Security and privacy
How Larvabot encrypts your keys, what the tracking snippet collects (no cookies, no IPs), sessions, and what never leaves your account.
Larvabot holds API keys, mailbox passwords and your outreach history, so it's built to keep them locked down and to collect as little as possible about anyone else.
#Your keys
- Encrypted at rest. Secrets saved in Settings (API keys, SMTP and IMAP passwords, tokens, the Telegram session) are encrypted with AES-256-GCM before they reach the database, with a key that's kept separately from it. A database backup on its own can't reveal them.
- Never shown again. After saving, Settings only shows the last four characters, like
••••x7Qa. - Only sent where they belong. Each key goes only to its own provider's API.
- Easy to revoke. Deleting a key in Settings removes it immediately. Revoking it at the provider works too, and Larvabot simply moves on to the next provider in the chain.
Your inbox address is stored encrypted too, and never appears in anything Larvabot sends.
#Your account
- Passwords are hashed with scrypt and a unique salt, never stored in plain text.
- Sessions last 30 days with Keep me signed in, or one day without. Changing your password or clicking Sign out all other sessions ends every other session.
- The sign-in and password reset forms are protected against bots.
- Everything in the dashboard requires you to be signed in, and your projects are only visible to you.
#Connected apps and API keys
API keys (for Zapier, Make, n8n and the API) and apps you connect by signing in (Claude, ChatGPT and other MCP apps) can only read your projects, leads and conversations. None of them can post, send email or change anything. Revoke a key or disconnect an app under Settings → Integrations and it loses access straight away.
When an app asks to connect, Larvabot's approval page says which app it is and where access goes. Apps Larvabot recognises are marked Verified; for any other, you'll see a warning with the exact web address that would get access, and you have to tick that you trust it. Only approve a connection you started yourself: Larvabot never emails you a link asking you to approve an app.
#Reporting a security issue
Found something? Email [email protected] with the steps to reproduce. Please test only against your own account and don't access other people's data.
#What the tracking snippet collects
The tracking snippet on your site records, per page view:
| Collected | Not collected |
|---|---|
| Page path | Cookies or local storage |
| Referring URL | IP addresses |
ref and utm_* tags | Device fingerprints |
| Country | Names, emails or any form data |
| Time | Anything that follows a person between visits |
#What Larvabot does with other people's data
- Leads. It stores the public page it found, a summary, and the contact details published on that page or found through the email finders you connected. You can skip or delete any lead.
- Conversations. It stores the public post's link, title, a short excerpt and the author's public username.
- Telegram groups. It reads recent messages in groups you've joined, and keeps only the ones filed as conversations.
- Contacts. Only the people you import yourself.
Nothing is shared between projects, and nothing is sold or used for anything but your outreach.
#Things Larvabot never does
- Send an email you didn't approve
- Post, comment, vote, react or join anything on any platform
- Use a paid tier of any provider on its own
- Show your full keys back to you or anyone else