Privacy Policy

Overview

This Privacy Policy explains what information is collected and why it is collected. Account changes, exports, and deletions are currently handled by emailing info@lifub.com — there is no self-serve account dashboard yet.

Depending on your use of the Lifub website and its products, two types of information are collected: personal data and non-personal data.

Controller (Art. 4 No. 7, Art. 13(1)(a) GDPR)

The controller operates as a natural person under the Kleinunternehmer scheme (§ 19 UStG). No Data Protection Officer is mandatory because § 38 BDSG only requires one where 20 or more persons are regularly engaged in personal-data processing. The primary contact for data-protection enquiries is info@lifub.com.

Legal bases for processing (Art. 6 GDPR)

Art. 6(1)(b) — Contract performance

Account creation, API key issuance, delivery of purchased services, requested Monitoring email verification and alerts, and pre-contractual communication initiated by you (e.g. emailing info@lifub.com to request a service).

Art. 6(1)(f) — Legitimate interest

IT security via server logs (Recital 49 GDPR), anti-abuse rate limiting on anonymous API traffic, basic aggregated usage statistics without user-level tracking, and bot / AI-agent recognition (Analytics) from server-side request fingerprints for fraud / abuse prevention (Recital 47 GDPR).

Art. 6(1)(c) — Legal obligation

Retention of invoicing / accounting records for 10 years per § 147 AO.

Art. 6(1)(a) — Consent

Only where explicitly collected (e.g. opt-in to non-essential communication). None is required or requested for using Lifub products today.

Retention periods

• Account / key-issuance emails: for the duration of the service relationship + 30 days.
• Server access logs (including IP addresses): 30 days, then auto-deleted. BayLDA recognises 30 days for IT-security legitimate interest.
• API request log (metering): retained for the duration of your service relationship. Within 30 days of the relationship ending (key revocation or written request), all rows tied to your API key are deleted. Aggregated, non-identifying counts may be retained for billing reconciliation. This matches the deletion timeline in the DPA § 4.
• Site Search crawled index & search logs: duration of the customer relationship + 30 days after termination.
• Analytics visit analytics (per-visit verdict + request fingerprints incl. the hashed IP, JA3 / JA4, TLS cipher, User-Agent): kept on a rolling 365-day default TTL (configurable per site), and in any case deleted within 30 days of the service relationship ending. The raw IP is never stored — only the pseudonymous ha5h:… hash. Aggregated, non-identifying counts may be retained for reporting.
• Monitoring notification email: a pending address and hashed verification UUID are kept in Monitoring state for at most 15 minutes. After successful verification, the address is retained while its anonymous Monitoring site remains active and expires no later than 90 days after activity stops; removing it in the Monitoring gadget deletes the pending and verified address from Monitoring state immediately. Previously delivered messages remain subject to the sender’s and recipient’s mail-retention settings.
• Site Audit reports and snapshots: every completed browser audit is stored server-side for 90 days so its unguessable bearer report link works. Saving it as a labelled snapshot in the browser does not create another server copy: the label and local snapshot history remain in that browser until cleared or displaced from its 50-entry history, while the underlying report keeps its original 90-day expiry. Server-side API or MCP snapshots use the same 90-day TTL. A direct API or MCP audit requested without sharing or snapshot storage is returned once and is not stored as a report. Stored reports retain the target and final URLs, status and classifications, selected response headers, captured-size and hash evidence, scores, findings, and bounded page, TLS, and SEO facts. They do not retain response bodies, request headers, or cookies. Anyone holding the report UUID can read it until it expires.
• Operator administration audit history: capped at 1,000 entries; the Redis list expires 365 days after the last administrative write. Entries record the operator source address, timestamp, action, target or recipient information, and bounded fulfillment detail.
• Site Audit voucher fulfillment records: provider name, purchase-reference UUID, transaction and voucher fingerprints, remaining balance, and issuance or revocation time currently have no automatic expiry because they preserve the outstanding bearer entitlement and prevent duplicate fulfillment. They remain until operator deletion, subject to applicable accounting, dispute-resolution, and legal-retention duties.
• Outbound email awaiting retry: when a receiving mail server refuses a message temporarily (greylisting is the common case), we hold that message — recipient address, subject and full body — in a queue on our own EU infrastructure and retry it on a fixed schedule spanning a little over 5 hours. It is deleted as soon as it is delivered, or when the schedule is exhausted, whichever comes first. Because the body is held whole, a queued Monitoring verification message contains its verification UUID, a queued Site Search setup message contains its Site Secret, and a queued Site Audit voucher-delivery message contains its bearer voucher for that period. No third party holds the queue.
• Suppressed recipient addresses: when a receiving mail server rejects an address permanently as nonexistent or disabled, we record that address for 30 days and send it nothing further. Keeping it is what stops us mailing a dead mailbox repeatedly; it expires automatically, and no message content is retained with it.
• Invoicing / accounting records: 10 years (§ 147 AO).
• Aggregated, anonymised usage statistics: retained indefinitely.

