1. Controller
Samin Sabahudin Grahich (Apiboo), Traunaustraße 29/13, 4600 Wels, Österreich, is the data controller for personal data processed by Apiboo (see Impressum). Contact: hello@apiboo.com.
2. Local-first by design
The Apiboo desktop app stores your collections, requests, environments and other work on your own device by default. Cloud sync, team workspaces and other server-backed features are optional and only send data to our servers when you turn them on.
3. What we collect and why
Account data (email, name, authentication identifiers) — to create and secure your account (contract performance). Data you sync or share — to provide the features you use (contract performance). Billing data — processed by Stripe; we store subscription status and invoices, not full card numbers (contract/legal obligation). Transactional email (verification, password reset, invitations) — sent via Resend (contract performance). Operational logs (login IP address and approximate location (country/region), timestamps, request metadata to our own API) — for account security, fraud and abuse prevention and rate limiting (legitimate interest, Art. 6(1)(f) GDPR). Location is derived on our own servers (no data leaves the EU). Security logs containing the full IP are kept for 90 days and then deleted; only truncated / aggregated statistics are retained longer. Anti-abuse records (the IP address a newsletter subscription or a promotional-code redemption was submitted from) — so that signup forms, free trials and discount codes cannot be redeemed repeatedly from one source, and so we can stop automated abuse of them (legitimate interest, Art. 6(1)(f) GDPR; Recital 49 recognises network and information security as such an interest). We keep the address itself rather than a shortened version because a shortened one would group unrelated people who share a network and produce false accusations. These addresses are erased 90 days after they are recorded, and are covered by your access and erasure rights below like everything else. Update checks (the app version, operating system and CPU architecture sent when the desktop app checks for updates, and the country your connection comes from) — so we can see how many installations are active, roughly where they are, and which versions are still in use, which tells us how long to support older releases and where to run our servers (legitimate interest, Art. 6(1)(f) GDPR). The country is worked out from your IP address on our own servers, in memory, at the moment of the request, using a local database; the address is not written to disk for this and is not sent anywhere. These daily counts hold no identifier, no link to your account and no IP address — only daily aggregate counts per country. From version 1.0.6 the same request also carries the installation’s licence key, described next. Installation licence (from desktop app 1.0.6) — on first launch the app creates a random installation ID (it is not derived from your device: no hardware serial, network address, computer or user name) and registers it once; our server answers with a free, signed licence key for that installation. The key is sent with the update check and, when you sign in, linked to your account. We store the licence, a one-way hash of the installation ID, the first and last day it was seen, the time of its latest update check, the app version it runs, operating system, CPU architecture and the country your connection came from — never the IP address. We use it to provide and manage the licence (including paid tiers later) and to count distinct installations instead of guessing from daily totals (contract performance, Art. 6(1)(b) GDPR, and legitimate interest, Art. 6(1)(f) GDPR). Installations not seen for 24 months are deleted automatically. The key itself carries no usage information. Newsletter (only if you ask for it — on the website, or by ticking the box when you create an account) — your email address, when and where you signed up, and when you gave your consent, so we can send you product news. Ticking the box at sign-up counts as confirmation once your address is verified, so no second confirmation mail is sent. You can unsubscribe at any time with the link in every newsletter; this withdraws your consent (consent, Art. 6(1)(a) GDPR). Payments for a licence or support — when you buy a licence or support Apiboo, Stripe processes the payment and card details; we receive and store the amount, currency, status, the Stripe payment and subscription IDs and, when you buy from inside the app, the installation licence the purchase belongs to, so the licence can be activated and the payment shown to our administrators. We do not store card data. The email address you give at checkout is used once to send your activation key (contract performance, Art. 6(1)(b) GDPR; bookkeeping, Art. 6(1)(c) GDPR). Feature usage (optional) — only while "Send usage data" is on in the app's settings (you can switch it off at any time): once a day at most, the names of the app features this installation used that day (for example "Terminal", "PowerShell", "Vault unlock", or which AI coding agent called the app's MCP server), together with the licence key, so we know how many installations use each feature and what to improve (legitimate interest, Art. 6(1)(f) GDPR). Never the content of anything: no requests, files, commands, hosts or names you entered. It is deleted together with the installation record. Website statistics (the page you open on apiboo.com, whether it is the first page of your visit, the website that linked you here (its address only, never the page), which download button you click, and — when a link carries a campaign tag such as ?ref= — the name of that campaign) — so we can see how many visits the site gets, which pages people read, where visitors come from and how many visits lead to a download (legitimate interest, Art. 6(1)(f) GDPR). This is counted on our own servers as daily totals only. We store no cookie and no identifier in your browser for it: a few flags in your browser's session storage mark that your visit, your first download click and — if you arrived through a campaign link — that arrival have already been counted; they disappear when you close the tab. We keep no IP address, no browser signature and no hash of either for these statistics, so nothing in them can be traced back to a person; your address is held in memory only for the rate-limit window and then forgotten, as everywhere else on our API.
