Privacy Policy for Lotse
Effective date: 2026-11-02 (replaces the earlier "Jules Console" privacy policy)
This policy explains what data the Lotse app ("the app", formerly "Jules Console") and its servers process, why, and what rights you have. Lotse is an app for iOS and Android that runs coding tasks on your GitHub repositories and opens pull requests.
1. Who is responsible
Mahbob Alhoussen (sole proprietor)
E-mail: tigermm609@gmail.com · Website: mahbob.de · Address: see the Impressum
I am the controller under the GDPR. I have not appointed a data protection officer; none is required for a business of this size. Write to the address above for any privacy question.
2. What we process, why, and on what legal basis
| Data | Purpose | Legal basis (GDPR) |
|---|---|---|
| Account: sign-in method (Google, Apple, e-mail and password), e-mail address, Firebase user ID. A guest account (anonymous user ID) is created when you open the app. | Create and secure your account, link purchases and quotas to you | Art. 6(1)(b), performing the contract (providing the app) |
| GitHub connection: GitHub user ID, account name, the ID of your installation of the GitHub App "Lotse Agent", the time you connected | Let Lotse read your selected repositories and open pull requests | Art. 6(1)(b) |
| Tasks: repository name, your task description (prompt), status, branch and pull request link, test result, error message, token and cost counters, timestamps, and a live log of progress messages | Run the task, show you progress and results, enforce usage limits, support you when something fails | Art. 6(1)(b); limits and abuse protection Art. 6(1)(f) |
| Repository contents: the files of the repository you select, read through a short-lived GitHub token limited to that one repository | Let the AI work on your code | Art. 6(1)(b) and your consent in the in-app dialog before your first task (Art. 6(1)(a)) |
| AI prompt improver (optional): the text you submit | Improve a task description with an AI model (Google Vertex AI). Only a usage counter is stored, not the text. | Art. 6(1)(b) |
| Subscription: purchase status, plan, expiry and the receipt or token needed to verify it. We never see your card or payment details. | Unlock Lotse Pro, restore purchases | Art. 6(1)(b); keeping records Art. 6(1)(c) |
| Push notifications: a device token (Firebase Cloud Messaging) if you allow notifications | Tell you that a task has finished | Art. 6(1)(b) and the permission you give on your device |
| Usage analytics and crash reports: app events, screens, device model, OS version, app version, approximate location derived from the IP address, crash traces (Google Analytics for Firebase, Crashlytics) | Understand which features are used, find and fix bugs | Art. 6(1)(f), my interest in a stable, improving app. You can object (section 8). |
| Advertising (free version only): advertising ID and device data processed by Google AdMob, after the consent form (Google UMP) shown where required | Show ads that pay for the free version. Pro removes ads. | Art. 6(1)(a), your consent in the consent form, which you can change at any time |
| Remote configuration: app version and a random installation ID (Firebase Remote Config) | Switch features on or off, keep the app working | Art. 6(1)(f) |
| Community: if you post a feature request or vote, your content and user ID | Run the feature request board | Art. 6(1)(b) |
| Support e-mails: whatever you send me | Answer you | Art. 6(1)(b) or (f) |
You are not obliged to give any of this data, but without an account and the GitHub connection Lotse cannot run tasks.
3. Your code and task description go to AI providers
This is the most important part of this policy. When you start a task:
- The task runs on Google Cloud (Cloud Run, region us-central1, USA). The repository is copied into a temporary container, which is deleted when the task ends.
- The task description and the parts of the repository the AI needs are sent to AI model providers through OpenRouter (openrouter.ai, USA), which routes the request to a model provider. This data may include source code, comments and any secrets or personal data that happen to be in files of the repository. Do not use Lotse on repositories you may not share with such providers, and do not keep secrets in the files of the repository.
- Each task gets its own OpenRouter key with a spending limit and an expiry time. The key expires after the task.
- The result is a branch and a pull request on your GitHub repository, written through the GitHub App.
The app asks for your consent in a dialog before your first task. If you do not agree, do not start a task; nothing is sent. OpenRouter and the model providers process the data under their own terms and privacy policies (for OpenRouter: https://openrouter.ai/privacy).
