Lobsite Privacy Policy

Last updated: 4 November 2026

This policy explains what personal data Lobsite collects, why, who we share it with, how long we keep it, and what rights you have.

1. Who we are

Lobsite is run by Feynman OÜ, a company registered in Estonia under registry code 16935626 ("Lobsite", "we", "us"). We're the controller of the personal data described in this policy, except where section 3 says otherwise.

2. What this policy covers

Lobsite users: people who sign up, use the dashboard at lobsite.com, use the lobsite command-line tool, or deploy a site without an account.
Visitors to lobsite.com.
Visitors to sites we host, on lobsite.app addresses or custom domains, as far as we process their data to serve those sites and their forms.

Each hosted site belongs to its owner. Its content, and what it does with your data, is the owner's responsibility. Contact the site owner about it; to report a site, see section 10.

3. What we collect and why

If you have a Lobsite account

Data	Why	Legal basis
Email address, and whether you've confirmed it	To create and run your account, sign you in, and send service messages	Contract
Name and profile picture from Google or GitHub, if you sign in with them	To show who's signed in	Contract
Which sign-in methods you use, and the one-time sign-in links we email you (stored only as hashes, valid for 15 minutes)	To sign you in	Contract
The creation date of a linked GitHub account	To decide whether new-account limits apply	Legitimate interest: preventing abuse
A normalised form of your email address, and a DNS lookup of its domain's mail servers	To block temporary email addresses and stop one inbox from opening several accounts	Legitimate interest: preventing abuse
Sessions: a session cookie in the dashboard, and login tokens for the command-line tool, with when they were last used	To keep you signed in, and let you sign other devices out	Contract
Your sites, deploys (time, file names, sizes, an optional message), custom domains and settings	To provide the Service	Contract
A hash of each site password you set (never the password itself)	To protect the site for you	Contract
The email address of a person you invite to your account, the invitation, and which accounts each person can manage	To let them manage your sites with you	Contract
Extra addresses you add for form notifications, and whether they're confirmed	To send them submissions, after they confirm by a link	Contract
Bandwidth and storage used, per site and per month	To apply limits and warn you before you reach them	Contract
A record of actions on your account (for example deploys, domain changes, deletions)	Security and handling disputes	Legitimate interest: security
Messages you send us	To answer them	Contract, or legitimate interest
How you told us you found Lobsite, if you answer the question in the dashboard	To learn which channels bring people to Lobsite	Legitimate interest: improving the Service
The approximate place you signed up from (country, region and city), its time zone, and the name of the network you used, which Cloudflare works out from your IP address when you create your account and each time you deploy. We don't keep the IP address.	To learn where people sign up and deploy from, and to spot sign-ups and deploys made through hosting networks to get around limits	Legitimate interest: improving the Service, preventing abuse
Where you came from when you signed up, if you accepted the cookie banner: the other site's domain, the first page you opened and any campaign tags in its address. Saved on your account and sent to PostHog with your signup.	To learn which channels bring people to Lobsite	Consent
Product events linked to your account or temporary site: signing up, deploying (how it was made, and the public page an upload started from), keeping a site, a custom domain going live, a site reaching its first visitors, a form receiving a submission (not what it contains), plan changes and which days you use Lobsite. These events contain no email address, IP address, custom domain, file name or form content.	To understand how Lobsite is used and improve it	Legitimate interest: improving the Service
Payment status, and billing details from our payment provider (once paid plans launch). We never see or store full card numbers.	Billing, tax records	Contract; legal obligation

If you deploy without an account

Data	Why	Legal basis
A hash of your IP address, stored with each deploy	To apply the limit on new sites per IP	Legitimate interest: preventing abuse
The approximate place each deploy came from (country, region and city), its time zone, and the name of the network, which Cloudflare works out from your IP address. We don't keep the IP address.	To spot abuse coming from one place or through hosting networks	Legitimate interest: preventing abuse
The site and its files	To host the site for 6 hours, or until you claim it	Legitimate interest: providing the Service you asked for

The claim token for the site stays where you deployed from: on your computer (in ~/.config/lobsite/anon.json) when you use the command-line tool, or in your browser's local storage when you upload on lobsite.com. We store only a hash of it.

Your site's content

Files you deploy are published to the public, unless you protect the site with a password. We store them, serve them, and scan HTML pages automatically for forms and signs of phishing. For sites that belong to an account and have no password, we take a screenshot of the live page, using Cloudflare's browser rendering service, to show in your dashboard. If your files contain personal data, you're responsible for publishing it.

Visits to hosted sites

To apply bandwidth limits, and to show site analytics on the Standard plan, we count page views and bytes served at the edge. For analytics we keep the page path (without the query string) and the website the visitor came from, reduced to its domain name. We don't record visitors' IP addresses, user agents or cookies for this, and we add nothing to the site's pages.

Form submissions on hosted sites

When a visitor submits a form on a site we host, we store what they submitted, a salted hash of their IP address (never the address itself), their browser's user agent, and a spam score. We use this to deliver the submission to the site owner (in the dashboard, by email, and by webhook if they set one up) and to block spam.

For this data, the site owner is the controller and Lobsite is their processor: we handle it only on the site owner's behalf and following their instructions. Visitors should contact the site owner about their submissions.

When you visit `lobsite.com`

Analytics: we use Cloudflare Web Analytics, which doesn't use cookies and doesn't build a profile of you. We see aggregate figures such as page views and countries.
Website analytics with PostHog: unless you decline the banner, our public pages send page views to PostHog, without cookies or anything stored in your browser. PostHog uses your IP address and browser details to count visits, and we've set it not to keep your IP address. We use this because we have a legitimate interest in understanding how our website is used.
Bot protection: asking for a sign-in link uses Cloudflare Turnstile, which looks at signals from your browser to tell people from bots.
Google sign-in: if Google sign-in is on, the sign-in and sign-up pages load Google's sign-in script, which can offer to continue with a Google account you're signed in to in this browser. Google receives the visit to those pages. Other pages don't load it.