Recipients / processors

• OVH SAS (2 rue Kellermann, 59100 Roubaix, France) — infrastructure hosting (EU). A GDPR-compliant data processing agreement (Art. 28) is in place.
• Applicable Stripe entities identified in Checkout and Stripe's Privacy Center — primary hosted payment processing. The responsible Stripe entity depends on location, payment service, and processing role. For Site Audit, Stripe receives the purchaser's delivery email, business-buyer confirmation, purchase reference, and payment details needed to complete the one-time checkout. Card number and CVC are submitted directly to Stripe and are never stored by Lifub.
• Revolut — fallback payment processing only when separately arranged by the operator. Raw card or account credentials are submitted directly to the Revolut entity identified in the hosted checkout or receipt. Lifub also processes the voucher-delivery email address and the fulfillment and accounting metadata described below.
• DB-IP (by 2VIA S.A.) — DB-IP Lite geolocation database (CC BY 4.0). IP addresses are looked up locally against a database hosted by us; no end-user IP is sent to DB-IP. Published with required attribution.
• Apple Distribution International Ltd. — backup mail exchanger (iCloud Mail). Lifub’s mailboxes live on our own OVH-hosted server, which both receives mail addressed to Lifub and sends every message we write directly to the recipient domain’s mail exchanger — no third party sits in that primary path. Apple processes personal data only when our primary mail server is unreachable: the published backup mail-exchanger records then let Apple’s iCloud Mail servers accept a message on our behalf until the primary returns. The iCloud terms apply.

A processor may use infrastructure or subprocessors outside the EEA. Where an international transfer is unavoidable, we rely on Art. 46 GDPR safeguards (Standard Contractual Clauses).

Site Audit reports

Site Audit fetches and transiently analyzes the public page selected by the user. Every completed browser report is published under an unguessable bearer UUID and kept for 90 days. Saving a browser snapshot adds its label only to local browser history; it does not make another server copy or extend the underlying report's expiry. Server-side API or MCP snapshots use the same 90-day TTL. A direct API or MCP audit requested without sharing or snapshot storage is not retained as a report. Stored reports contain bounded technical evidence, not the fetched response body, request headers, or cookies. Recent-site and browser-created snapshot-label history stays in the user's browser and is not sent to Lifub.

Monitoring email notifications

Monitoring works without an account or email address. If you explicitly enable email notifications, we store the address under your unguessable siteId and send a one-time UUID to prove that you control the mailbox. Only a SHA-256 hash of that UUID is stored in Monitoring state, it expires after 15 minutes, and successful verification consumes it. The raw UUID necessarily appears in the delivered verification message and may remain in sender or recipient mail systems under their retention settings. The verified address is used only for requested incident, recovery, and verification messages — never marketing. You can remove pending or verified Monitoring configuration at any time in the Monitoring gadget.

