This Privacy Policy explains what data the Lubo desktop app (“Lubo”, the “App”) and the zatsepin.dev website collect, why we collect it, and how you can control it. It applies to the most recent version of the App. We (“we”, “us”) are Yura Zatsepin, an individual entrepreneur registered in the Russian Federation, based on operating as an independent developer.
1. Privacy by design
Lubo is designed to keep your data on your computer. Indexing, semantic search, color analysis and text recognition (OCR) run locally using small open-source models. Your files, screenshots, folder names, search queries and recognized text never leave your device. There is no cloud, no account and no upload feature in Lubo.
2. What Lubo does NOT collect
- content of your files or screenshots;
- text recognized by OCR or semantic-search embeddings;
- file names, folders or any metadata of your library;
- keystrokes or browsing activity;
- your name, email, phone number or payment details.
This applies to the App on your device. The only exception is the website checkout: when you purchase a license, we do collect the contact details you provide voluntarily — see §7.
3. Installation telemetry
On first launch, Lubo sends one short “install” event to
our server (zatsepin.dev) so we can count how many times
the App is installed. It contains:
- a randomly generated device identifier;
- the app name and app version;
- the operating system.
The event is sent once. We do not track how you use the app and do not receive any further telemetry. If your browser or device sends a “Do Not Track” (DNT) or Global Privacy Control (GPC) signal, our server declines and discards the event.
4. License validation
When you activate a license key, the App contacts our server and sends the license-key value, a random device identifier, an optional device name and the product code. Once a day the App calls a “heartbeat” endpoint using the signed token it received, to keep its offline license certificate valid; calling the endpoint also refreshes last-seen time for the activated device. This data is used solely to enforce the license (device limit, revocation) and to prevent abuse.
- The license key is stored on our server only as a SHA-256 hash; the plaintext key is never stored.
- Activation records include the device identifier, device name (if any) and product code, and are kept for as long as the activation is active. The IP address is not stored in activation records.
- Offline validation uses a short, cryptographically signed token that is stored locally by the App and expires after 30 days.
5. Updates
The App periodically requests a small version manifest from our server
(zatsepin.dev/lubo/latest.json) on launch to check whether
a newer version is available. This request contains no personal data.
Updates are downloaded and installed only after you confirm them.
6. The website (zatsepin.dev)
Our website uses a self-hosted, cookieless analytics service (Umami) to count page views. It does not use cookies and we ask it to honor browser “Do Not Track” and Global Privacy Control signals.
Umami records the page you viewed, the referrer, your browser and device type, your country and the time of the visit. The IP address itself is not stored as an analytics field: the visit identifier is derived from the IP address, the browser User-Agent and a salt that is rotated automatically every month, so after a rotation the analytics can no longer be linked back to a particular IP address. If you sign in to your account, visits made in that browser may be linked to your user identifier.
When you click a Lubo download button, the site records a single event with a randomly generated identifier, the operating system and the app version, so we can see how many downloads each platform receives. This respects “Do Not Track” and is used only for aggregate download statistics.
Our server also keeps security logs for the website and the license endpoints. These may contain the IP address, the browser User-Agent, the time, the HTTP method and path and the response status. The logs are used only to keep the service running and secure, to detect abuse and to investigate incidents, are never used for profiling or advertising, and are deleted automatically after 5 days.
When you sign in to your account, the server stores a pseudonymous fingerprint of the sign-in location to protect the account: a one-way MD5 hash computed from the IP address and the User-Agent. The IP address itself is not part of that record. At most 5 fingerprints are kept per account, a sign-in from a new location triggers an email notice, and the fingerprints are removed when you change your password, when they are pushed out by newer locations, or when the account is deleted.
Newsletter. You can subscribe to email updates on the
/subscribe page. You
enter your email address, confirm it with a one-time code, and
separately tick a consent checkbox for receiving the emails; without
that checkbox the subscription is not created. We store your email
address, the subscription flag, the date and time consent was given,
and a random unsubscribe token. Signing in to your account is not a
subscription by itself. The emails contain only new posts and
announcements of our own projects — no third-party advertising, and
we never share the address list. Every email carries a one-click
unsubscribe link plus the standard List-Unsubscribe
header, so you can unsubscribe straight from your mail client.
Unsubscribing stops the newsletter immediately and does not affect
your account, license or purchased materials. The unsubscribe token is
kept after you unsubscribe so that links in older emails keep working;
it is unrelated to your password and grants no access to the account.
7. Purchases and payment
When you purchase a license on our website, the checkout form asks for your email address, first and last name, phone number and, optionally, your company name. Before you can continue to payment you must tick a separate consent checkbox confirming that you agree to the processing of your personal data as described in this policy; the order cannot be placed without that consent. We use this data solely to process your order: create the order record, deliver the license key, issue a payment receipt, resolve payment issues and provide customer support. We do not use it for marketing; the newsletter is a separate opt-in described in §6.
Payment itself is processed by a third-party payment provider. Your card details are collected and processed by that provider under its own privacy policy — we never see or store them. Order records (contact details and order metadata) are stored in our own system and are kept for as long as required for accounting and tax purposes and for the lifetime of your license, after which they are deleted or anonymized.
8. Storage and third parties
The data described above is stored on our own servers. We do not sell or rent any data. We do not share data with third parties except:
- our payment provider, to process your purchase (see above);
- hosting and infrastructure providers that operate the server;
- public authorities, if we have a good-faith belief that it is required by applicable law, or to protect our rights and safety.
9. Your rights
You can delete your local installation data at any time by uninstalling the App and removing its data directory. To exercise your rights over data stored on our servers — including the contact details from your purchase — access, correction, deletion, restriction or data portability — or to revoke any consent you may have given, email us at support@zatsepin.dev. We will respond within a reasonable period (in the EU/EEA, within one month as required by the GDPR). Where the GDPR applies to you, the data described above is processed on the legal grounds of contract performance (license activation and delivery), consent (the checkout details you submit) and legitimate interest (security, abuse prevention and aggregate download statistics). You can revoke the newsletter consent at any time with the unsubscribe link in any email — that is the fastest way and it takes effect immediately.
Security logs are kept for 5 days only, so an erasure request cannot reach entries older than that — they are already gone. Analytics data is stored under a rotating salted identifier and is no longer linkable to an IP address once the salt rotates (at least once a month).
If you are in the EU/EEA, you also have the right to lodge a complaint with your local data-protection supervisory authority.
10. Changes to this policy
We may update this Privacy Policy from time to time. The current version is always published at /lubo/privacy with the date of the last update. Significant changes will be announced in the App before they take effect.
11. Contact
For any privacy or data questions, contact us at support@zatsepin.dev or hi@zatsepin.dev.