Privacy policy

Effective October 26, 2026. This page says what the site and the API really do with your data today. The terms of service are a separate page.

1. Who runs it, and how to ask about privacy

Logo Lava is run by B Klug. For anything about your data, write to privacy@logolava.com. I read it and reply myself.

In short: Logo Lava does not sell data, shows no ads and runs no analytics or tracking scripts. You can make logos without an account.

2. What is collected, and why

Logo requests

Every logo made through the API or the logo maker is recorded as one row: the time, your IP address, the API key if you sent one, the name or text, the settings, the seed, the format and size, whether the image came from the cache, how long it took, the page the request came from (the referrer) and your browser's user agent. This is how the limits work, how abuse is found and how I see what the API is used for. Images that Cloudflare answers from its own cache may never reach our server, so they leave no row.

Version 1 of the API (the older one at /v1/, online since 2019) keeps a similar record: time, API key, text, settings, seed, referrer, IP address and user agent.

Server logs

The web server writes an access log: your IP address, the time, the address requested, the response, the referrer and your user agent. It is used to fix errors and stop abuse.

Rate limits

The API counts requests per IP address (or per key) for the current minute and the current day, so one caller cannot use up the service. These counters live in the server's memory and are cleared each day or when the service restarts. The sign-up and contact forms keep a short count per network address, in a small file, for the same reason.

API-key accounts

If you sign up for a key, I store your email address, the name you enter, your password (only as a one-way hash, never in plain text), the IP address and time of the sign-up, your API key and whether you confirmed your email. Your account page shows your key and a list of your recent requests.

AI briefs

When you ask for an AI logo, the name you typed (up to 80 characters), any hint, domain, tones, industry or colours you gave are sent to Anthropic, which runs the Claude model that writes the design brief. Your IP address and API key are not sent to Anthropic. The brief that comes back is stored with the name, so the same name never needs a second call and its logos stay the same. A separate record keeps the time, the name, your IP address and key (if any), and the size and cost of the call.

Logo images

Finished images are kept in a cache on the server, and by Cloudflare, so the same logo is not drawn twice. An image shows the name it was made for. The cache is not tied to your IP address or your key.

The contact form, and email

If you write through the contact form, the name you give (optional), your email address and your message are emailed to me through Mailgun. The email also carries your IP address, user agent and the page you came from, so that I can spot spam. I use your address only to reply. I do not keep the messages anywhere except my own mailbox. If you write to support@logolava.com or privacy@logolava.com, the message goes to my mailbox the same way.

The only other email Logo Lava sends is the confirmation link when you sign up and the link when you reset a password. Both go through Mailgun.

3. Who else receives data

• Tornado VPS (formerly Prgmr) hosts the server that runs Logo Lava. All the data above lives on it.
• Cloudflare sits in front of logolava.com and api.logolava.com. It sees every request, caches images and pages, and blocks abuse. On the sign-up page it also runs Turnstile, a check that you are not a bot; Turnstile may set its own cookie or storage and sends your IP address to Cloudflare.
• Mailgun delivers the contact form message, the sign-up confirmation and the password-reset email. It receives the address and the message.
• Anthropic receives the name and hints for an AI brief, as section 2 describes. Its own policy is at anthropic.com/legal/privacy.
• Stripe, if you buy a paid plan: Stripe processes the payment and receives your card details, email and billing country; we receive a record of the payment, not your card number. Nothing is for sale today.
• NameFew (namefew.com) is another site run by B Klug. It asks Logo Lava for logos and AI briefs for the names it shows, using a key called "namefew". Those requests are recorded like any other. What NameFew itself keeps is covered by its own policy.

Beyond these, I share personal information only when the law requires it.

4. How long things are kept

• Logo request records (version 2 and version 1) and the AI usage records: 12 months, then deleted.
• Web server access logs: 14 days.
• Rate-limit counters: no longer than a day.
• API-key accounts: until you ask for deletion.
• AI briefs: kept, with the name they were made for, so existing logos do not change. A brief holds design choices, not your IP address or key. If a name you typed is personal, write to me and I will remove its brief.
• Cached images: at most a year at Cloudflare, and on the server until the cache is full and old files are dropped.
• Contact messages: in my mailbox as long as needed to answer you.
• Backups: nightly copies of the database are kept for about a week, and an occasional full copy of the server is kept longer on my own storage. They hold the same data as above and are not shared.

5. Your choices

You can ask to see, correct or delete the data I hold about you by writing to privacy@logolava.com. There is no delete button yet, so deleting an account is done by email: write from the address on the account, and I will delete the account, its key and the request records tied to that key, and confirm by reply, within 30 days. To have request records that are tied only to an IP address removed, tell me the address and roughly when. You can change your password at any time from the reset page.

You can use the logo maker and the API without an account. If you block cookies, everything still works except staying signed in.

6. Cookies and local storage

• PHPSESSID (cookie): keeps you signed in while you use the sign-up, log-in, password-reset and account pages. It ends when you close the browser.
• ll_rm (cookie, 180 days): set only if you tick "Remember me" when you log in. It holds your account number, an expiry time and a signature, never your password. Logging out or changing your password clears it.
• logolava-theme (local storage): your light or dark choice, kept until you clear it.
• ll-name (session storage): the name you last typed in the logo maker, so it is still there when you move between pages. It ends when you close the tab.
• Cloudflare Turnstile: on the sign-up page only, and set by Cloudflare, not by Logo Lava.

There are no advertising or analytics cookies.

7. Children

Logo Lava is not meant for children under 13, and we do not knowingly collect their data.

8. No selling, no ads

I do not sell or rent personal data, and Logo Lava shows no ads.

9. Changes to this policy

If this policy changes in a way that matters, we will say so on the site. The effective date at the top shows when it last changed. The earlier policy, effective 1 June 2019, is replaced by this one.