Reference
Security and privacy
How Larvabot encrypts your keys, what the tracking snippet collects (no cookies, no IPs), sessions, and what never leaves your account.
2 min readUpdated
Larvabot holds API keys, mailbox passwords and your outreach history, so it's built to keep them locked down and to collect as little as possible about anyone else.
#Your keys
- Encrypted at rest. Secrets saved in Settings (API keys, SMTP and IMAP passwords, tokens, the Telegram session) are encrypted with AES-256-GCM before they reach the database, with a key that's kept separately from it. A database backup on its own can't reveal them.
- Never shown again. After saving, Settings only shows the last four characters, like
••••x7Qa. - Only sent where they belong. Each key goes only to its own provider's API.
- Easy to revoke. Deleting a key in Settings removes it immediately. Revoking it at the provider works too, and Larvabot simply moves on to the next provider in the chain.
Your inbox address is stored encrypted too, and never appears in anything Larvabot sends.
#Your account
- Passwords are hashed with scrypt and a unique salt, never stored in plain text.
- Sessions last 30 days with Keep me signed in, or one day without. Changing your password or clicking Sign out all other sessions ends every other session.
- The sign-in and password reset forms are protected against bots.
- Everything in the dashboard requires you to be signed in, and your projects are only visible to you.
#What the tracking snippet collects
The tracking snippet on your site records, per page view:
| Collected | Not collected |
|---|---|
| Page path | Cookies or local storage |
| Referring URL | IP addresses |
ref and utm_* tags | Device fingerprints |
| Country | Names, emails or any form data |
| Time | Anything that follows a person between visits |
#What Larvabot does with other people's data
- Leads. It stores the public page it found, a summary, and the contact details published on that page or found through the email finders you connected. You can skip or delete any lead.
- Conversations. It stores the public post's link, title, a short excerpt and the author's public username.
- Telegram groups. It reads recent messages in groups you've joined, and keeps only the ones filed as conversations.
- Contacts. Only the people you import yourself.
Nothing is shared between projects, and nothing is sold or used for anything but your outreach.
#Things Larvabot never does
- Send an email you didn't approve
- Post, comment, vote, react or join anything on any platform
- Use a paid tier of any provider on its own
- Show your full keys back to you or anyone else