How our email is delivered

Every message Lifub sends — Monitoring incident, recovery and verification messages, the Site Search setup-information message, and Site Audit voucher delivery — is delivered by our own EU-hosted server straight to your mail provider. No third-party sending service or SMTP relay sits in between. Your provider necessarily receives the message and processes it as your mail host rather than ours.

A Site Audit voucher-delivery message carries a bearer credential. Anyone who reads that voucher can spend its remaining paid audits. Keep it private; retrying fulfillment for the same settled provider transaction returns the same voucher rather than another balance.

The Site Search setup-information message carries a credential on purpose. It is sent to the address you enter in the Getting Started gadget, which is labelled accordingly, and it contains your Site ID and your Site Secret — the value that authorizes crawls, page writes and profile changes for that index. Treat it like a password: we cannot recover it for you, and anyone who reads that message controls the index.

Two mechanisms exist so that a delivery problem neither loses your message nor turns us into a source of junk mail, and both retain data for a bounded period — see Retention periods above. A message a receiver refuses temporarily is held whole and retried for a little over 5 hours. An address a receiver refuses permanently, as nonexistent, is recorded for 30 days and sent nothing further; if that was a mistake, tell us and we will clear the entry immediately.

Your rights (Art. 15–22 GDPR)

• Access (Art. 15) — a copy of the personal data we hold about you.
• Rectification (Art. 16) — correction of inaccurate data.
• Erasure / "right to be forgotten" (Art. 17).
• Restriction of processing (Art. 18).
• Data portability (Art. 20) — structured, machine-readable export.
• Objection (Art. 21) — in particular to processing based on legitimate interest.
• Revoke consent (Art. 7(3)) — where consent was the legal basis.
• No automated individual decision-making (Art. 22) — we do not subject you to automated decisions with legal effect.

To exercise any of these rights, email info@lifub.com. We respond within one month (Art. 12(3) GDPR). We may verify your identity by requiring the request to come from the email address registered with the service.

Supervisory authority

You have the right to lodge a complaint with a supervisory authority (Art. 77 GDPR). The authority competent for this service is:

Types of Data

When Data is Collected

1. When you integrate Page Finder into your website
2. When you log in to access your Page Finder dashboard
3. When you optionally enter an address for Monitoring email notifications
4. When you simply browse this website

Page Finder Integration — What Data is Collected from Your Users?

When we process your visitors' data on your behalf as a data processor under the Data Processing Agreement, we permanently ensure that our operations are executed in accordance with GDPR requirements. To make sure your privacy is protected:

• Technical and organizational measures taken by our infrastructure provider (ISO/IEC 27001 certified)
• Quality compliance certificate issued by the German certification body TÜV Rheinland
• Technical and organizational measures taken by us as a contractor

HTTPS and API traffic uses TLS 1.2 or later; direct email uses STARTTLS when the receiving server offers it.
What we store about your end users: their search query (Site Search) or their IP address (IP Intelligence API) for the duration of the service relationship + 30 days, then deleted. We do not store names, emails, or other contact data of your end users.

Analytics — What Data is Collected from Your Visitors?

Analytics is a web-analytics tag whose purpose is bot and AI-agent recognition. When you embed it we act as your data processor under the Data Processing Agreement. By default Analytics sets no cookies and assigns no cross-site identifier — it never follows a visitor across different websites. A site owner may optionally enable a single first-party, same-site cookie to tell new visitors from returning ones (see Returning-visitor cookie below); it is off unless the owner turns it on. To tell real humans from bots, Analytics processes and stores server-side request fingerprints for each visit:

• IP address — used at the moment of the visit to derive the network owner (ASN), country and city and the datacenter / proxy-bot signal, then discarded and kept only as a pseudonymous, irreversible hash (an IPv6-shaped ha5h:… token, peppered server-side). The raw IP address is not retained.
• TLS fingerprints (JA3 / JA4) and the negotiated TLS cipher — these identify the client's TLS stack, a strong automation tell.
• HTTP protocol version and the User-Agent header.
• Page path and the external referrer host (where the visitor came from).
• For visitors that run JavaScript, a small set of browser runtime signals (e.g. whether automation is detected, language count, hardware concurrency, plugin count).

