Privacy Policy

Last updated: 2026-08-13 · Version: 2.0

Applies to the libi desktop application, the libi CLI (npx @nagellabs/libi), and this website.

The short version

This describes libi as it works today: the free, local, open-source app. It runs on your computer. Your videos, audio, images, projects and database live in a folder on your own machine (~/.libi/). We never receive them. There is no libi account, no libi server holding your work, and no upload step.

Some things do leave your machine, and we explain each below:

1. 01Product analytics — anonymous usage counters sent to Google Analytics. You can turn this off in Settings → Privacy.
2. 02Crash reports — error reports sent to Sentry so we can fix bugs. You can turn this off in Settings → Privacy too; see §5.2, which also explains honestly what a crash report can contain.
3. 03Requests you ask libi to make — when you generate a voice, an image or a video, libi calls that provider directly from your machine using your own API key. Those requests go to the provider, not to us. For one feature, this includes uploading your video file — see §4.2.
4. 04Your email, if you join the paid membership waitlist — and only then. This is the one thing we hold that identifies you, you have to type it in and send it yourself, and we use it for a single announcement. See §5.3.

A paid membership would change this — by your choice, and only then (§10). Subscribing would mean a libi account, and features like cloud backup and team sharing exist to put some of your files on our servers. That is the point of them. It stays opt-in, the free local app keeps working exactly as described above whether or not you subscribe, and we will publish a revised policy before any of it goes live.

If you read one section, read §4 — What leaves your device.

1. Who we are

libi is operated by Nadav Nagel, an individual sole proprietor in Israel. There is no company entity behind libi at the time of writing.

• Privacy enquiries: admin@nagellabs.com
• Postal address: Yarden Street, Rosh HaAyin, Israel
• EU representative (Art. 27 GDPR): none appointed. We are established in Israel, and we consider the processing described here to fall within the Art. 27(2) exemption — it is limited, involves no special-category data, and is not large-scale. If that stops being true we will appoint a representative and name them here. Until then, write to admin@nagellabs.com, which reaches the controller directly.

For the limited processing described here we are the data controller. For everything that happens inside the app on your own machine there is no controller relationship at all — we have no access to it.

2. Who this is for

libi is not directed at children. You must be at least 16, or the age of digital consent where you live, to use libi. We do not knowingly collect personal data from children. If you believe a child has given us personal data, email us and we will delete it.

3. What stays on your device

Everything you create lives locally under ~/.libi/ (or LIBI_HOME):

We never receive any of it. There is no sync, no backup, no upload to us — none exists to enable. Deleting ~/.libi/ deletes everything libi holds locally. Because this sits on your computer under your control, backing it up and securing it is your responsibility (§11). (Cloud backup and sync are among the things a future paid membership would add; §10.)

Note that ~/.libi/logs/ contains diagnostic logs including absolute file paths of media you work with — which means file names you chose. These stay on your machine, but a subset can be included in crash reports. See §5.2.

4. What leaves your device

4.1 Things that come to us

Product analytics (§5.1), crash reports (§5.2), and — only if you choose to join the waitlist — your email address (§5.3). That is the complete list, and it stays complete for as long as you use the free app. A paid membership would add to it, by your choice; §10.

4.2 Things your machine sends to AI providers on your own account

When you ask libi to generate media, libi calls the provider directly from your computer, authenticated with the API key you supplied. We do not proxy these calls and never see your keys, requests or responses. That is true of every model call libi makes today. If we later offer hosted models as part of a paid membership, using them would be your choice and that traffic would pass through us — see §10, and we will publish a revised policy before any of it goes live.

Two things to be clear about:

• This is the one case where your content genuinely leaves your device. It does not come to us, but it does go to the provider you chose. Providers may retain inputs and outputs for a period and may serve generated media from public URLs. Review your provider's settings and terms before sending anything confidential.
• Their terms govern, not ours. Each provider is an independent controller of what it receives.

libi also reads your locally-stored Claude Code credentials to show your plan usage. That token is used on your machine to call Anthropic's usage endpoint directly; it is never sent to us.

4.3 Things libi downloads to set itself up

On first run libi downloads bundled tools and models — ffmpeg, ffprobe, yt-dlp, and tracking models — from public hosts. As with any download, those hosts see your IP address, and their own privacy policies apply. We receive nothing from these requests.

