Privacy Policy

LOWKI OS is run by SecurityMindset B.V., The Netherlands ("we", "us"). We decide why and how the account data described below is handled, which makes us the controller under data-protection law (including the GDPR).

You can reach us at support@lowkios.com about anything on this page.

The desktop app runs on your PC. Our servers only exist for your account and billing. They hold:

• Account: your email address and the time you signed up. That is all. We keep no password and no name: you sign in with a one-time link or code sent to your email, or with Google or Microsoft (which only tell us that the address is yours).
• Plan: which plan you have and your payment provider's customer reference. We do not store card numbers.
• Linked PCs: for each PC you link, the name it reported, a hashed device token (not the token itself) and when it last checked in.
• Licence checks: each time the app checks your plan it sends its device token, a one-way hash that identifies that installation (made from the Windows machine ID and user, never readable back into either) and the app version. Our server answers with a signed licence that is valid for a limited time. We do not receive anything about what you do in the app.
• Sign-in times: that you were signed in, and when (at most once per half hour), so we can count how many people use the site. Detailed records are deleted after three months; only daily totals are kept.
• Payments: the plan, amount and date of each payment we received, for our sales figures. The payment provider keeps the official record.
• Cart: the plan you put in your cart, so it follows you between devices.
• One-time link codes: stored only as a hash and deleted after they expire.
• Technical logs: like any web server, ours records the IP address, time, page and browser type of each request, used for security and to stop abuse.

Your conversations, voice recordings, screen contents, webcam images, files, messages sent on your behalf and the memory LOWKI OS builds about you never reach our servers. The app has no analytics, telemetry or crash reporting that sends anything to us.

Settings, conversation history, memory, logs, recorded macros and downloaded speech models are stored in your user profile under AppData\Local\Lowki. Your API keys are encrypted with Windows' built-in data protection and are readable only by your Windows account. Speech recognition (turning your voice into text) and the wake-word check run on your PC.

Uninstalling the app leaves this folder in place so you don't lose your data by accident. You can delete it yourself at any time.

LOWKI OS talks to some services directly from your PC, without going through us. What is sent depends on what you ask it to do:

• AI providers: Google Gemini is required; Anthropic Claude and OpenAI can be added on plans that include them. Your request text is sent with your own API key, along with a screenshot, webcam frame, file or tool result when your request needs one. The provider's terms and privacy policy apply to that data. On unpaid or free-tier keys, a provider may be allowed to use content to improve its products, so check the provider's terms if that matters to you.
• Cloud voices: if you choose a cloud text-to-speech voice, the text to be spoken is sent to that voice service. The on-device voice sends nothing.
• Web features: searching the web, weather, news and opening links contact those sites from your PC in the normal way.
• Our server: a version check (is a newer LOWKI OS available?) and, once you link a PC, a periodic check of which plan your account has. These use your IP address and, for the plan check, your device token. The plan check only happens once you link a PC, and the version check can be switched off in the app's configuration.

LOWKI OS does not send your data or your AI usage through our servers. Requests go from your PC straight to the AI provider (Google Gemini, Anthropic Claude or OpenAI) using an API key that you paste into the app yourself. We never see your prompts, replies, screenshots, audio or your API key.

When you use your own API key, you have your own agreement with that provider and you decide what is sent to it. For that data you act as the data controller. We are not a party to that relationship, we do not receive the data, and we cannot access, correct or delete what the provider holds. If you use LOWKI OS with other people's personal data (for example messages, or people visible on your screen), you are responsible for having a lawful basis to do so.

Warning about free-tier keys: providers such as Google and Anthropic may log the requests made with a free or unpaid key, may let their staff read them (human review), and may use them to improve or train their products. Paid keys are often treated differently, but the rules differ per provider and can change. You are entirely responsible for reading and accepting the provider's terms and privacy policy before you use a key, and for not sending anything through a key that you are not willing to share on those terms.

To the extent the law allows, we are not responsible for how a provider stores, reviews, trains on or protects the data you send it, including any breach at the provider.

• Sign-in cookies: when you sign in, our authentication provider sets the cookies needed to keep you signed in. They are strictly necessary and are removed when you sign out.
• Local storage: your cart is remembered in your browser so it is still there when you come back.
• Bot protection: signup and login may use Cloudflare Turnstile, which checks that a visitor is not a script and may process your IP address and browser details for that purpose.
• No analytics or advertising cookies: the site sets no tracking or analytics cookies and loads no analytics service, so there is no cookie banner to accept.

• To provide the service you signed up for and to take payment (performance of a contract).
• To keep the service secure, prevent abuse and fix faults (our legitimate interest).
• To keep the accounting and tax records we are required to keep (legal obligation).

We do not sell your data, do not show ads and do not build advertising profiles.

We use a small number of service providers (processors) to run the service. Each only receives what it needs:

• Supabase: database and sign-in for your account, hosted in the EU.
• Stripe: payments and invoices. Stripe is also responsible for its own handling of your payment details.
• Vultr: the virtual server that hosts this website.
• Our email delivery provider: sends account emails such as the confirmation message.
• Cloudflare: domain name (DNS) and, when enabled, the Turnstile bot check.

Some of these providers may process data outside the EU/EEA. Where they do, they rely on safeguards such as the EU Standard Contractual Clauses.

• Account data: for as long as your account exists. Press Delete account on your Account page and it is removed at once, together with your linked PCs and cart; any subscription is cancelled first.
• Payment records: for as long as tax and accounting law require us to keep them.
• Server logs: only as long as needed for security and abuse prevention.
• Link codes: minutes; they are removed after they expire.

If data-protection law applies to you, you can ask us to give you a copy of your data, correct it, delete it, restrict or object to how we use it, or move it to another service. You can remove any linked PC yourself from your Account page.

To use a right, email support@lowkios.com from the address on your account. We reply within one month. You can also complain to your local data-protection authority.

Connections to this website use HTTPS. Link codes and device tokens are only stored as hashes. Database access is restricted so that an account can only read its own rows. Actions LOWKI OS takes on your PC go through permission checks you control. No system is perfectly secure; if we ever learn of a breach affecting your data we will tell you and the authorities as the law requires.

LOWKI OS is not meant for anyone under 16. If you think a child has created an account, contact us and we will delete it.

When what we collect or who we share it with changes, we update this page and the date at the top, and we tell signed-in customers by email if the change is significant.