Git LoraGit Lora

Privacy

Git Lora is local-first. Your project content stays under your control.

Privacy Policy

Effective date: 22 August 2026
Last updated: 22 August 2026
Operator: Git Lora ("we", "us", "our")
Website: https://gitlora.uz
Product: Git Lora Desktop ("the Application")

This Privacy Policy explains, in plain language, how Git Lora collects, uses, stores, transfers and protects information when you use the Git Lora Desktop application and the gitlora.uz website (together, the "Service"). It is designed to be accurate, complete and enforceable.

1. Who we are and how to reach us

Git Lora is the data controller responsible for your personal data in connection with the Service. If you have any question, request or complaint about this Policy or your personal data, contact us at privacy@gitlora.uz. We will respond without undue delay and in any case within the period required by applicable law.

2. The local-first principle

Git Lora is built local-first. By default, your project content — including Markdown files, source code, characters, story, memory contents, prompts and private files — is created, stored and processed on your own device. The gitlora.uz website does not store, receive or have access to your project content unless you explicitly start a feature that requires transmission, and even then only the minimum necessary data is sent.

3. Information we do NOT collect

We do not collect, transmit or process the following, regardless of whether you are logged in:

  • The text, code or media content of your projects;
  • Memory contents, prompts or AI completions;
  • Characters, storylines, worldbuilding material or notes;
  • Biometric data, genetic data, health data or other special categories of personal data;
  • Hardware serial numbers, MAC addresses, or invasive device fingerprints;
  • The contents of your file system beyond files you explicitly select.

4. Information we may collect

When you interact with the Service, we may collect the following categories of information, always with the legal basis and purpose described below:

  • Account data — email address and hashed password when you register or log in by email. We do not offer or store third-party social login identifiers.
  • Installation identifier — a random, revocable identifier generated locally on first run, used to know that an installation exists (not what it contains).
  • Technical metadata — application version, platform (Windows / macOS / Linux), architecture and language, collected to provide updates and compatibility.
  • Support and diagnostic data — only when you explicitly submit a support ticket and separately consent to sending a locally generated diagnostic bundle. Diagnostic bundles never include project content.
  • Business enquiry data — the contact details and message you voluntarily provide on the Business page.
  • Ideas and feedback — the content you voluntarily submit through the Ideas feature.
  • Aggregate usage statistics — only if you opt in, always anonymised and aggregated, never tied to your identity or your projects.

5. How we use your information

We use information only for the following purposes:

  1. To operate, maintain and secure the Service and the website;
  2. To provide software updates, release verification and version policy;
  3. To respond to support tickets and business enquiries;
  4. To analyse, in aggregate only, the stability and adoption of the Application;
  5. To comply with legal obligations and to prevent, detect and respond to fraud or abuse.

We do not use your data to train AI models, and we do not sell, rent or trade personal data to third parties.

6. Legal basis for processing (GDPR)

Where the General Data Protection Regulation (EU) 2016/679 applies, we process personal data on the following legal bases:

  • Consent — for telemetry, diagnostic data and optional registration, you give specific, informed and revocable consent;
  • Contract — to provide the updates and support you requested;
  • Legitimate interests — to secure the Service, prevent abuse and maintain compatibility, balanced against your rights;
  • Legal obligation — where we are required to retain or disclose data by law.

You may withdraw consent at any time without affecting the lawfulness of processing carried out before withdrawal.

7. Installation identifiers and tokens

The Application generates a random installation identifier locally. When registering with the website, the Application receives a short-lived, refreshable, revocable access token. Tokens are stored securely, are never embedded in front-end source, and can be revoked. Tokens identify that an installation exists — they do not reveal what your project contains.

8. Telemetry

Telemetry is opt-in where required by law. Where enabled, it is minimal, clearly explained, aggregated, and never includes project content. You can disable telemetry at any time in the Application settings; disabling telemetry does not affect core functionality.

9. Cookies and local storage

The gitlora.uz website uses local storage and strictly necessary cookies for language preference, session continuity and security. It does not use advertising or cross-site tracking cookies. Where any non-essential cookie or similar technology is used, it requires your prior consent.

10. AI providers

Git Lora is configurable. If you choose to use a cloud AI provider (such as ChatZ / GLM), that provider is an independent data controller for the prompts and content you send to it. We encourage you to review the provider's privacy policy. When you run a local model, prompts and content remain on your device.

11. Synchronisation

Synchronisation is optional and user-controlled (LAN, self-hosted or managed). If you enable sync, your data is transmitted only to the destination you configure and is governed by that destination's terms. The gitlora.uz website is not the default storage location for project content.

12. Business users

Business users are subject to the same principles set out here, plus any additional terms agreed in their commercial contract. Business contracts may add audit, retention and data-boundary commitments, but never authorise access to your project content.

13. Data retention

We retain personal data only as long as necessary for the purposes described here or as required by law. Installation identifiers are retained while the installation is active and can be deleted on request. Account data is retained while your account is active and deleted or anonymised after account closure, subject to legal retention obligations.

14. Data security

We implement appropriate technical and organisational measures: TLS-only transport, HSTS, secure cookies, CSP, CSRF protection, an allowlisted CORS policy, input validation, output encoding, rate limiting, Argon2id password hashing, a secret manager, database backups, audit logs, short-lived tokens, refresh-token rotation and token revocation. No method of transmission or storage is fully secure, but we work to protect your data.

15. Your rights

Depending on your jurisdiction, you may have the right to:

  • Access the personal data we hold about you;
  • Rectify inaccurate data;
  • Erase your data ("right to be forgotten");
  • Restrict or object to processing;
  • Data portability;
  • Withdraw consent;
  • Lodge a complaint with a supervisory authority.

To exercise any right, contact privacy@gitlora.uz. We will verify your identity before acting.

16. Children's privacy

The Service is not directed to children under the age required by applicable law (13 in most jurisdictions, 16 in some EU member states). We do not knowingly collect personal data from children. If you believe a child has provided data, contact us and we will delete it.

17. International data transfers

Your data may be processed in countries other than your own. Where this involves a transfer outside your jurisdiction, we rely on appropriate safeguards such as Standard Contractual Clauses, adequacy decisions or your explicit consent, in accordance with applicable law.

18. Changes to this policy

We may update this Policy to reflect legal, technical or product changes. We will publish the updated version on gitlora.uz with a new effective date. Material changes will be highlighted. Continued use after the effective date constitutes acceptance, but consent-based processing remains revocable.

19. Offline operation

Git Lora Desktop continues to function locally even if gitlora.uz is unavailable. Offline use does not trigger any data transmission.

20. Contact

For privacy questions or requests: privacy@gitlora.uz.
For support: the Support page or in-app support panel.
For business enquiries: the Business page.

This Policy is provided in English as the authoritative version. Translations are provided for convenience; in case of conflict, the English version prevails.