Privacy Policy

Last updated: October 28, 2026

This Privacy Policy explains what personal information the operator of LazySiren ("LazySiren", "we", "us") collects, why, and what rights you have. The person in charge of the protection of personal information (privacy officer) can be reached at [email protected]. This address is temporary and will be updated to a Palier Labs domain after incorporation.

1. What we collect, and why

Account data: email address, display name, a salted hash of your password (never the password itself), and a hash of your account recovery code — to create and secure your account, sign you in, and enable recovery.
Sync data: if you enable account sync, the files and settings you choose to synchronize.
Connector tokens: if you connect external services (Gmail, Calendar, GitHub, and others), encrypted copies of the access tokens, used only to act on your behalf within the permissions you grant. Revocable at any time.
AI usage: prompts sent to LazySiren Cloud are processed to answer you; per-week token counters are kept for quota enforcement. Counters are totals, not conversation contents.
Payments: Stripe processes subscriptions; we receive plan status and subscription identifiers and never see or store your full card number.
Technical data: Cloudflare processes IP addresses and request logs as needed to deliver and protect the Service.

2. What we never do

We do not use your files, messages, prompts, or activity to train any AI model.
We do not sell, rent, or trade personal information.
We run no advertising trackers, no third-party analytics, and no session-replay tools. We do not record your keystrokes, mouse movements, clicks, or screen for analytics or advertising.
We send no marketing email. Account emails are transactional only.

3. Cookies and local storage

LazySiren stores data on your own device only where necessary for the Service to function: sign-in state, settings and preferences, and your local files. Nothing is stored for advertising or cross-site tracking, and no third-party tracking cookies are set.

4. Who processes data for us

Cloudflare (hosting and delivery), Stripe (payments), Brevo and Resend (account email delivery), and Google and X (only if you sign in with them), strictly to operate the Service and under their own terms and privacy policies. Because these providers operate internationally, your information may be processed outside your province or country, where it may be subject to the laws of that jurisdiction.

5. Retention and deletion

We keep personal information only as long as your account exists or as needed to operate the Service. Delete your account at any time in Settings: the data we control — account record, synced files and settings, connector tokens, and usage counters — is permanently erased, and we instruct our processors to delete your data. Copies already held by third parties (such as OAuth providers or infrastructure logs) remain subject to their own policies.

6. Your rights

Depending on where you live — including under Quebec's Law 25 and Canada's PIPEDA, the EU and UK GDPR, and California's CCPA/CPRA — you may have the right to access, correct, export, or delete your personal information, to withdraw consent, and to complain to your privacy regulator. Contact the privacy officer at [email protected]; we respond within the time your law requires.

7. Security and incidents

Passwords and recovery codes are stored only as salted hashes, connector tokens are stored encrypted, and traffic is encrypted in transit. If a privacy incident involving your information occurs, we will notify you and the relevant authorities as applicable law requires.

8. Children

LazySiren is not directed to children, and accounts are for people 18 or older. If we learn that a person under 18 created an account, we terminate the account and delete its data.

9. Changes

Material changes will be announced inside the Service before taking effect. The current version is always available on this page.