Privacy Policy

Laby — the label maker for tiny printers

Last updated: 27 August 2026 · Effective: 27 August 2026 Canonical URL: https://labykit.com/privacy

The short version

• Laby has no accounts. You never sign up, and we never ask for your name, email or phone number.
• Your labels live on your phone. Label documents, photos you place on them and drawings you make are stored in the app’s own storage on your device. They are not uploaded to us, and there is no cloud sync.
• We do not sell, rent or share your data with data brokers or advertisers, and Laby contains no advertising and no cross-app or cross-site tracking.
• Two things do leave your device: what you type into Ask Laby (the AI feature), and anonymous product analytics that count what happens in the app — never what your labels say.
• Everything below explains each of those precisely.

1. Who is responsible for your data

The controller under the EU General Data Protection Regulation (GDPR) is:

Fasky e.U. Albert-Schweitzer-Gasse 8 8020 Graz Austria

Email: hello@labykit.com

We are a small company and have not appointed a Data Protection Officer, as we are not required to under Art. 37 GDPR.

This policy covers the Laby mobile app for iOS and Android, and the website at labykit.com.

2. What Laby deliberately does not do

We think the clearest way to describe a privacy policy is to start with what is absent:

• No user accounts, no sign-in, no password, no email address collected.
• No advertising, no ad networks, no ad identifiers (Laby does not use Apple’s IDFA and does not present an App Tracking Transparency prompt, because it does not track you).
• No cross-app or cross-website tracking, and no sharing of data with third parties for their own marketing.
• No sale of personal data, and no sharing with data brokers.
• No cloud backup or sync of your labels. If you delete the app, the labels stored in it are gone with it.
• No access to your contacts, calendar, microphone, camera or precise location. Laby does not request these permissions at all.

3. Data that stays on your device

The following never leaves your phone unless a section further down says otherwise:

We have no server-side copy of any of this and no way to read it.

4. Ask Laby (the AI feature)

Ask Laby is the feature where you describe a label in your own words — “jam jar label for strawberry, 2026” — and the app lays one out for you. This is the only feature that sends content you authored off your device.

What is sent

When you tap Ask, the app sends the following to our own server (api.labykit.com, a Cloudflare Worker), which forwards the relevant parts to an AI provider:

• The text you typed into the ask field.
• The label’s physical size — width and height in millimetres, and the printer resolution.
• When you ask Laby to edit a label that already has content: the text content of the existing text and barcode elements, plus their positions, so the model can change one thing without destroying the rest.
• An anonymous customer identifier from RevenueCat (see §5) so the ask can be counted against your monthly allowance, plus a randomly generated request ID.

What is never sent

• Photos and drawings are never sent. When you edit a label containing a photo or a freehand drawing, the model is told only the rectangle those elements occupy in millimetres — never the image itself. The app keeps them in place locally.
• No name, email address, phone number, contacts or location.
• No printer name or Bluetooth address.
• No previously asked prompts — every ask is stateless and standalone. There is no conversation history and no user profile.

Who processes it

Which model provider serves a given request is a server-side configuration and may change; the categories of data sent do not.

Note that your prompt text is sent to OpenAI’s moderation endpoint for a content check even when Google’s model produces the layout. This screening exists so that Laby refuses requests for content we will not help with; refused prompts do not cost you an ask.

Retention

• We do not log your prompt or your label content. Our server writes exactly one structured line per request containing the request ID, the anonymous customer ID, whether it was a new label or an edit, which model was used, the outcome, how long it took and token counts. These logs are retained for a short period for debugging and abuse prevention and are then discarded. If a prompt is refused, we log the category name returned by the moderation service — never the text.
• The AI providers retain API inputs and outputs for a limited period (typically up to 30 days) for abuse monitoring under their API terms, after which they are deleted. We use their API tiers on which submitted data is not used to train their models.
• Cloudflare, as our hosting provider, processes the network-level metadata needed to deliver the request, including your IP address. We do not store it or connect it to anything else.

Legal basis

Processing your prompt is necessary to perform the service you asked for — Art. 6(1)(b) GDPR (performance of a contract). The content screening rests on our legitimate interest in preventing misuse of the feature — Art. 6(1)(f) GDPR.

Please review what the AI produces

The layouts Ask Laby returns are generated automatically and can be wrong. Check every label before you print it, and never rely on generated text for anything that has to be correct by law — ingredients, allergens, dosages, hazard warnings, or regulated markings. See the Terms of Use.

5. Purchases and Laby Pro

Laby Pro is sold as an auto-renewing subscription through the Apple App Store and Google Play. We never see your payment details — Apple and Google process the payment and tell us only whether an entitlement is active.

We use RevenueCat, Inc. to manage subscription state and the monthly Ask Laby allowance. RevenueCat receives and stores:

• An anonymous app user ID generated on your device (in the form $RCAnonymousID:…). It is not linked to your name, email or store account, and Laby does not log you in.
• The purchase receipt from Apple or Google, the subscription’s status and renewal dates, and your country and platform as reported by the store.
• Your remaining ask balance for the month.

Legal basis: performance of a contract, Art. 6(1)(b) GDPR. RevenueCat acts as our processor under a data processing agreement, and their privacy policy is at https://www.revenuecat.com/privacy. Apple’s and Google’s own handling of your purchase is governed by their respective privacy policies, as the controllers of that payment relationship.

