Privacy Policy

Effective 14 October 2026

1. Who we are

Lore LLM is operated by Davide Berardi, an individual developer based in Italy, who is the data controller for the personal data described here. Contact: davide.bera2021@gmail.com.

This policy covers the hosted Lore LLM service (the server at the MCP and management API endpoints), the Lore LLM Desktop and Lore LLM Mobile apps, and this website. If you run your own instance of the server from the source code, the person running that instance is responsible for the data it holds.

2. What we collect

Account information

When you sign in with Google, we use Amazon Cognito to receive the information Google shares under the openid, email and profile scopes: your name, email address, Google account identifier and, if you have one, your profile picture. Cognito assigns you a user identifier that we use to keep your data separate from everyone else's. We never see your Google password.

Your content

The notes, folders and attachments (images and PDFs) that you or your agents create in the knowledge base, including file names and project names. We also store a generated index.md for each project.

Agent records

For each agent you connect: the name you give it, its type (for example Claude or Codex), the projects it may access, its access level (read-only or read-write) and when it was created. Agent tokens are shown to you once and are not stored by us.

Activity log

Each time an agent creates, updates or deletes a file we record the time, the agent, the action and the file path. This is what powers the activity feed in the apps. We also keep a per-account change counter so the apps know when to refresh.

Technical data

Like any web service, our infrastructure providers (Cloudflare and Amazon Web Services) process your IP address and request metadata to deliver requests, protect against abuse and keep short-lived operational logs. We don't build profiles from this data.

Data that stays on your device

• Desktop: your local knowledge-base folder and the app's activity history stay on your computer. Sign-in tokens are encrypted with your operating system's secure storage. Using the desktop app without signing in sends nothing to us.
• Mobile: sign-in tokens are kept in the device keychain, and preferences such as appearance and recent searches are stored on the device.

3. How we use it

• To provide the service: store and sync your knowledge base, let your agents read and write it, and show you their activity.
• To authenticate you and enforce the permissions you give each agent.
• To keep the service secure and working, and to investigate abuse.
• To answer you when you contact us.

We do not sell or rent personal data, use it for advertising, or use your content to train AI models.

4. AI agents you connect

When you create an agent token and add it to an AI tool, that tool can read and, if you allow it, change the files in the projects you selected. Everything the agent reads is sent to the company that runs that tool (for example Anthropic for Claude, or OpenAI for Codex) and is handled under that company's own terms and privacy policy, not this one. Only give agents access to projects you are comfortable sharing with their provider. You can narrow an agent's scope or revoke it at any time in the apps, and revocation takes effect immediately.

5. Legal bases (GDPR)

• Performance of a contract (Art. 6(1)(b)): account data, content, agent records and the activity log are needed to provide the service you signed up for.
• Legitimate interests (Art. 6(1)(f)): technical data used to secure the service and prevent abuse.
• Legal obligations (Art. 6(1)(c)): where we must keep or disclose data by law.

6. Who processes your data

Some of these providers may process data outside the European Economic Area. Where they do, the transfer relies on the EU–US Data Privacy Framework or the European Commission's Standard Contractual Clauses, as set out in each provider's data processing terms.

7. How long we keep it

• Account, content, agent records and activity log: for as long as your account exists. Files you delete are removed from storage straight away; there is no recycle bin on the server.
• Revoked agents: the agent's permission record is deleted when you revoke it. Entries it left in the activity log stay until your account is deleted.
• When you ask us to delete your account, we delete your account and all associated data within 30 days.
• Technical logs held by our providers are kept for the short periods described in their own policies.

8. Your rights

Under the GDPR you can ask to access, correct, delete or export your data, and to restrict or object to how we process it. Email davide.bera2021@gmail.com from the address on your account and we will reply within one month. Much of this you can also do yourself: the apps let you edit, export (copy or share) and delete your notes, and revoke agents.

If you think we have handled your data unlawfully, you can complain to the Italian data protection authority, the Garante per la protezione dei dati personali, or to the authority in the EU country where you live.

9. Security

All traffic is encrypted with TLS. Every stored file is keyed to the verified account it belongs to, so one account cannot reach another's data, and agents are limited to the projects and access level you set. Agent tokens expire (after 90 days by default) and are never stored on the server. No system is perfectly secure; if a breach affects your data we will notify you and the authorities as the law requires.

10. Children

Lore LLM is not intended for children under 14, and we do not knowingly collect their data. If you believe a child has given us personal data, contact us and we will delete it.

11. Changes

If we change this policy we will update the date at the top. For significant changes we will also tell you in the apps or by email before they take effect.

12. Contact

Davide Berardi, Italy · davide.bera2021@gmail.com