1. Controller
Samin Sabahudin Grahich (Apiboo), Traunaustraße 29/13, 4600 Wels, Österreich, is the data controller for personal data processed by Apiboo (see Impressum). Contact: hello@apiboo.com.
2. Local-first by design
The Apiboo desktop app stores your collections, requests, environments and other work on your own device by default. Cloud sync, team workspaces and other server-backed features are optional and only send data to our servers when you turn them on.
3. What we collect and why
Account data (email, name, authentication identifiers) — to create and secure your account (contract performance). Data you sync or share — to provide the features you use (contract performance). Billing data — processed by Stripe; we store subscription status and invoices, not full card numbers (contract/legal obligation). Transactional email (verification, password reset, invitations) — sent via Resend (contract performance). Operational logs (login IP address and approximate location (country/region), timestamps, request metadata to our own API) — for account security, fraud and abuse prevention and rate limiting (legitimate interest, Art. 6(1)(f) GDPR). Location is derived on our own servers (no data leaves the EU). Security logs containing the full IP are kept for 90 days and then deleted; only truncated / aggregated statistics are retained longer. Anti-abuse records (the IP address a newsletter subscription or a promotional-code redemption was submitted from) — so that signup forms, free trials and discount codes cannot be redeemed repeatedly from one source, and so we can stop automated abuse of them (legitimate interest, Art. 6(1)(f) GDPR; Recital 49 recognises network and information security as such an interest). We keep the address itself rather than a shortened version because a shortened one would group unrelated people who share a network and produce false accusations. These addresses are erased 90 days after they are recorded, and are covered by your access and erasure rights below like everything else. Update checks (the app version, operating system and CPU architecture sent when the desktop app checks for updates) — so we can see how many installations are active and which versions are still in use, which tells us how long to support older releases (legitimate interest, Art. 6(1)(f) GDPR). We store no identifier, no link to your account and no IP address for this — only daily aggregate counts.
4. What we do not do
We do not sell personal information and we do not share it for cross-context behavioral advertising, and have not done so in the preceding 12 months. We do not use third-party advertising, and we do not train AI models on your content. AI-assistant features only send the specific content you submit when you invoke them.
5. Processors and transfers
We use a small set of processors: our own application servers, hosted with EU-based infrastructure providers; Stripe (payments); Resend (transactional email); Anthropic (the AI model behind the assistant, which receives only the content you submit when you invoke it). Web fonts are self-hosted, so using this site sends nothing to any third-party CDN. Where a processor handles data outside the EEA, transfers rely on adequacy decisions or standard contractual clauses.
6. Retention and deletion
Account data is kept while your account exists. If you delete your account, synced content and personal data are deleted within 30 days, except records we must keep for legal reasons (e.g. invoices). Local data on your device is yours to delete at any time.
7. Your rights
Under the GDPR (and similar laws) you can request access, correction, deletion, restriction, portability, and can object to legitimate-interest processing. Write to hello@apiboo.com. You also have the right to lodge a complaint with the Austrian data protection authority (Datenschutzbehörde, www.dsb.gv.at) or your local supervisory authority.
8. Cookies
The apiboo.com website uses only strictly necessary cookies/local storage needed for the site to function (e.g. remembering your session and language). We do not use third-party tracking or advertising cookies. The desktop app does not use browser cookies; it does store data locally on your device so it can work (your settings, cached data and your local collections, requests and environments), but that data stays on your device and is never used for tracking or advertising.
9. Changes
We will announce material changes to this policy by email or in-app before they take effect. The latest version is always at apiboo.com/privacy.