The IP address is personal data under the GDPR, and the pseudonymous hash that replaces it is treated as personal data too — a hash is pseudonymisation, not anonymisation. We process these fingerprints on the basis of Art. 6(1)(f) legitimate interest — fraud and abuse prevention (Recital 47), which is the core function you embed Analytics for. The data is scoped to your individual site, used only to compute each visit's human / bot verdict and your aggregated analytics, and is never used for cross-site profiling, advertising, or sold to anyone. Retention follows the "Retention periods" section above. We store no names, emails, or other contact details of your visitors.

Returning-visitor cookie (optional, off by default)

A site owner may switch on a single first-party cookie (loxal_vid) so Analytics can distinguish new from returning visitors. It holds only a random per-browser id, is same-site only (never read on any other website), is no advertising or cross-site identifier, and expires after ~180 days. Because it is not strictly necessary, it is written only with the visitor's consent — obtained either through Analytics' own built-in consent banner (with an equally-prominent Accept / Reject) or through the site owner's own consent platform. With the cookie off (the default) Analytics is fully cookieless.

What we collect when you request access

Access that requires approval is granted manually by email. When you email info@lifub.com to request a Free or Pro API key (or a managed Site Search install), we collect only what you supply:

• Email address
• Name (optional)
• Domain (Page Finder only)
• Tier (Free / Pro)

How we use this information

1. To issue an API key and reply to you.
2. To understand how the service is being used so we can prioritise.
3. To send service messages (e.g. key revocation notice). We do NOT send marketing emails — there's no list to be on.

To update or delete your record, email info@lifub.com. There is no self-serve dashboard / "Profile settings" UI yet — the current operating scale does not justify building one. We respond within one month per Art. 12(3) GDPR.

Vynx full browser extension build

Vynx is our browser extension: multi-provider AI chat, a Browser Agent that acts in a visible tab, an MCP Bridge that lets a coding agent drive the browser, and developer power tools. Because it runs inside your browser, it is worth being precise about what it reads, what leaves your device, and what never does. We operate no server-side profile of your extension use: there is no analytics, no advertising, and no browsing-history collection.

What the extension reads

• Page content — text and structure of pages you point it at, when you start a Browser Agent run, drive the MCP Bridge, or ask a chat to work with the current page. Those AI and automation tools do not read other pages in the background. The separate local dark-mode and cookie-banner tools inspect supported pages as described for the Store build below; the full build includes those tools too, and they do not transmit page content or visited URLs.
• Provider session cookies — so a chat can be sent as you, in the AI provider session you are already signed in to, instead of asking you for an API key.
• Network traffic you capture — only while you have explicitly started a HAR capture.

What leaves your device, and to whom

Your prompts, your Browser Agent instructions, and any page content you ask an agent to work with are sent to the AI provider you selected — Anthropic, OpenAI, Google, GitHub, Perplexity, xAI, DeepSeek, Moonshot, MiniMax, Z.ai or Lifub — inside your own session with that provider, and are then governed by that provider's privacy policy. Choosing the provider is choosing the recipient. Nothing else is transmitted, and the extension sends nothing to us that you did not direct at the Lifub API yourself.

What stays on your device

• Settings, provider and model choices, and request-header rules.
• Chat history, and the newest 10 Browser Agent sessions, kept so a run can be replayed or audited. You can clear them at any time from the extension.

Vynx no longer contains a password vault. That surface became the separate Keyring extension on 28 August 2026, and Vynx now ships no vault code and no clipboard access on any platform.

Permissions that look alarming, and why they exist

• Access to all sites — you decide which site an agent works on, and it can be any site; the extension cannot know it in advance. AI and automation access begins only when you start a run, start the Bridge, or invoke a tool. The local page tools described below run according to their own settings.
• Debugger — used for two things only: screenshotting the page an agent is working on, and answering a native dialog that would otherwise freeze the run. It attaches only to a tab the extension is actively driving, and detaches afterwards.

