Lobsite Privacy Policy
Template for review, not legal advice. Written from the MVP docs on 2026-10-13. Everything in
[square brackets]needs to be filled in or decided, and a lawyer should check the whole text before it's published atlobsite.com/privacy. Notes for reviewers are in quoted blocks like this one and are removed before publishing.The facts below (what's collected, retention periods, providers) come from
docs/mvp-technical-plan.mdanddocs/tier-limits.md. If those change, this policy must change too.
Last updated: [date]
This policy explains what personal data Lobsite collects, why, who we share it with, how long we keep it, and what rights you have.
1. Who we are
Lobsite is run by [Company legal name], [registered address], company number [company number] ("Lobsite", "we", "us"). We're the controller of the personal data described in this policy, except where section 3 says otherwise.
Contact us about privacy at privacy@lobsite.com.
Reviewer: add an EU representative (GDPR article 27) if the company isn't established in the EU, and a data protection officer if one is required.
2. What this policy covers
- Lobsite users: people who sign up, use the dashboard at
lobsite.com, use thelobsitecommand-line tool, or deploy a site without an account. - Visitors to
lobsite.com. - Visitors to sites we host, on
lobsite.appaddresses or custom domains, as far as we process their data to serve those sites and their forms.
Each hosted site belongs to its owner. Its content, and what it does with your data, is the owner's responsibility. Contact the site owner about it; to report a site, see section 10.
3. What we collect and why
If you have a Lobsite account
| Data | Why | Legal basis |
|---|---|---|
| Email address, and whether you've confirmed it | To create and run your account, sign you in, and send service messages | Contract |
| Name and profile picture from Google or GitHub, if you sign in with them | To show who's signed in | Contract |
| Which sign-in methods you use; a hash of your password (never the password itself) | To sign you in | Contract |
| The creation date of a linked GitHub account | To decide whether new-account limits apply | Legitimate interest: preventing abuse |
| A normalised form of your email address, and a DNS lookup of its domain's mail servers | To block temporary email addresses and stop one inbox from opening several accounts | Legitimate interest: preventing abuse |
| The first 5 characters of a hash of a new password, sent to the Have I Been Pwned service (it never sees your password or its full hash) | To stop passwords known from data breaches | Legitimate interest: security |
| Sessions: a session cookie in the dashboard, and login tokens for the command-line tool, with when they were last used | To keep you signed in, and let you sign other devices out | Contract |
| Your sites, deploys (time, file names, sizes, an optional message), custom domains and settings | To provide the Service | Contract |
| Bandwidth and storage used, per site and per month | To apply limits and warn you before you reach them | Contract |
| A record of actions on your account (for example deploys, domain changes, deletions) | Security and handling disputes | Legitimate interest: security |
| Messages you send us | To answer them | Contract, or legitimate interest |
| Payment status, and billing details from our payment provider (once paid plans launch). We never see or store full card numbers. | Billing, tax records | Contract; legal obligation |
If you deploy without an account
| Data | Why | Legal basis |
|---|---|---|
| A hash of your IP address, stored with each deploy | To apply the limit on new sites per IP | Legitimate interest: preventing abuse |
| The site and its files | To host the site for 24 hours | Legitimate interest: providing the Service you asked for |
The claim token for the site stays on your computer (in ~/.config/lobsite/anon.json). We store only a hash of it.
Your site's content
Files you deploy are published to the public. We store them, serve them, and scan HTML pages automatically for forms and signs of phishing. If your files contain personal data, you're responsible for publishing it.
Form submissions on hosted sites
When a visitor submits a form on a site we host, we store what they submitted, a salted hash of their IP address (never the address itself), their browser's user agent, and a spam score. We use this to deliver the submission to the site owner (in the dashboard, by email, and by webhook if they set one up) and to block spam.
For this data, the site owner is the controller and Lobsite is their processor: we handle it only on the site owner's behalf and following their instructions. Visitors should contact the site owner about their submissions.
Reviewer: this needs the Data Processing Agreement (see
docs/TODO.md).
When you visit lobsite.com
- Analytics: we use Cloudflare Web Analytics, which doesn't use cookies and doesn't build a profile of you. We see aggregate figures such as page views and countries.
- Bot protection: sign-up, sign-in and password reset use Cloudflare Turnstile, which looks at signals from your browser to tell people from bots.
- Error reports: when something breaks in the dashboard, an error report is sent to Sentry. It can include your IP address, browser details and the page you were on.
Logs and security
Our hosting provider, Cloudflare, processes the IP address and request details of every request, to deliver pages, stop attacks, and enforce rate limits. We keep request logs for [X days]. We count bytes served per site, without IP addresses, to apply bandwidth limits.
