Lava Privacy Policy

Effective date: 12 July 2026

This Privacy Policy explains how Timur Darmaev, an individual operating Lava (“Lava,” “we,” “us,” or “our”), collects, uses, shares, and protects personal data when you join the Lava closed beta, use the Lava website, or use the Lava plugin and related services (collectively, the “Service”).

Lava is an independent third-party plugin for Obsidian. Lava is not affiliated with, endorsed by, or sponsored by Dynalist Inc. or Obsidian.

Who is responsible for your data

The controller of personal data processed through the Service is:

• Operator: Timur Darmaev
• Privacy and support contact: Lava contact form

Data we process

Beta waitlist and account data

We may process:

• The email address you provide to join the closed-beta waitlist.
• Your email address, account identifier, authentication records, and related security metadata when you create or use a Lava account.
• Communications you send to us, including support requests and feedback.

Supabase provides Lava’s authentication and account database. Resend delivers waitlist, invitation, sign-up, sign-in, and other service emails.

Notes, prompts, and AI responses

Lava can access notes in your Obsidian vault because this access is necessary for features such as adding a referenced note to an AI request. Lava processes note content only when you select, reference, or otherwise instruct Lava to use it, or when a feature you activate clearly requires that content.

The text you submit, the note content you specifically select or reference, and the generated response are transmitted through Lava’s backend and OpenRouter to a selected model provider so the provider can generate a response. Lava does not store the contents of your notes, prompts, or AI responses in its databases, application logs, backups, or error-monitoring tools. This content is processed transiently to generate and return the requested response and is not persisted by Lava.

Lava is configured to:

• enforce OpenRouter’s Zero Data Retention setting at the account level and on each AI inference request;
• route inference requests only to model endpoints that OpenRouter identifies as having a zero-data-retention policy and not using request content to train AI models; and
• keep OpenRouter’s optional prompt and response logging disabled.

OpenRouter may retain request metadata such as timestamps, model selection, token counts, and latency without retaining prompt or response content. OpenRouter explains these controls in its data collection documentation and Zero Data Retention documentation.

These controls apply to AI inference requests. If Lava later enables additional AI tools or plugins governed by different data practices, we will disclose them before use. Configuration and routing controls reduce risk but cannot guarantee against every provider or software error.

Do not send information through Lava unless you have the right to process and disclose it. Avoid submitting highly sensitive data, secrets, passwords, private keys, regulated health information, or third-party confidential information unless you have determined that doing so is appropriate and lawful.

Technical and security data

When you use the Service, Lava and its infrastructure providers may automatically process limited technical data needed to operate and secure the Service, such as:

• IP address;
• request date and time;
• response status and error information;
• device, browser, or app information transmitted with a request;
• account identifier associated with an authenticated request; and
• model name, token counts, latency, and other usage metadata.

Lava does not use client-side telemetry or analytics in the Obsidian plugin during the closed beta. Lava does not use advertising cookies or third-party advertising trackers. The website and authentication system may use cookies or local storage that are strictly necessary for sign-in, security, and operation of the Service.

Why we use personal data

We use personal data to:

• manage the beta waitlist and send invitations;
• create, authenticate, secure, and administer accounts;
• provide AI responses and requested plugin features;
• enforce beta usage limits and prevent fraud, abuse, or security incidents;
• diagnose failures and maintain the Service;
• respond to support requests and feedback;
• comply with law and protect our rights and users; and
• send product or marketing communications only where permitted by law. You may unsubscribe from optional marketing messages at any time.

For users in the European Economic Area or United Kingdom, our legal bases are:

• Performance of a contract or steps requested before a contract: providing the beta, account, and AI features you request.
• Legitimate interests: securing, maintaining, improving, and protecting the Service, provided those interests are not overridden by your rights.
• Consent: optional marketing communications or any optional processing for which we specifically request consent. You may withdraw consent at any time.
• Legal obligation: complying with applicable law, lawful requests, and recordkeeping duties.

How we share data

We disclose personal data only as necessary to provide, secure, and administer the Service:

We may also disclose information:

• when required by law, court order, or lawful government request;
• to investigate fraud, abuse, security incidents, or violations of our Terms;
• to protect the rights, safety, and property of Lava, users, or others; or
• as part of a merger, financing, acquisition, reorganization, or sale of assets, subject to appropriate safeguards and notice where required.

We do not sell personal data. We do not share personal data for cross-context behavioral advertising.

International data transfers

Our providers and model providers may process personal data in jurisdictions other than the one where you live. Data-protection laws may differ between jurisdictions. Where applicable law requires it, we rely on appropriate transfer mechanisms, such as adequacy decisions, approved contractual clauses, or another lawful safeguard.

Because the available model provider may vary by model and routing availability, the location of processing may vary. Lava limits routing to endpoints that meet its zero-retention and no-training requirements.

Retention

We retain personal data only for as long as needed for the purposes described above:

• Waitlist data: until you receive an invitation, ask us to delete it, or the closed-beta waitlist ends, and no longer than 12 months after your last interaction with the waitlist.
• Account data: while your account is active and for up to 30 days after deletion, unless a longer period is required for security, dispute resolution, or legal compliance.
• Support communications: for up to 24 months after the matter is closed, unless a longer period is needed for a legal claim.
• Backend security and operational logs: for up to 30 days, unless needed longer to investigate a security incident, abuse, or legal obligation.
• Note, prompt, and AI-response content: Lava does not retain this content in its systems, including its databases, application logs, backups, or error-monitoring tools. It is processed transiently to return the requested response.

Service providers may retain limited information under their own agreements and legal obligations. We delete or anonymize information when the applicable retention period ends.

Your choices and rights

Depending on where you live, you may have the right to:

• request access to or a copy of your personal data;
• correct inaccurate personal data;
• request deletion of personal data;
• restrict or object to certain processing;
• receive certain data in a portable format;
• withdraw consent without affecting earlier lawful processing;
• opt out of optional marketing; and
• lodge a complaint with your local data-protection authority.

To exercise a right, use the Lava contact form. We may need to verify your identity. We will respond within the period required by applicable law.

California residents may also request information about the categories and specific pieces of personal information collected, request correction or deletion, and receive equal service when exercising applicable rights. Lava does not sell or share personal information for cross-context behavioral advertising.

If notes or prompts contain information classified as “sensitive personal information” under California law, Lava uses it only as reasonably necessary to provide the feature you requested and for other legally permitted purposes.

Security

We use reasonable technical and organizational safeguards designed to protect personal data, including encrypted network transport, authenticated requests, access controls, and data minimization. No service or transmission method is completely secure, and we cannot guarantee absolute security.

You are responsible for securing your device, Obsidian vault, Lava account, and email account. Notify us through the Lava contact form if you believe your Lava account or data has been compromised.

If we become aware of a security incident that poses a risk to personal data, we will notify affected users and any required regulator without undue delay and in accordance with applicable law.

Children

The Service is intended only for people aged 18 or older. We do not knowingly collect personal data from children. If you believe a child has provided personal data to Lava, use the Lava contact form so we can investigate and delete it where appropriate.

Third-party services

The Service may interact with third-party services, including Obsidian, OpenRouter, and model providers. Their own terms and privacy practices apply to their independent processing. Lava is not responsible for third-party products or services outside its control.

Changes to this policy

We may update this Privacy Policy as the Service develops or legal requirements change. We will post the updated version with a new effective date and provide additional notice of material changes where required. Your continued use after the effective date is subject to the updated policy.

Contact

Questions and privacy requests may be submitted through the Lava contact form.