Last updated 6 November 2026
Privacy Policy
What Obstat stores about you, why, and what it never does.
The short version
- The Obstat app has no tracking, analytics or ads. Your apps, files, logs and API keys stay on your computer.
- For a chat account we keep a scrambled (hashed) version of your email, not the address itself, plus your chat name and what you post.
- If you join the download waitlist, we keep your email so we can tell you when Obstat is out, and nothing else.
- obstat.app counts visits without cookies and without storing your IP address. There are no third-party trackers or ads.
- We never sell your data.
1. Who we are
Sweeney Creative Co., trading as SWE3WE ("we", "us"), runs Obstat and is the controller of the personal data described here. Contact: hello@swe3we.dev.
2. What stays on your computer
The Obstat desktop app keeps these on your computer only, and doesn't send them to us: the apps you install and their files, your settings, your logs, your sandbox tests, and any API keys you add (which are encrypted with Windows' own protection). Obstat doesn't include analytics, crash reporting, advertising or tracking code.
We can't see your API keys. A key you add in Obstat's Keys page is encrypted on your computer and only given to the apps you pick. A key you type into an app's own settings (Plazai's, for example) is kept by that app on your computer too. Either way, the app sends it straight from your computer to the AI service you chose, such as OpenAI, Anthropic or Google. It never passes through Obstat or obstat.app.
3. What we collect, and why
| What | Why | Legal basis | How long |
|---|---|---|---|
| Chat account: a salted hash of your email, your chat name, when you signed up, which version of the terms you agreed to, and hashed sign-in tokens | To let you sign in and post, and to stop banned people coming back (if you're banned, the hashed address is kept after your account is deleted) | Contract (providing the chat) | Until you delete your account; sign-ins end after 90 days |
| Sign-in email: your email address, for the moment we send the code | To send you a one-time code | Contract | Not stored by us after sending; the code itself expires in 10 minutes |
| Chat messages and reports: what you post, when, and which account posted or reported it | To show the chat, and to moderate it | Contract; legitimate interests (keeping the chat safe) | Until you or we delete them, or your account is deleted |
| Waitlist: your email address and the date you joined | To email you when Obstat can be downloaded | Consent (you can withdraw it at any time) | Until we've emailed you that Obstat is out (we then delete the list), or until you ask us to remove it |
| Abuse protection: a salted, one-way hash of your IP address, with a count of recent requests | Rate limits, and blocking spam and attacks | Legitimate interests (security) | Counters are deleted within about two hours; a ban record stays while the ban does |
| Security log: when someone signs in to the chat, enters a wrong or expired code, or tries a wrong admin password: the time, the page, and the same salted hash of the IP address used for abuse protection (never the address itself, and never your email or the code) | To spot and stop people guessing sign-in codes or trying to break into the admin page | Legitimate interests (security) | The hash is deleted after 30 days; the rest after 180 days |
| Error reports: what went wrong on our server, and on which page | To find and fix bugs | Legitimate interests | 180 days |
| App submissions and lookups: the GitHub link you submit or look up | To check and review the app, and show it on the list | Legitimate interests | While the app is listed or under review |
| Visit counts: the page you opened, the website that sent you (its domain only), your country, whether you're on a phone or a computer, and a code made by scrambling your IP address and browser with a random value we delete every day. Your IP address itself isn't stored, and the code can't link your visits on different days | To see how many people visit and which pages are useful, and to spot errors on the site | Legitimate interests | Up to 13 months |
| Emails you send us | To answer you | Legitimate interests | As long as needed to deal with your message |
Our hosting provider keeps standard server logs (such as IP address, time and page requested) for a short time for security and to keep the service running.
4. What's public
Your chat name and messages are public: anyone using Obstat can read them. Don't post personal information you don't want shared.
5. Who we share data with
We only share personal data with providers who run parts of Obstat for us, under contracts that protect it:
- Netlify hosts the website, the app list and the chat, and stores the data above.
- Resend sends sign-in codes and waitlist emails.
- Supabase stores the visit counts, the security log and error reports, in London.
- GitHub hosts the download and the apps' code. When Obstat looks up or downloads an app, GitHub sees the request.
Some of these providers are in the United States. Where data leaves the UK, it's protected by the UK's adequacy rules or standard contractual clauses. We may also share data if the law requires it, or to protect people from harm.
When you install or run a third-party app, that app and the sites it downloads from (for example, Hugging Face or PyPI) may collect data under their own privacy policies. They aren't run by us.
6. Cookies
obstat.app doesn't use cookies or third-party trackers. We count visits ourselves, without cookies or storing your IP address (see section 3). The admin page and the app may remember small settings on your own device (for example, which news you've already seen).
7. Children
Obstat isn't meant for children under 13, and they mustn't create an account. If you believe a child under 13 has given us personal data, email us and we'll delete it.
8. Security
Everything is sent over HTTPS. We store hashes instead of email addresses for accounts, sign-in tokens are stored only as hashes, and admin tools are locked behind a secret token. No system is perfectly secure; if a breach affects you, we'll tell you and the regulator when the law requires it.
9. Your rights
Under UK and EU data protection law you can ask to see, correct, delete, restrict or move your personal data, object to how we use it, and withdraw consent at any time. You can delete your chat account yourself in Settings. For anything else, email hello@swe3we.dev from the address in question. We'll reply within one month.
If you're unhappy with how we've handled your data, you can complain to the UK Information Commissioner's Office at ico.org.uk, or to the data protection authority where you live.
10. Changes
If we change this policy, we'll update the date at the top. If the change matters, we'll tell you in the app.