5. What we collect

5.1 Product analytics (Google Analytics 4) — you can switch this off

Purpose. To learn which features are used, so we know what to build and fix. Nothing else. We do not advertise, profile, or sell anything.

What is sent. Short event names from a fixed list published in our source code (lib/analytics/events.ts) plus a few low-cardinality parameters — for example which export format was chosen, or which top-level media type was uploaded (video, image, audio). Never your prompts, file names, file contents, project names, chat messages, or any free text you type.

Identifier. A random UUID generated on first run and stored locally. It is sent to Google as both the client_id and the user_id. It is not derived from your hardware, name, email or OS account, and it does not follow you across websites. Deleting ~/.libi/libi.sqlite generates a new one.

Google's role. Google acts as our processor, and also processes some data as a controller for its own purposes. We do not enable Google Signals, advertising features, or ad personalisation.

How to turn it off. Settings → Privacy. Analytics is also disabled entirely in development builds and in test mode.

5.2 Crash and error reports (Sentry)

Purpose. To learn that libi crashed and where, so we can fix it.

We minimise this deliberately. We set sendDefaultPii: false, never call Sentry's user-identification API, do not capture local variables, and use no session replay. Before a report leaves your machine an automatic scrubber removes values whose keys or shapes look like credentials — API keys, tokens, passwords, cookies, authorization headers — and drops the user object, request headers, cookies and query strings.

What a crash report can still contain. We would rather tell you than let you find out:

• The error message and stack trace, including file paths. Before a report leaves your machine we strip your operating-system user name and the names of your own media files (anything under ~/.libi/storage/) from these paths, replacing them with placeholders. The surrounding path structure and the error message text itself can still be revealing.
• Diagnostic log lines from around the time of the error.
• Your operating system, app version and runtime versions.
• Your IP address is visible to Sentry as the origin of the connection, even though we do not attach it to the report.

For that reason we describe these reports as pseudonymous, not anonymous. We have no way to link one to you by name, but we cannot promise a report contains nothing traceable.

Turning it off. Settings → Privacy. This takes effect immediately, mid-session, with no restart. If you run libi from source or from the command line, you can also launch it with the environment variable LIBI_SENTRY_DISABLED=1, which acts as a hard kill-switch that wins over the Settings toggle.

Where it goes. Sentry (Functional Software, Inc., USA) acts as our processor. Data is stored in the United States.

5.3 The paid membership waitlist

Opt-in. Nothing is sent unless you type your address and press "Join waitlist".

If you join the waitlist, your email address is sent to us and stored on our servers. Alongside it we store the date and time you joined, which membership you asked about, and — where your app sent one — the version of libi you signed up from. We do not store your IP address, your device details or anything that ties the address to the rest of your use of libi.

What we use it for. One thing: telling you when the membership is available. We will not sell it, share it, add you to any other mailing list, or use it to profile you. Every message we send includes a way to unsubscribe.

Where it goes. The list is stored in Google Cloud Firestore (Google LLC acting as our processor) in the United States. Because that is outside Israel and the EEA, the transfer relies on Google's Standard Contractual Clauses.

How long we keep it. Until the membership launches and we have told you, or until you ask us to delete it — whichever comes first. If the membership is shelved, we delete the list.

Your copy of it. Your own computer also remembers that you joined, so the app can show you a confirmation instead of an empty form. Clearing that — including with the app's "leave waitlist" control — only affects your computer. To have the address itself deleted, email us (§6).

5.4 This website

This website runs no analytics, no advertising and no third-party trackers, and sets no cookies of its own. Our hosting provider keeps standard server access logs for security. If we ever add analytics we will update this policy and add a consent banner for EU and UK visitors first.

6. Legal bases and your rights

We process the data above under Israel's Privacy Protection Law, 5741-1981 (as amended, including Amendment 13). Where you are in the EEA or UK, the GDPR also applies because libi is offered internationally: analytics rests on your consent, crash reporting on our legitimate interest in keeping the software working, and the waitlist email on your consent — given by the deliberate act of typing your address into a form headed "Join waitlist" and pressing the button, having been told beside it where the address goes and what it is used for. Nothing is pre-filled and nothing is sent unless you send it.

