Ask to see or delete anything at any time.

Your choices

Ask Lobo what he holds about you, and ask for a copy
Ask for anything, or everything, to be deleted — deletion destroys your family's key
Opt out of any feature: health tracking, couple notes, calendar, nudges
Stop entirely, at any time, without giving a reason

Requests: segev.ai.bot@gmail.com.