How we handle your data
Last updated 10 November 2026.
Already is provided by Leadlabs. This page describes the personal data we process when you use the service, why we process it, where it is stored, and the rights you have. It is based on how Already actually works today.
Controller
Leadlabs is the controller of personal data processed in Already.
Company registration number, postal address and a dedicated email for privacy requests are not yet listed here and will be added.
What data we collect
When you create an account we store your email address, the date the account was created and – if you sign up with a password – a hash of the password, not the password itself. If you sign in with Google we also store Google’s user id for the account (the OpenID subject). Google then receives your email in order to complete the sign-in. We do not fetch or store your Google profile photo.
In the app you can add a display name, a profile photo, a language preference and a daily reminder (on/off and a time). We also store whether you have seen the introduction.
When you record, we store the audio file together with the title, folder, category, feeling, target date, duration, timestamp and any waveform data. If you mark something as having happened, we store that date and the reflection you write.
When a recording is saved, the audio is sent to a speech-to-text service so you can read what you said. The transcript, the language that was heard and the transcription status are stored on your recording. You can also request a new transcript later.
Folders are stored with a name, icon and colour. Active days (when you record or listen) are stored for streaks and statistics under Progress. Those statistics cover only your own account.
If you share a story under Account, we store the name, city and quote you send, together with the consent text, the language and the time. A story is not published without that consent.
If you start a subscription, your email and an internal user id are sent to Stripe, which handles the payment. We never see your card details. On your account we store Stripe customer and subscription details (status, interval, currency, trial and renewal dates).
In your browser we store a sign-in cookie (30 days, httpOnly), a language cookie (one year) and, briefly, a cookie during Google sign-in (ten minutes). Local storage may hold your language, currency, today’s activity, the reminder, the introduction and a checkout you started.
Where the data is stored
Already runs on Vercel. Your data, including audio files and your profile photo, is stored in Vercel Blob with private access. The profile photo sits at an unguessable path and is only shown when you are signed in. Recordings also play only through your account.
Who receives data
We use the following to run the service:
- Vercel – hosting, operation and file storage.
- Speech-to-text: the first service that is configured, either OpenAI, Groq or Vercel AI Gateway. Audio is sent there when a recording is saved or when you ask for a transcript.
- Stripe – payment and subscription, if you upgrade to Pro.
- Google – if you choose to sign in with Google.
Some of them may be located outside the EU/EEA. In that case the transfer takes place under their contract with us, typically using the EU standard contractual clauses. We do not sell your data.
Purpose and legal basis
Your account, recordings, transcripts, folders, profile photo, statistics and reminder are processed to provide Already, on the basis of the contract with you (Article 6(1)(b) GDPR).
Payment through Stripe is processed to perform the subscription.
Stories you send for possible publication are processed on the basis of your consent (Article 6(1)(a)). You can withdraw that consent at any time.
The sign-in cookie is needed for you to use your account. The language cookie remembers the language you chose.
How long we keep the data
We keep your data for as long as the account exists, or until you delete a single recording or the profile photo. If you delete the account, we remove the account data, recordings, folders, profile photo, activity days and stories you submitted.
The sign-in cookie lasts 30 days. The temporary Google sign-in cookie lasts ten minutes. The language cookie lasts one year.
Your rights
You have the right to access your data, obtain a copy, have inaccurate data corrected, have data erased, object to certain processing and, where processing is based on consent, withdraw that consent. You also have the right to data portability. These rights may be limited in some cases by law.
How to exercise your rights
In the app, under Account, you can change your name, language, reminder, password and profile photo, export your audio and text (export is included in Pro) and delete the whole account. You delete individual recordings in the library. A deleted recording can be undone for a short moment, then it is gone.
Until a contact address is listed above, you can use the in-app features for access, correction, export and deletion.
Complaints
You can lodge a complaint with the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, IMY) if you think we are processing your data incorrectly. More information is available at imy.se.
Changes
If we change how Already processes personal data, we will update this page and the date above.