You have the right to access, correct, delete and port your personal data, to object to processing based on legitimate interests, and to withdraw consent at any time. In practice, given how little we hold:

• Everything on your device is already fully under your control — read it, edit it, export it, or delete ~/.libi/. No request to us is needed.
• Analytics is keyed only to a random identifier we cannot link to a person, so we usually cannot find "your" records. If you send us your identifier we will locate and delete the matching data. Crash reports carry no identifier at all — we never call Sentry's user-identification API — so there is nothing for us to look "your" reports up by.
• Stopping future collection is the remedy that always works, and both switches are yours. Analytics goes off in Settings → Privacy; crash reporting — the legitimate-interest processing you have the right to object to under GDPR Art. 21(1) — goes off with its own switch in the same place, immediately and with no confirmation step (see §5.2). Neither requires a request to us.
• Waitlist: this is the one thing we hold that is tied to you by name, so it is the one thing we can act on directly. Email admin@nagellabs.com from the address you signed up with, or naming it, and we will delete it and confirm. Unsubscribing from a message we send does the same. Clearing your browser storage does not — that only removes your computer's copy of the confirmation.

We respond within one month, free of charge. We will not demand identity documents for data we cannot tie to an identity.

EEA/UK residents may complain to their national supervisory authority. Israeli residents may complain to the Privacy Protection Authority.

7. Sharing and international transfers

We do not sell your personal data and never have. The only recipients are the processors named above — Google (analytics, and Cloud Firestore for the waitlist) and Sentry (crash reports) — plus our website host.

All of them process data in the United States. Two separate regimes apply, running in opposite directions, and they are often conflated:

• Into Israel. The European Commission's adequacy decision for Israel (Decision 2011/61/EU) means personal data may flow from the EEA to us without additional safeguards.
• Out of Israel. That adequacy decision does nothing for our onward transfers to Google and Sentry. Those are governed by Israel's Privacy Protection (Transfer of Data Abroad) Regulations, 5761-2001, and rely on your consent together with each processor's contractual undertaking to apply Israeli-equivalent protections and not to transfer your data onward.

8. Retention

9. Security

Your projects are only as secure as the computer they sit on, and ~/.libi/ is not encrypted by libi. Use full-disk encryption and keep your machine updated. Your API keys live wherever you configured them — libi neither stores nor transmits them to us.

For the small amount we do handle: it travels over TLS, we minimise it as described, and we scrub credential-shaped values before reports leave your machine. The waitlist is stored with secured, access-controlled cloud infrastructure (Google Firebase); the credentials that can touch it are held server-side only and are never shipped in the app or in this site's client code. We are a one-person project and do not claim enterprise security certifications.

libi is free and open source under GPL-3.0-only. Every claim here can be checked against the source — the analytics event list, the crash scrubber, and every network call are all readable. Please verify rather than trust us.

10. When the paid membership launches

This describes services that do not exist yet. We will publish a revised policy before any of it goes live, and none of it applies unless you choose to subscribe.

It will be an optional, paid membership — the app calls it libi Pro today, and the name may change before launch; this section applies to whatever we end up calling it. The free local app keeps working exactly as described above either way.

• Accounts and billing — an email address, a password hash, and billing handled by a payment processor. We will not store full card numbers.
• Cloud backup and sync — if you enable it, your projects and media will be transmitted to and stored on our infrastructure. This is a genuine change from today's model, and it will be opt-in per project, never a default.
• Team sharing — content you share becomes visible to your teammates; administrators will see membership and usage information.
• In-app AI coding and generation models — if you opt in to our models and API keys instead of your own, the prompts and outputs involved — both the coding chat that drives the editor and any voice, footage, music or art you generate — pass through our servers, and we log usage volume to enforce limits and bill correctly. We will not train models on your content.
• Social publishing — if you connect a social account we will store OAuth tokens to publish on your behalf, encrypted at rest, used only for actions you scheduled, and deleted when you disconnect.

That version will add a subprocessor list, a data-processing agreement, a breach-notification commitment and a full account-deletion flow.

11. Changes

We post revisions here with a new date and version. Because the repository is public, every superseded version stays permanently visible in the git history. For material changes — especially anything that increases what we collect — we will give 30 days' notice first.

12. Contact

Email: admin@nagellabs.com · Postal: Yarden Street, Rosh HaAyin, Israel