Privacy Policy

1. Overview

Lobe is a local-first HTTP performance profiling tool. Our default stance is that your data stays on your machine. This policy covers the small set of cases where data leaves your machine and what happens to it when it does.

2. What we collect

Account data (paid tiers only):

• Email address
• Name, if you provide one
• Authentication tokens (managed by Clerk)

Session data (uploaded captures):

• HTTP request and response metadata: URLs, methods, status codes, header names, phase timings
• Derived fields we compute: asset type, party (first/third), redirect flags, connection reuse
• Important: captures may include sensitive request headers (authorization tokens, cookies) and URL query parameters. Only upload sessions whose contents you’re comfortable storing in cloud infrastructure. You can delete uploaded sessions at any time.

Billing data: handled entirely by LemonSqueezy, our Merchant of Record. We never see or store your card details. LemonSqueezy shares only your name, email, country, and subscription state with us.

Technical data: IP address (short-term, for abuse prevention), user agent (for compatibility debugging).

3. What we don't collect

• No telemetry from the CLI. The CLI never phones home. Local sessions stay local unless you explicitly upload them.
• No marketing pixels, no third-party ad networks, no session replay.
• No AI training on your data. If you use lobe explain, your session summary is sent to Anthropic’s API using your own API key. We don’t proxy it.

4. How we use your data

• Authenticate you into the web dashboard
• Store, display, and compare your uploaded sessions
• Send account-related email (receipts, security notices, policy changes)
• Detect and prevent abuse

We don’t sell your data. We don’t use it for advertising. We don’t share it with third parties beyond the service providers listed below.

5. Service providers

The subprocessors we use to run Lobe:

Each provider has its own privacy policy governing their handling.

6. Data retention

• Active accounts: session data retained while your account is active.
• Cancelled accounts: session data deleted 30 days after cancellation.
• Full deletion: request via email and we’ll remove within 30 days.
• Billing records: retained as required by tax law (typically 7 years) by LemonSqueezy.

7. Your rights

Regardless of your location, you can:

• Export your data (JSON download of any session)
• Delete your data (per session or account-wide)
• Request a copy of what we hold about you
• Correct any inaccuracies
• Object to processing or withdraw consent

Email getlobedev@gmail.com to exercise any of these.

8. Cookies

We use functional cookies for session management (Clerk auth cookies) and Convex session identifiers. We don’t use tracking cookies, analytics cookies, or advertising cookies.

9. Security

• All data in transit uses HTTPS with modern TLS.
• Data at rest in Convex is encrypted.
• Auth tokens are hashed and rotated by Clerk.
• CLI upload tokens are stored in your local config with 0600 permissions and can be revoked from the web dashboard.

No system is perfectly secure. Report suspected vulnerabilities to getlobedev@gmail.com with subject “security”.

10. International users

Lobe is operated from the United States. If you use Lobe from outside the US, you consent to your data being processed in the US and other jurisdictions where our service providers operate.

11. Children

Lobe is not directed at children under 13. We don’t knowingly collect data from children. If we learn we’ve collected data from someone under 13, we’ll delete it.

12. Changes to this policy

We may update this policy. Material changes will be emailed to registered users at least 30 days before taking effect.

13. Contact

Privacy questions, data access requests, or complaints: getlobedev@gmail.com