BATTLELAB
BATTLELAB // PRIVACY

Privacy Policy

Last updated: 26 September 2026

This page explains what personal data is processed when you visit battlelabos.com, download the BattleLab installer, or use the optional features of the BattleLab app that talk to our servers. Short version: no cookies, no ads, no third-party trackers. Visitor analytics run on our own server, and you can switch them off at any time.

01Who is responsible

The controller under the EU General Data Protection Regulation (GDPR) is:

Marcus Braun
Sankt-Magnus-Straße 80
28217 Bremen
Germany

Contact: marcusbraun@live.com

This site is operated privately and non-commercially. See also the legal notice.

02Visiting this website

When you open a page, your browser sends the usual request data to our web server: your IP address, date and time, the page requested, the referring page, and your browser's user-agent string. The web server writes this to its access log. If our web application firewall flags a request as suspicious, the request is also written to a security audit log.

  • Purpose: delivering the site, keeping it secure, and fixing faults.
  • Legal basis: our legitimate interest in running a secure website (Art. 6(1)(f) GDPR).
  • Retention: access logs are rotated daily and deleted after 52 days. Security audit log entries are deleted after 14 days.

The site loads no external fonts, CDNs, social-media widgets or ads. Links to other sites, such as GitHub, the documentation site or Buy Me a Coffee, are ordinary links. Nothing is sent to those sites until you click one, and from then on their own privacy policies apply.

03Visitor analytics

We count visits with Umami, a self-hosted, cookieless analytics tool on our own server. It sets no cookies, stores nothing on your device (except remembering your choice if you switch analytics off), and does not keep your IP address. It records the page, referrer, browser, device type, screen size, language and country. Legal basis: our legitimate interest in understanding how the site is used (Art. 6(1)(f) GDPR). You can switch it off at any time under Privacy settings, and we honour your browser's Global Privacy Control signal.

  • Where it runs: Umami is open source and hosted by us at analytics.superstatus.io. No data goes to a third-party analytics company. We see only aggregate statistics.
  • Your IP address: Umami uses it only in passing, to estimate the country and to form a pseudonymous visit identifier that changes regularly. The web server in front of it keeps the standard access log described in section 02.
  • Automated visits: to keep the statistics clean, your browser drops the analytics request when it looks automated: a browser under automation control, a headless Chrome, or a screen of exactly 800×600, 1024×1024 or 1280×720, which are common defaults for automated browsers. This is a rough heuristic for cleaner statistics, not a security measure. A real visitor with one of those screen sizes is simply not counted.

04Your privacy settings

Analytics are on unless you switch them off here. If your browser sends the Global Privacy Control signal, analytics are off regardless. When you switch analytics off, the choice is stored only in your browser's local storage, under the key battlelab.consent, together with umami.disabled, the analytics script's own "do not track me" switch. Neither key is a cookie, and neither is sent to us. Clearing your browser's site data resets the choice to on. If your browser blocks local storage, we cannot remember a choice, so we do not track you at all.

05Downloading the installer

Running curl -fsSL https://battlelabos.com/install.sh | sh or uninstall.sh downloads a script from this web server, which is logged like any page visit (section 02). The installer then downloads BattleLab and its runtimes directly from their public sources. We are not involved in those downloads, and those providers' own privacy policies apply:

  • the source code from GitHub (github.com/teriansilva/agent-sessions);
  • Python packages from the Python Package Index (PyPI), and JavaScript packages from the npm registry;
  • a standalone Python build from GitHub, and Node.js from nodejs.org, when they are not already installed. System packages come from your operating system's own package sources.

The installer itself sends us no usage data.

06Usage report in the BattleLab app (opt-in)

A self-hosted BattleLab install can send us a small daily active-install report, but only if its operator switches Usage analytics on. This setting is off unless you agree during setup, and you can change it later in Settings. When it is on, the app delivers at most one report per day, on days the app is opened, to our Umami server. If delivery fails, it retries, with at most three attempts per day. The report contains exactly:

  • a random install ID, created on your machine when you agree and not derived from your machine, account or network;
  • the BattleLab version and the operating system name, such as Linux.

Nothing about your sessions, prompts, code, files, projects, hostnames or account is sent. As with the website analytics, the connecting IP address is used only to estimate an approximate location and is not stored by Umami, while the web server's access log keeps it for up to 52 days. Switching the setting off deletes the install ID and stops future reports. A report that is already under way may still arrive. The server administrator can turn the feature off completely with AGENT_SESSIONS_ANALYTICS=0.

  • Legal basis: your consent (Art. 6(1)(a) GDPR).

07Home Free relay (optional)

If you enable Home Free streaming, your BattleLab install and your browser connect through our relay. The connection is end-to-end encrypted: the relay forwards only encrypted data, holds no keys, and cannot read your terminal traffic, files or access key. To route the connection, the relay necessarily handles technical connection data, such as the IP addresses of both ends, the console name you use, and connection times. There is no account. Home Free is used only if you choose it, for example with the streaming install command or the installer's prompt. A plain install never contacts the relay.

  • Legal basis: providing the service you asked for (Art. 6(1)(b) GDPR) and its secure operation (Art. 6(1)(f) GDPR).

08Recipients and transfers

The website, the analytics and the relay run on servers we operate ourselves. We do not sell your data or share it with anyone for advertising or analytics. The downloads in section 05 go directly to those providers, some of whom are based outside the EU (for example GitHub, in the USA).

09Your rights

You have the right to access your personal data, and to have it corrected, erased or restricted (Art. 15–18 GDPR). You also have the right to data portability (Art. 20), to object to processing based on legitimate interest (Art. 21), and to withdraw any consent you gave, such as for the app usage report, at any time (Art. 7(3)). Write to the contact address above.

Much of the data described here, such as pseudonymous analytics counts and IP addresses in short-lived logs, cannot be linked back to you without extra information from you. Include what you can, for example the approximate time and your IP address, and we will help as far as we are able.

You can also complain to a data protection supervisory authority. The authority responsible for us is the State Commissioner for Data Protection and Freedom of Information of Bremen (Die Landesbeauftragte für Datenschutz und Informationsfreiheit Bremen). You can also complain to the authority where you live.

10Changes

We will update this page when what we process changes. The date at the top shows the latest version.

← Back