Restoring a purchase asks the store whether the current store account owns a subscription; it does not create an account with us.

6. Anonymous analytics and crash reports

Laby uses Aptabase (Aptabase, Lda.) for anonymous product analytics, on their EU-hosted instance, so this data does not leave the European Union. Aptabase is built to work without cookies, without persistent device identifiers and, per its documentation, without storing IP addresses — an approximate country is derived at ingest and the address discarded.

The entire analytics surface of the app is five events, and this is the complete list:

Alongside each event, the Aptabase SDK sends standard technical context: app version and build, operating system and version, device model, locale and a short-lived random session identifier.

Deliberately excluded, as a rule we hold ourselves to in code: the text on your labels, your prompts, your photos, file names, and the Bluetooth name or address of your printer (some printers advertise a name derived from their serial number, so those are treated as identifiers and never sent).

Crash reporting is enabled in the same SDK. When the app hits an unhandled error, it reports the error type, message and stack trace from Laby’s own code, plus the technical context above. A stack trace is machine data, but we cannot rule out that an error message occasionally contains a fragment of the value that caused it.

Legal basis: our legitimate interest in understanding which printers people actually use, where connection fails, and where the app crashes — Art. 6(1)(f) GDPR. You can object to this processing at any time by writing to hello@labykit.com.

7. Bluetooth and your printer

Laby connects to thermal label printers over Bluetooth Low Energy. That connection is direct, device-to-printer; nothing about it is routed through us.

• iOS asks for Bluetooth permission the first time you look for a printer.
• Android 12 and newer asks for the “Nearby devices” permission. Laby declares the Bluetooth scan permission with neverForLocation, which is Android’s formal declaration that we do not derive your location from Bluetooth scan results — and we do not.
• Android 11 and older required a location permission to scan for Bluetooth devices at all; that is a platform requirement of those versions, the permission is declared only up to that API level, and Laby does not request, use or store your location.

What we retain locally is your paired printer’s model and the identifier your OS uses to reconnect. “Forget printer” in Settings removes it.

8. Photos

If you add a photo to a label, iOS or Android shows its own picker and Laby receives only the images you pick. A copy is written into the app’s private storage so the label still renders after you edit or delete the original.

Photos are used purely to draw and print your label. They are never uploaded, never sent to the AI, and never included in analytics.

9. Support, feedback and reports

• Writing to us at hello@labykit.com — including via “Report AI content” in Settings, which pre-fills a subject line — means we process your email address and whatever you write, in order to answer you. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in providing support) or Art. 6(1)(b) where your message concerns your subscription. We keep support mail as long as needed to handle the matter and to meet Austrian retention duties.
• “Send feedback” opens an external feedback service in your browser (laby.fdback.io). What you submit there is handled by that provider under its own privacy policy.
• “Rate Laby” hands off to the App Store or Play Store; anything you write in a review is public and governed by Apple’s or Google’s terms.

10. International transfers

Some of the providers above (RevenueCat, OpenAI, Google, Cloudflare) are established in the United States or process data globally. Where personal data is transferred outside the European Economic Area, the transfer is covered by the European Commission’s Standard Contractual Clauses together with the supplementary measures set out in each provider’s data processing agreement. Our analytics provider is hosted inside the EU.

You may request a copy of the relevant transfer safeguards by writing to hello@labykit.com.

11. How long we keep things

12. Your rights

Under the GDPR you have the right to request access to your personal data (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20), and to object to processing based on legitimate interests (Art. 21). Where processing rests on consent, you may withdraw it at any time without affecting processing already carried out.

To exercise any of these, write to hello@labykit.com.

One honest caveat: because Laby has no accounts, we usually cannot identify you from the data we hold — anonymous analytics events and an anonymous RevenueCat ID cannot be traced back to a person. Under Art. 11 GDPR we are not required to acquire additional information just to identify you. If you can supply information that lets us locate a specific record (for example, the anonymous customer ID shown in the app, or the store transaction ID of your purchase), we will act on your request.

You also have the right to lodge a complaint with a supervisory authority. The competent authority for us is:

Österreichische Datenschutzbehörde Barichgasse 40–42, 1030 Vienna, Austria https://www.dsb.gv.at · dsb@dsb.gv.at

You may also complain to the authority in your own country of residence.

13. Children

Laby is a general-audience utility and is not directed to children. We do not knowingly collect personal data from children under 14 (the age of digital consent in Austria under §4(4) DSG). If you believe a child has provided us with personal data, contact hello@labykit.com and we will delete it.

14. Security

Labels are stored inside the app’s private, OS-sandboxed storage, which other apps cannot read. All network traffic — to our Ask Laby endpoint, to the stores and to RevenueCat — travels over TLS. API keys for the AI providers live only on our server and are never present in the app, which is why Ask Laby is routed through our own endpoint rather than calling a model provider directly from your phone.

No system is perfectly secure. If we ever become aware of a breach affecting your personal data, we will notify the Austrian Data Protection Authority within 72 hours and inform affected users where the GDPR requires it.

15. Changes to this policy

If we change how Laby handles data, we will update this page and change the “Last updated” date. Material changes will be announced in the app before they take effect. Continuing to use Laby after a change means the updated policy applies.

16. Contact

Fasky e.U., Albert-Schweitzer-Gasse 8, 8020 Graz, Austria hello@labykit.com

Appendix — App Store privacy label mapping

Provided for transparency; it reflects the same facts as above.