4. What we do not do
We do not sell personal information and, apart from the consent-gated Google Ads measurement described in section 8, we do not share it for cross-context behavioral advertising, and have not done so in the preceding 12 months. We advertise on Google and, only if you accept in the cookie banner, let Google measure whether those ads led to a visit (see section 8); we still do not sell your data, and we do not train AI models on your content. We do not receive, store or process what you send to the AI assistant: it runs on an API key you supply, and requests go directly from your device to the provider you chose.
5. Processors and transfers
We use a small set of processors: our own application servers, hosted with EU-based infrastructure providers; Stripe (payments); Resend (transactional email); and — only after you accept in the cookie banner — Google Ireland Ltd (Google Ads conversion measurement and ad personalisation), whose transfers to the United States rely on the EU-US Data Privacy Framework and standard contractual clauses. Web fonts are self-hosted. The Google tag library (gtag.js) is loaded from Google on every page — Google receives your IP address and the page URL, as with any script download — but it sets no cookies and transmits no identifiers until you accept the cookie banner. Where a processor handles data outside the EEA, transfers rely on adequacy decisions or standard contractual clauses. The AI assistant is not in this list: it uses an API key you supply, and your prompts go directly from your device to the provider you selected (Anthropic, OpenAI or Google) under your own agreement with them — we are not a party to it and never see that traffic. What is sent is the messages you write plus the results of the actions the assistant takes on your behalf (for example a request URL and status, a database schema, or the output of a command you approved); the app minimises those results before they leave your device. Anything you have marked as secret is held back, and we also look for values that appear to be credentials — API keys, tokens, passwords in a connection string — and replace them automatically. That automatic check recognises the common formats, but it cannot recognise every possible one, so please do mark sensitive values as secret: that is the setting we guarantee.
6. Retention and deletion
Account data is kept while your account exists. If you delete your account, synced content and personal data are deleted within 30 days, except records we must keep for legal reasons (e.g. invoices). Local data on your device is yours to delete at any time.
7. Your rights
Under the GDPR (and similar laws) you can request access, correction, deletion, restriction, portability, and can object to legitimate-interest processing. Write to hello@apiboo.com. You also have the right to lodge a complaint with the Austrian data protection authority (Datenschutzbehörde, www.dsb.gv.at) or your local supervisory authority.
8. Cookies
The apiboo.com website uses strictly necessary cookies/local storage needed for the site to function (e.g. remembering your session and language, and flags that mark your visit and first download click as already counted — see section 3). Beyond that, and only if you accept in the cookie banner, Google Ads sets cookies (_gcl_*) for conversion measurement and ad personalisation; no Google cookies are set before you accept. Your choice is stored in your browser's local storage for 12 months, and you can withdraw or change it at any time via "Cookie settings" in the footer. The desktop app does not use browser cookies; it does store data locally on your device so it can work (your settings, cached data and your local collections, requests and environments), but that data stays on your device and is never used for tracking or advertising.
9. Changes
We will announce material changes to this policy by email or in-app before they take effect. The latest version is always at apiboo.com/privacy.