Privacy policy

This policy explains what personal data Larvabot collects, why, who helps us process it, how long we keep it and what you can do about it. It covers our website (larvabot.com), the Larvabot dashboard (app.larvabot.com) and the small tracking script members add to their own sites.

Questions or requests: [email protected].

#Who we are

Larvabot is an outreach tool for indie hackers and small projects. For data about our website visitors and our members, we decide how it's used, so we are the controller. For data members collect with Larvabot about the people they contact (their leads, contacts and site visitors), the member decides how it's used, so the member is the controller and we process it on their behalf. See People our members contact.

#What we collect

#When you visit larvabot.com

• Analytics. If you accept analytics cookies, we use Google Analytics to understand which pages are read and how people find us. It sets cookies and receives your IP address, browser details and pages visited. If you decline, it doesn't load. See the cookie notice.
• Server logs. Our hosting provider records technical request data (IP address, time, page, browser) for security and to keep the site running.
• Waitlist sign-ups. If you join the waitlist we store your email address, which form you used and a country derived from your connection. We don't store your IP address with it. We send you a welcome email and, later, an invitation.

#When you have a Larvabot account

• Account details: your name, email address and a password hash (never the password itself), plus sign-in times, your plan and its billing status. If you sign in with Google or GitHub, we receive your name and verified email address from them.
• Your settings: the API keys, mail account details and tokens you add. Secrets are encrypted before they're stored and only their last four characters are ever shown again.
• Your projects: the sites you add, their profiles, campaigns, drafts, notes and reports.
• Usage and logs: how many calls each connected service made (to keep you inside free quotas) and a log of background jobs, so you and we can see what ran.

#When you use the Larvabot browser extension

The extension for Chrome and Microsoft Edge is a side panel for your Larvabot account. It has no access to the pages you visit: it can't read, record or change them, and it doesn't collect your browsing history.

• What it sends to Larvabot: only what you act on. When you select text on a page and choose Save to Larvabot, it sends that selected text and the page's address, so Larvabot can draft a reply. When you click Replied or Skip, it records that on the conversation.
• What it keeps in your browser: its sign-in tokens, the project you picked, and any edits you make to a draft before you post it. Signing out deletes the tokens.
• What it never does: post, comment, send messages or click anything for you; read your other tabs; or sell or share any of this data. Saved posts are used only to find and draft replies for your own projects, under the rest of this policy.

The use of information received from the extension adheres to the Chrome Web Store User Data Policy, including the Limited Use requirements. Disconnect the extension any time under Settings → Integrations, or remove it from your browser.

#People our members contact

To find and contact people, Larvabot processes information that is already public or that the member provides:

• Leads: the public page that was found, a summary of it, and contact details published on that page or its contact and about pages. If the member connects an email-finding service (such as Hunter, Prospeo or Tomba), that service may supply a business email address.
• Conversations: the link, title, a short excerpt and the public username of posts where someone asked for something a member's project does.
• Contacts: names, phone numbers, emails and notes the member imports about people they already know.
• Telegram groups: if a member connects their own Telegram account, recent messages in groups they have joined are read and only the relevant ones are kept.
• Threads: if a member connects their Threads account, Larvabot uses Meta's official Threads API to search public Threads posts for the member's keywords. From each relevant post it keeps the link, the text (up to 1,500 characters), the time and the public username, the same as other conversations. From the member's own Threads account it stores only an access token (encrypted), the Threads user ID and the username. It asks only for read permissions (threads_basic, threads_keyword_search), and it never posts, replies, likes or follows. Disconnecting in Settings → Communities, or removing Larvabot in your Threads settings, deletes the stored login right away.
• Emails: messages the member approves and sends, and replies or bounces that arrive in the inbox they connect.

Every outreach email includes a one-line opt-out and a List-Unsubscribe header, and a reply stops all follow-ups. If you were contacted by a Larvabot member and want your details removed, reply to their email or write to [email protected] and we'll help.

#Visitors to our members' websites

Members can add a small tracking script to their own site to see which outreach brought visitors. It records the page, the referring site, any ref or utm tags, a country and the time. It sets no cookies, stores no IP addresses and doesn't follow anyone between visits or sites.

#Why we use it (legal bases)

We don't sell personal data, and we don't use members' data or their contacts' data for advertising.

#Who processes data for us

We use a small number of providers to run Larvabot:

Services members connect themselves. Larvabot works with the member's own accounts at AI, search, email and community services (for example Google Gemini, Groq, Tavily, Brevo or Gmail). When Larvabot uses them, the content needed for the task (a page to read, a draft to write, a search query, an email to send) is sent to that service under the member's own account and that service's terms and privacy policy.

Apps and AI assistants members connect. A member can send their own leads and conversations to other tools: through the Zapier, Make or n8n apps, CSV downloads, Larvabot's read-only API, or AI assistants such as Claude and ChatGPT connected over the Model Context Protocol (MCP). This only happens when the member creates an API key or approves a connection, and those tools can only read the member's own projects, leads, conversations and drafts; they can't change anything or see API keys, billing or passwords. What a tool or assistant does with that data is governed by its own terms and privacy policy. We store only fingerprints (hashes) of API keys and connection tokens, never the keys themselves, and a member can revoke any key or disconnect any app under Settings → Integrations at any time.

Some providers are based outside your country, including in the United States. Where the law requires it, we rely on appropriate safeguards such as standard contractual clauses.

#How long we keep it

• Account and project data: while your account is open. When an account is deleted, its projects, leads, emails, contacts and keys are deleted with it.
• Job logs and usage counts: as long as they're useful for running the service, and deleted with the account.
• Threads login: until the member disconnects it, removes Larvabot in their Threads settings, or the account is deleted. Meta's data deletion requests are handled at once.
• API keys and app connections: until you revoke them, a sign-in connection's refresh token expires (60 days without use), or the account is deleted.
• Waitlist entries: until you're invited or ask us to remove you.
• Analytics: according to our Google Analytics retention setting.
• Backups and logs held by our providers roll over on their own schedules.

#Security

Connections are encrypted, secrets are encrypted at rest with a key kept separately from the database, passwords are hashed with a unique salt, and every page and action checks that you can only see your own data. No system is perfectly secure, but we work to keep yours safe and will tell affected people promptly if something goes wrong.

#Your rights

Depending on where you live, you may have the right to access, correct, delete or export your personal data, to object to or restrict some processing, and to withdraw consent at any time. Write to [email protected] and we'll respond within the time the law allows. If you're not happy with our answer, you can complain to your local data protection authority.

If your data is in a member's project (for example as a lead or contact), we'll pass your request to that member and help them handle it.

#Children

Larvabot is not meant for anyone under 16, and we don't knowingly collect their data.

#Changes

If we change this policy in a meaningful way, we'll update the date at the top and, for members, let you know by email or in the dashboard before the change takes effect.