The extension's source is public at github.com/loxal/lifub, so every claim above can be checked rather than taken on trust. Questions: info@lifub.com.

Keyring browser extension

Keyring is our standalone password and passkey manager. It is a single-purpose extension: it contains no AI, no browser agent, no diagnostics and no bridge code. It is currently a beta, distributed unlisted, and its behaviour may still change.

The property that matters most: encryption and decryption happen in your browser, and we cannot read your entries. Your local Vault password and your recovery phrase never leave your device. What synchronises to the Lifub API is ciphertext, and we hold no key that opens it. There is no sign-up and no account — a vault is proven by a cryptographic challenge, not by an identity we hold.

What leaves your device, and to whom

• Encrypted vault records only, to api.lifub.com under /keyring/v1/: enrollment, challenge/response proofs, encrypted vault items, and recovery state. Item names, usernames, passwords, notes, TOTP secrets and passkeys are inside that ciphertext, never outside it.
• Connection metadata, as with any HTTPS request: your source IP address reaches our servers so a response can be delivered. It is retained in security and access logs for up to 30 days and then deleted. Keyring requests no location permission.

Nothing else is transmitted. Keyring sends no page content, no page URLs, no browsing history, no cookies and no analytics, and it contains no advertising and no third-party service.

What stays on your device

• Your local Vault password, recovery phrase, and every decryption key. They exist only in the Rust core running in your browser, and are cleared when the vault locks.
• The decrypted vault, while unlocked. It auto-locks after inactivity.
• Your settings, and the encrypted local bootstrap stored in browser IndexedDB.
• Site icons, if you turn them on: Keyring reads your browser's own local favicon cache. It makes no request to the website, to an icon service, or to Lifub for them.

Permissions that look alarming, and why they exist

• Access to all sites — a password manager cannot know in advance which site you will sign in to. Page helpers are registered per site, stay inert while the vault is locked, and fill only after your direct action; Keyring never submits a form for you.
• Clipboard read — used only to confirm that a password Keyring copied is still on the clipboard before clearing it, so it never erases something you copied yourself.
• Tabs — used to match the site you are on against your entries and to open the management page. Keyring does not record where you browse.
• Scripting and alarms — to register the fill-assist and save-prompt helpers on sites you use them on, and to run the inactivity auto-lock.

Questions: info@lifub.com.

Vynx Store distribution build

The Vynx build distributed through browser and app stores is deliberately smaller than the full build. It includes first-party Lifub AI chat, an offline German-English dictionary, page dark mode, cookie-banner dismissal, and, on Chrome and macOS, Picture-in-Picture. The iOS build omits Picture-in-Picture and keyboard commands. Store builds do not include third-party provider sessions, the Browser Agent, MCP Bridge, HAR capture, or custom request headers.

Local page processing

• Dark mode — a local script loads at the start of HTTP and HTTPS pages so it can apply dark mode on domains where you explicitly enabled it.
• Cookie-banner dismissal — enabled by default. Local scripts scan supported pages for up to 60 seconds and may click accept, reject, or dismiss controls selected by built-in rules. There is no remote filter list or dismissal telemetry.
• Picture-in-Picture — on Chrome and macOS only, a local script identifies supported HTML5 videos and selected embedded players. While this feature is enabled, Vynx transiently processes pointer position, page-scroll events and keydown events locally to reveal the video control and detect the Alt/Option+P shortcut. These events are neither retained nor transmitted. The iOS Store build does not contain this script.

These tools inspect or modify supported pages locally. Vynx does not send page content, visited URLs, dictionary search terms, cookie values, or credentials to Lifub from the Store build.

Network requests

• Model catalogue — opening the popup requests the currently available model list from api.lifub.com.
• Dictionary — the first lookup downloads one fixed compressed Ding dictionary file of about 14.4 MB from www.lifub.com. The query itself is not sent. After a successful local cache write, lookups work offline; clearing browser storage or a failed cache write can require another download.
• AI chat — pressing Send transmits the selected model and the complete current popup conversation, including prompts and replies, over HTTPS to Lifub's self-hosted AI service to generate the next reply. That conversation exists only in popup memory and is cleared when the popup closes.
• Connection logs — as with an ordinary HTTPS request, Lifub receives connection metadata including the source IP address. Security and access logs are retained for up to 30 days and then deleted.