4. GitHub
You connect GitHub through the GitHub App "Lotse Agent". It can only access the repositories you select when you install it, and you can change or remove that selection at any time on GitHub (Settings, Applications, Installed GitHub Apps, Lotse Agent). Removing the app on GitHub is the only way to take back that access: deleting your Lotse account does not remove the app from GitHub, so please do both. Pull requests and branches already created stay in your repository. GitHub processes data under its own privacy statement (https://docs.github.com/en/site-policy/privacy-policies/github-general-privacy-statement).
5. Who receives data (processors and other recipients)
| Recipient | What for | Location |
|---|---|---|
| Google Ireland Ltd. / Google LLC (Firebase Authentication, Cloud Firestore, Cloud Functions, Cloud Run, Cloud Tasks, Cloud Messaging, Remote Config, Analytics, Crashlytics, Vertex AI) | Hosting, accounts, database, running tasks, notifications, analytics, crash reports, prompt improver | EU and USA. Task execution: us-central1 (USA). Database region: us-central1 (USA) |
| OpenRouter, Inc. and the AI model providers it uses | AI processing of your task (section 3) | USA, possibly other countries |
| GitHub, Inc. (Microsoft) | Repository access, pull requests | USA |
| Google (AdMob) | Ads in the free version | EU and USA |
| Apple / Google Play | Sign-in with Apple or Google, purchases and subscriptions | EU and USA |
I have data processing agreements with the processors where the law requires them. I do not sell your data and I do not use your code to train models myself.
6. Transfers outside the EU/EEA
Several recipients are in the USA. Where possible, transfers rely on the EU-US Data Privacy Framework (Google, GitHub and Apple are certified), otherwise on the EU Standard Contractual Clauses (Art. 46 GDPR). Task execution takes place in the USA by design. A copy of the safeguards is available on request.
7. How long we keep data
| Data | Retention |
|---|---|
| Account, GitHub connection, task records (description, status, PR link, counters) | Until you delete your account |
| Live log events of a task | Deleted automatically 30 days after they were written (at most 500 events per task are stored) |
| Repository copy in the task container | Deleted when the task ends |
| Per-task OpenRouter key | Expires after the task, at the latest shortly after the task deadline |
| Usage counters and subscription status | Until you delete your account. Purchase records that tax law requires me to keep are retained for up to 10 years |
| Analytics and crash data | As set in Google's tools, currently up to 14 months |
| Legacy Jules API keys (section 9) | Server copies are deleted in November 2026. Keys on your device stay there until you remove them or uninstall the app |
| Support e-mails | Until the matter is solved, then up to 3 years |
Deleting your account: in the app, Settings, Delete account. This deletes your account and the data stored for it in our database (profile, tasks, templates, notification settings). It does not remove the GitHub App from GitHub (section 4) and does not cancel a subscription: cancel that in the subscription settings of Google Play or the App Store. Backups are overwritten within a short period.
8. Your rights
You have the right to access (Art. 15), correction (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20), and to object to processing based on legitimate interests (Art. 21), for example analytics. Where processing rests on consent, you can withdraw it at any time with effect for the future (Art. 7(3)): ad consent in the consent form, AI consent by not starting tasks, notifications in your device settings. Write to tigermm609@gmail.com. I will answer within one month.
9. Jules (legacy)
Before Lotse, this app was a client for Google's Jules service.
- Your Jules API key was stored on your device (secure storage: Keychain or Keystore). If you turned on Jules notifications or chains, an encrypted copy (AES-256-GCM) was also stored on my server so that I could check your sessions and send you a push. I stop this processing in November 2026 and delete all such server copies. Saved Jules chains and chain templates on the server are deleted in January 2027.
- Jules features are removed from the app on 1 January 2027. Jules sessions themselves live at Google, not with me.
10. Security
Connections are encrypted (HTTPS). Access to your data is limited by Firebase security rules and your account. GitHub access tokens are short-lived and limited to one repository. No system is perfectly secure.
11. Children
Lotse is for developers and not for children under 16. I do not knowingly collect their data.
12. Changes
If this policy changes materially, I will update the date above and, where the change matters to you, tell you in the app.