Privacy Policy

Last updated: 2026-07-25 · Version: 1.0-draft

Applies to the libi desktop application, the libi CLI (npx @nagellabs/libi), and this website.

The short version

libi runs on your computer. Your videos, audio, images, projects and database live in a folder on your own machine (~/.libi/). We never receive them. There is no libi account, no libi server holding your work, and no upload step.

Some things do leave your machine, and we explain each below:

1. 01Product analytics — anonymous usage counters sent to Google Analytics. You can turn this off in Settings → Privacy.
2. 02Crash reports — error reports sent to Sentry so we can fix bugs. You can turn this off in Settings → Privacy too; see §5.2, which also explains honestly what a crash report can contain.
3. 03Requests you ask libi to make — when you generate a voice, an image or a video, libi calls that provider directly from your machine using your own API key. Those requests go to the provider, not to us. For one feature, this includes uploading your video file — see §4.2.

If you read one section, read §4 — What leaves your device.

1. Who we are

libi is operated by Nadav Nagel, an individual sole proprietor in Israel. There is no company entity behind libi at the time of writing.

• Privacy enquiries: admin@nagellabs.com
• Postal address: [POSTAL ADDRESS]
• EU representative (Art. 27 GDPR): [NAME AND EU ADDRESS — or remove if not appointed]

For the limited processing described here we are the data controller. For everything that happens inside the app on your own machine there is no controller relationship at all — we have no access to it.

2. Who this is for

libi is not directed at children. You must be at least 16, or the age of digital consent where you live, to use libi. We do not knowingly collect personal data from children. If you believe a child has given us personal data, email us and we will delete it.

3. What stays on your device

Everything you create lives locally under ~/.libi/ (or LIBI_HOME):

We never receive any of it. There is no sync, no backup, no upload to us. Deleting ~/.libi/ deletes everything libi holds locally. Because this sits on your computer under your control, backing it up and securing it is your responsibility (§11).

Note that ~/.libi/logs/ contains diagnostic logs including absolute file paths of media you work with — which means file names you chose. These stay on your machine, but a subset can be included in crash reports. See §5.2.

4. What leaves your device

4.1 Things that come to us

Product analytics (§5.1) and crash reports (§5.2). That is the complete list.

4.2 Things your machine sends to AI providers on your own account

When you ask libi to generate media, libi calls the provider directly from your computer, authenticated with the API key you supplied. We do not proxy these calls and never see your keys, requests or responses.

Two things to be clear about:

• This is the one case where your content genuinely leaves your device. It does not come to us, but it does go to the provider you chose. Providers may retain inputs and outputs for a period and may serve generated media from public URLs. Review your provider's settings and terms before sending anything confidential.
• Their terms govern, not ours. Each provider is an independent controller of what it receives.

libi also reads your locally-stored Claude Code credentials to show your plan usage. That token is used on your machine to call Anthropic's usage endpoint directly; it is never sent to us.

4.3 Things libi downloads to set itself up

On first run libi downloads bundled tools and models — ffmpeg, ffprobe, yt-dlp, and tracking models — from public hosts. As with any download, those hosts see your IP address, and their own privacy policies apply. We receive nothing from these requests.

5. What we collect

5.1 Product analytics (Google Analytics 4) — you can switch this off

Purpose. To learn which features are used, so we know what to build and fix. Nothing else. We do not advertise, profile, or sell anything.

What is sent. Short event names from a fixed list published in our source code (lib/analytics/events.ts) plus a few low-cardinality parameters — for example which export format was chosen, or which top-level media type was uploaded (video, image, audio). Never your prompts, file names, file contents, project names, chat messages, or any free text you type.

Identifier. A random UUID generated on first run and stored locally. It is sent to Google as both the client_id and the user_id. It is not derived from your hardware, name, email or OS account, and it does not follow you across websites. Deleting ~/.libi/libi.sqlite generates a new one.

Google's role. Google acts as our processor, and also processes some data as a controller for its own purposes. We do not enable Google Signals, advertising features, or ad personalisation.

How to turn it off. Settings → Privacy. Analytics is also disabled entirely in development builds and in test mode.

5.2 Crash and error reports (Sentry)

Purpose. To learn that libi crashed and where, so we can fix it.

We minimise this deliberately. We set sendDefaultPii: false, never call Sentry's user-identification API, do not capture local variables, and use no session replay. Before a report leaves your machine an automatic scrubber removes values whose keys or shapes look like credentials — API keys, tokens, passwords, cookies, authorization headers — and drops the user object, request headers, cookies and query strings.

What a crash report can still contain. We would rather tell you than let you find out:

• The error message and stack trace, including file paths. Before a report leaves your machine we strip your operating-system user name and the names of your own media files (anything under ~/.libi/storage/) from these paths, replacing them with placeholders. The surrounding path structure and the error message text itself can still be revealing.
• Diagnostic log lines from around the time of the error.
• Your operating system, app version and runtime versions.
• Your IP address is visible to Sentry as the origin of the connection, even though we do not attach it to the report.