Logs and security

Our hosting provider, Cloudflare, processes the IP address and request details of every request, to deliver pages, stop attacks, and enforce rate limits. We don't keep logs of individual requests or their IP addresses ourselves. We count bytes served per site, without IP addresses, to apply bandwidth limits.

4. Cookies and similar storage

On lobsite.com: one session cookie when you're signed in. It's strictly necessary, HttpOnly, sent only to lobsite.com, and expires when you sign out or after 90 days. Your browser's local storage keeps your theme choice (light, dark or auto), whether the dashboard sidebar is collapsed, which account you're managing if you've been invited to one, and the claim tokens of sites you uploaded without an account. We don't use advertising or tracking cookies. Cloudflare Turnstile may store data needed for its check.
With your consent: if you accept the banner on our public pages, a lobsite_source cookie keeps the details above for 7 days, until you sign up or it expires. A consent cookie remembers your choice for a year, whichever you choose. To change your mind, ask again, which removes both.
On hosted sites: Lobsite sets no cookies, except on a password-protected site: once you enter its password, a signed cookie keeps you signed in to that address for 7 days. It's strictly necessary and contains no personal data. Site owners may add their own cookies.

5. Who we share data with

We don't sell personal data, and we don't share it for advertising. We use these providers ("subprocessors") to run the Service:

Provider	What for	Where
Cloudflare, Inc.	Hosting, storage, databases, content delivery, DNS, bot protection, analytics, site screenshots	Worldwide network, including the United States
Resend	Sending email: account email and form notifications	United States
Stripe	Payments for the Standard plan, invoices and tax (VAT) calculation. Stripe receives your email address, billing address, VAT number if you give one, and your card details, which we never see.	United States and the EU
Google and GitHub	Signing in, if you choose them. They receive the usual sign-in request.	United States
PostHog	Product and website analytics: the events listed in section 3 and page views of our public pages	European Union (Frankfurt)

We also share data:

with the site owner, for submissions to their forms (section 3), and with the notification addresses and webhooks they set up;
with the person invited to a Standard account, who sees what the owner sees about its sites, including form submissions and analytics; the owner also sees the invited person's email address;
with the person who claims an anonymous site, which includes its deploys;
when the law requires it, or to protect people from harm or the Service from abuse, for example in response to a valid request from an authority, or when reporting phishing to the organisation being imitated;
with a buyer, if Lobsite is sold or merged, under this policy.

6. International transfers

Some providers process data outside the European Economic Area. When they do, we rely on adequacy decisions, including the EU–US Data Privacy Framework where the provider is certified, and on the European Commission's Standard Contractual Clauses.

7. How long we keep data

Data	How long
Account data	While your account is open. Deleted within 30 days of closing it, apart from backups (below) and records we must keep by law
Anonymous sites	Only the live deploy is kept. Removed 6 hours after creation unless claimed; the site name is held, with no personal data, for 30 days
Deploys	The live deploy while the site exists; other deploys for 7 days (free) or 30 days (Standard). Their files are deleted once no kept deploy uses them
Site screenshots	Deleted with the deploys they belong to, unless a kept deploy shows the same screenshot
Site analytics	Monthly page paths and referring sites until a month after that month ends; daily figures for 400 days
Product events	1 year in PostHog
Invitations	7 days, or until accepted or cancelled
Deleted sites	Removed with their files 30 days after deletion, when the site name is released
Form submissions	90 days on free accounts, 1 year on Standard accounts, or sooner if the site owner deletes them
Abuse reports	2 years
Account activity records	1 year
Backups	Database backups are kept for 30 days; uploaded files are kept in a backup store until they're removed by the deletion rules above, plus 30 days
Billing records	7 years, as Estonian accounting law requires

8. Your rights

Depending on where you live, including in the EU and UK, you have the right to:

access your personal data and get a copy;
correct it if it's wrong;
delete it;
restrict or object to how we use it, including any use based on legitimate interest;
take it with you in a machine-readable format;
withdraw consent, where we rely on it;
complain to a data protection authority, for example the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon, aki.ee) or the one where you live.

To use these rights, email privacy@lobsite.com from your account's address. We'll answer within one month. Until account deletion is in the dashboard, you can close your account and delete your data by emailing us.

9. Security

All traffic uses HTTPS. Lobsite accounts have no passwords: you sign in with Google, GitHub or a link we email you. Sign-in links, site passwords, CI tokens, site claim tokens and visitors' IP addresses are stored only as hashes. User sites are served from a separate domain and a separate hosting account from the dashboard. Access to production systems is limited to the people who run Lobsite, and every change to an account is recorded.

No system is perfectly secure. If a breach affects your personal data, we'll tell you and the relevant authorities as the law requires.

10. Reporting a site

To report a site hosted on Lobsite, use the "Report abuse" link at /_lobsite/report on the site, or the Report abuse page at lobsite.com/abuse. If you give your email address with a report, we use it only to handle the report and to contact you about it.

11. Children

Lobsite isn't for children under 16. We don't knowingly collect personal data from them. If you believe a child has given us personal data, contact privacy@lobsite.com and we'll delete it.

12. Changes to this policy

We'll post any changes on this page and update the date at the top. For changes that matter, we'll email account holders at least 30 days before they take effect.

13. Contact

privacy@lobsite.com