Privacy policy

Privacy policy

Last updated 29 May 2026

The short version: Lab is built by one person who does not want your data. The app runs on your machine and does not phone home. This website does not track you. The only personal data we ever touch is the Patreon identity you choose to connect, used solely to confirm you're an active supporter so the app can update itself.

Who runs this

Lab and lab.decoupled.cam are operated by an individual developer publishing under the itsloopyo handle. Contact: Bluesky @itsloopyo, or legal@decoupled.cam.

What the Lab desktop app collects

Nothing about you, personally, is sent to us. The app runs entirely on your machine. On your machine it reads and writes:

• Your local filesystem: the project directories you point it at, and its own settings file.
• Your local git repositories and the GitHub remotes you configure, accessed over HTTPS using a personal access token you supply. That token is stored in your operating system's keychain and sent only to GitHub.
• The coding-agent command-line tools you have installed (for example Claude Code or Codex), which Lab launches in local terminal sessions on your behalf.

Lab sends no analytics, telemetry, crash reports, or usage metrics to any server operated by us.

The coding agents Lab runs

Lab is a workbench that launches AI coding agents you have installed; it does not host or proxy them. When you run an agent through Lab, your prompts, code, and files are sent by that agent to its own provider (for example Anthropic or OpenAI) under that provider's terms and privacy policy, using credentials you configured with them. That data path is between you and the provider you chose; Lab neither stores nor forwards it to us.

What this website collects

This site is a plain static page hosted on GitHub Pages. No analytics, no advertising, no A/B testing, no behavioural tracking.

Your browser exchanges standard request metadata (IP address, user-agent, requested URL) with the hosting and delivery providers in order to serve the page and any gated download. Those logs are managed by the providers; see GitHub's privacy statement and Cloudflare's privacy policy.

Cookies

None. The site sets no cookies and uses no persistent local storage. The supporter download flow holds your Patreon access token only in the memory of the open browser tab, and only for as long as that tab is open.

The Patreon integration and updates

Access to Lab and its automatic updates is for active Patreon supporters. To make that work, the app (or this site's download page) asks you to sign in with Patreon. The authorization code from that sign-in is exchanged for an access token by a small Cloudflare Worker we operate, which holds the OAuth client secret. That worker, and the app, query Patreon's API for one thing: whether you are an active patron of the Lab campaign, and at what tier. Your email, payment details, and anything else Patreon holds are not requested and not stored by us.

The resulting tokens are stored in your operating system's keychain on your own machine. A token-free summary (your display name and supporter tier) is cached locally so the app can show your status. Software downloads and updates are served from Cloudflare R2 through that same worker, which checks your supporter status before issuing a short-lived, single-use download link.

The lawful basis under UK GDPR for processing your Patreon identifier and supporter status is your consent, given when you connect your Patreon account. You may withdraw consent at any time by disconnecting the account in Lab's settings; this deletes the locally stored tokens and ends the eligibility check.

Third parties we touch

• GitHub. Source hosting, releases, and static site hosting.
• Cloudflare. The OAuth worker and the R2 bucket that stores signed app builds for supporter downloads.
• Patreon. Supporter sign-in and status, only if you choose to connect it.
• Google Fonts. Typefaces loaded from fonts.googleapis.com; Google receives standard request data when your browser fetches the font files.
• Your chosen AI providers (e.g. Anthropic, OpenAI). Reached directly by the agents you run, under their own terms, not by us.

No data is shared with any of these parties beyond the technical minimum required to deliver the page, the download, or the supporter check.

Your rights

Under UK GDPR you have the right to request access to, correction of, or deletion of personal data we hold about you, to object to or restrict its processing, and to data portability where it applies. Because we keep no user database, there is usually nothing to act on; the only identifier we touch (your Patreon supporter status) is read live and not retained on our servers. If you have messaged us and want that correspondence purged, contact us and it will be done.

You also have the right to lodge a complaint with the UK Information Commissioner's Office (ICO) at ico.org.uk if you believe your data has been mishandled.

Children

Lab is a developer tool not directed at children under 13, and we do not knowingly collect information from them. If you believe a child has sent us information, contact us and it will be deleted.

Changes

If this policy ever changes in a way that meaningfully affects what we collect or how we use it, the "last updated" date above will move and the change will be noted in the project's release notes.

Contact

Questions, concerns, or requests (including UK GDPR data requests): email legal@decoupled.cam, or DM @itsloopyo on Bluesky.