For that reason we describe these reports as pseudonymous, not anonymous. We have no way to link one to you by name, but we cannot promise a report contains nothing traceable.

Turning it off. Settings → Privacy. This takes effect immediately, mid-session, with no restart. If you run libi from source or from the command line, you can also launch it with the environment variable LIBI_SENTRY_DISABLED=1, which acts as a hard kill-switch that wins over the Settings toggle.

Where it goes. Sentry (Functional Software, Inc., USA) acts as our processor. Data is stored in the United States.

5.3 The libi Pro waitlist

If you enter your email on the waitlist, today that address is stored only in your own browser's local storage and is never transmitted to us or anyone else. We do not operate a waitlist server yet.

When we build one we will ask for your consent at the point of collection, use the address only to tell you when libi Pro is available, never sell or share it, include an unsubscribe link in every message, and update this policy first.

5.4 This website

This website runs no analytics, no advertising and no third-party trackers, and sets no cookies of its own. Our hosting provider keeps standard server access logs for security. If we ever add analytics we will update this policy and add a consent banner for EU and UK visitors first.

6. Legal bases and your rights

We process the data above under Israel's Privacy Protection Law, 5741-1981 (as amended, including Amendment 13). Where you are in the EEA or UK, the GDPR also applies because libi is offered internationally: analytics rests on your consent, crash reporting on our legitimate interest in keeping the software working, and any future waitlist email on your consent.

You have the right to access, correct, delete and port your personal data, to object to processing based on legitimate interests, and to withdraw consent at any time. In practice, given how little we hold:

• Everything on your device is already fully under your control — read it, edit it, export it, or delete ~/.libi/. No request to us is needed.
• Analytics is keyed only to a random identifier we cannot link to a person, so we usually cannot find "your" records. If you send us your identifier we will locate and delete the matching data. Crash reports carry no identifier at all — we never call Sentry's user-identification API — so there is nothing for us to look "your" reports up by.
• Stopping future collection is the remedy that always works, and both switches are yours. Analytics goes off in Settings → Privacy; crash reporting — the legitimate-interest processing you have the right to object to under GDPR Art. 21(1) — goes off with its own switch in the same place, immediately and with no confirmation step (see §5.2). Neither requires a request to us.
• Waitlist: clear your browser storage. Once a backend exists, email us.

We respond within one month, free of charge. We will not demand identity documents for data we cannot tie to an identity.

EEA/UK residents may complain to their national supervisory authority. Israeli residents may complain to the Privacy Protection Authority.

7. Sharing and international transfers

We do not sell your personal data and never have. The only recipients are the processors named above — Google (analytics) and Sentry (crash reports) — plus our website host.

Both process data in the United States. Two separate regimes apply, running in opposite directions, and they are often conflated:

• Into Israel. The European Commission's adequacy decision for Israel (Decision 2011/61/EU) means personal data may flow from the EEA to us without additional safeguards.
• Out of Israel. That adequacy decision does nothing for our onward transfers to Google and Sentry. Those are governed by Israel's Privacy Protection (Transfer of Data Abroad) Regulations, 5761-2001, and rely on your consent together with each processor's contractual undertaking to apply Israeli-equivalent protections and not to transfer your data onward.

8. Retention

9. Security

Your projects are only as secure as the computer they sit on, and ~/.libi/ is not encrypted by libi. Use full-disk encryption and keep your machine updated. Your API keys live wherever you configured them — libi neither stores nor transmits them to us.

For the small amount we do handle: it travels over TLS, we minimise it as described, and we scrub credential-shaped values before reports leave your machine. We are a one-person project and do not claim enterprise security certifications.

libi is free and open source under GPL-3.0-only. Every claim here can be checked against the source — the analytics event list, the crash scrubber, and every network call are all readable. Please verify rather than trust us.

10. When libi Pro launches

This describes services that do not exist yet. We will publish a revised policy before any of it goes live, and none of it applies unless you choose to subscribe.

libi Pro will be an optional, paid membership. The free local app keeps working exactly as described above either way.

• Accounts and billing — an email address, a password hash, and billing handled by a payment processor. We will not store full card numbers.
• Cloud backup and sync — if you enable it, your projects and media will be transmitted to and stored on our infrastructure. This is a genuine change from today's model, and it will be opt-in per project, never a default.
• Team sharing — content you share becomes visible to your teammates; administrators will see membership and usage information.
• Managed model usage — if you opt in to our API keys instead of your own, your prompts and outputs pass through our servers and we log usage volume to enforce limits and bill correctly. We will not train models on your content.
• Social publishing — if you connect a social account we will store OAuth tokens to publish on your behalf, encrypted at rest, used only for actions you scheduled, and deleted when you disconnect.

That version will add a subprocessor list, a data-processing agreement, a breach-notification commitment and a full account-deletion flow.

11. Changes

We post revisions here with a new date and version. Because the repository is public, every superseded version stays permanently visible in the git history. For material changes — especially anything that increases what we collect — we will give 30 days' notice first.

12. Contact

Email: admin@nagellabs.com · Postal: [POSTAL ADDRESS]