4. Cookies and similar storage
- On
lobsite.com: one session cookie when you're signed in. It's strictly necessary,HttpOnly, sent only tolobsite.com, and expires when you sign out or after [period]. Your theme choice (light, dark or auto) is stored in your browser. We don't use advertising or tracking cookies. Cloudflare Turnstile may store data needed for its check. - On hosted sites: Lobsite sets no cookies. Site owners may add their own.
Reviewer: confirm that no consent banner is needed, given only strictly necessary storage is used.
5. Who we share data with
We don't sell personal data, and we don't share it for advertising. We use these providers ("subprocessors") to run the Service:
| Provider | What for | Where |
|---|---|---|
| Cloudflare, Inc. | Hosting, storage, databases, content delivery, DNS, bot protection, analytics | Worldwide network; [data location settings] |
| Resend | Sending email: account email and form notifications | [United States] |
| Functional Software, Inc. (Sentry) | Error reports | [United States / EU region] |
| Better Stack | Uptime monitoring of public pages; no user data by design | [region] |
| Google (Web Risk) | Checking site addresses against lists of dangerous sites | [region] |
| Have I Been Pwned | Checking new passwords against breach data, using only a 5-character hash prefix | [region] |
| [Stripe] | Payments, once paid plans launch | [region] |
| Google and GitHub | Signing in, if you choose them. They receive the usual sign-in request. | [region] |
We also share data:
- with the site owner, for submissions to their forms (section 3);
- with the person who claims an anonymous site, which includes its deploys;
- when the law requires it, or to protect people from harm or the Service from abuse, for example in response to a valid request from an authority, or when reporting phishing to the organisation being imitated;
- with a buyer, if Lobsite is sold or merged, under this policy.
6. International transfers
Some providers process data outside [the EU / the UK / your country]. When they do, we rely on [adequacy decisions, including the EU–US Data Privacy Framework where the provider is certified, and the European Commission's Standard Contractual Clauses].
7. How long we keep data
| Data | How long |
|---|---|
| Account data | While your account is open. Deleted within [30] days of closing it, apart from backups (below) and records we must keep by law |
| Anonymous sites | Removed 6 hours after creation unless claimed; the site name is held, with no personal data, for 30 days |
| Deploys | The live deploy while the site exists; other deploys for 7 days (free) or 30 days (paid). Their files are deleted once no kept deploy uses them |
| Deleted sites | Files deleted within [X days]; the site name is held for 30 days |
| Form submissions | 90 days on free accounts, 1 year on paid accounts, or sooner if the site owner deletes them |
| Abuse reports | [2 years] |
| Account activity records | [1 year] |
| Request logs | [X days] |
| Error reports | [X days] |
| Backups | Database backups are kept for [X days]; uploaded files are kept in a backup store until they're removed by the deletion rules above, plus [X days] |
| Billing records | As required by tax law, [X years] |
8. Your rights
Depending on where you live, including in the EU and UK, you have the right to:
- access your personal data and get a copy;
- correct it if it's wrong;
- delete it;
- restrict or object to how we use it, including any use based on legitimate interest;
- take it with you in a machine-readable format;
- withdraw consent, where we rely on it;
- complain to a data protection authority, for example [the supervisory authority where the company is established] or the one where you live.
To use these rights, email privacy@lobsite.com from your account's address. We'll answer within one month. Until account deletion is in the dashboard, you can close your account and delete your data by emailing us.
Reviewer: add a section for California (CCPA/CPRA) and other US state laws if they apply.
9. Security
All traffic uses HTTPS. Passwords are hashed by our authentication library, and CI tokens, site claim tokens and visitors' IP addresses are stored only as hashes. User sites are served from a separate domain and a separate hosting account from the dashboard. Access to production systems is limited to [the people who run Lobsite], and every change to an account is recorded.
No system is perfectly secure. If a breach affects your personal data, we'll tell you and the relevant authorities as the law requires.
10. Reporting a site
To report a site hosted on Lobsite, use the "Report abuse" link at /_lobsite/report on the site, or email abuse@lobsite.com. If you report by email, we use your address only to handle the report and to contact you about it.
11. Children
Lobsite isn't for children under [16]. We don't knowingly collect personal data from them. If you believe a child has given us personal data, contact privacy@lobsite.com and we'll delete it.
12. Changes to this policy
We'll post any changes on this page and update the date at the top. For changes that matter, we'll email account holders at least [30] days before they take effect.
13. Contact
privacy@lobsite.com, or by post to [Company legal name], [registered address].