What stays on your device

Extension storage keeps the selected theme and model, cookie-banner preference, domains where you enabled dark mode, and Picture-in-Picture preferences on platforms that include it. The dictionary keyboard command writes a one-shot local focus timestamp that the popup deletes immediately after reading, whether it is fresh or stale. IndexedDB holds the downloaded dictionary. Chat messages remain only in memory for the lifetime of the popup. Vynx has no advertising or third-party analytics, does not sell or share this data, and does not use it for credit, lending, or advertising decisions.

Chrome Web Store Limited Use

Vynx's use of information received from Chrome extension APIs adheres to the Chrome Web Store User Data Policy, including the Limited Use requirements. Vynx handles user data only to provide or improve the disclosed user-facing features and their security; it does not use or transfer that data for advertising, data brokerage, creditworthiness or lending, and does not permit humans to read chat content except with the user's specific consent or where access is necessary for security or legal compliance.

Payment Information

Site Audit normally uses a fixed-price, one-time Stripe Checkout. Revolut is available only when separately arranged as an operator fallback. Neither payment route creates a subscription or automatically issues the voucher. Lifub manually verifies the settled payment and delivers the bearer voucher by email. Lifub processes the checkout delivery email to verify and deliver the purchase; delivered messages remain subject to the sender's and recipient's mail-retention settings. Lifub stores the provider name, purchase-reference UUID, transaction and voucher hashes, balance, and issuance time needed for replay-safe fulfillment and accounting. Raw card number, expiry date, and CVC are submitted directly to the selected provider and are never stored on Lifub's servers.

Website Browsing Data

When browsing our site, you automatically send us non-personal data such as your device's IP address, referring website, pages visited, and browser information. We use this aggregated data to:

• Collect website usage statistics to improve performance and content
• Remember your language preference for future visits

Cookies — essential only, no banner

This website uses only strictly-necessary cookies that are essential for the operation of the requested service (e.g. session cookies, CSRF tokens). Per § 25 Abs. 2 Nr. 2 TDDDG, such cookies are exempt from the consent requirement and we therefore do not show a cookie banner. We do not use third-party, advertising, or cross-site tracking cookies. The Analytics product can optionally set one first-party, same-site cookie to recognise returning visitors — off by default, and written only with the visitor's consent (see the Analytics section above); where we run it on our own pages, such as the Analytics demo, it is gated behind an explicit opt-in banner.

If we ever add non-essential cookies, we will request explicit opt-in consent via a banner with an equally-prominent "reject all" option (consistent with DSK Orientierungshilfe Telemedien v1.2, Nov 2024, and VG Hannover, 19 March 2025).

If your browser blocks essential cookies entirely, parts of the service (e.g. session continuity, form submission) will not work. You can still call the public API endpoints with curl without any cookies.

Protecting Your Information

Human administrative access to production is restricted to the operator. HTTPS and API traffic uses TLS 1.2 or later. Production service, root, container, and data contents on Mars are encrypted at rest in LUKS2 volumes. The root passphrase is supplied interactively at boot and is not stored on Mars. The boot, EFI, BIOS, and provider-configuration partitions remain unencrypted but contain no root unlock key. Encrypted off-site archives use a separate key derived from the operator-held recovery passphrase.

Sharing Your Information

We do not sell, rent, trade, or otherwise transfer any personal data without your consent. We do not run analytics, advertising-network integrations, or third-party tracking pixels — see the cookie section below.

Legal Compliance

Data Breach Notification

Should a personal data breach occur and if it is likely to put our users' privacy at risk:

• We will notify users by email and via in-site notification within seven business days
• We will notify designated supervisory authorities within 72 hours