Last updated: April 13, 2026
lxzl ("we", "us", "our") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, and safeguard your information when you use our workflow automation platform.
When you create an account, we collect your email address and authentication credentials. Passwords are hashed using Argon2id and are never stored in plaintext.
We store the workflows you create, including node configurations, execution history, and run results. This data is stored locally in your instance's SQLite database.
API keys and secrets you store in the credentials vault are encrypted using AES-256-GCM before being written to the database. Decryption occurs only at runtime when a workflow execution requires it.
When you register MCP (Model Context Protocol) servers, we store connection configuration including server names, transport type, commands, and URLs. Secret fields such as environment variables and authentication headers are encrypted using the same AES-256-GCM vault used for credentials. Plaintext secrets exist only in memory during active connections.
We may collect anonymous usage metrics such as node types used, execution counts, and error rates to improve the Service. This data does not include your workflow content or personal information.
Your data is stored in a SQLite database using WAL (Write-Ahead Logging) mode for performance and reliability. The database file resides on the server hosting your lxzl instance.
Security measures include:
Your workflows may interact with third-party services including:
When using cloud AI providers (Anthropic, OpenAI), your prompts and data are sent to their servers and subject to their privacy policies. Using Ollama (the default) keeps all AI processing local.
When using MCP servers, tool call inputs and outputs pass through the configured server. Local stdio servers process data on your machine; remote SSE/HTTP servers are subject to their operators' privacy policies.
Workflow data and run history are retained indefinitely unless you delete them. You can delete individual workflows, runs, tables, and credentials at any time through the application interface.
You have the right to:
The Service is not intended for use by children under 13. We do not knowingly collect personal information from children under 13.
We may update this Privacy Policy from time to time. We will notify you of material changes by updating the "Last updated" date. Continued use of the Service after changes constitutes acceptance.
For privacy-related questions, contact us at privacy@lxzl.dev.