App privacy policy
What the Lapsus app on your computer does with what you type, and the few times it goes online.
Last updated 27 September 2026.
What this covers
The Lapsus app for Windows and macOS, whether downloaded from this website or installed from the Microsoft Store. This website and the Lapsus account have a policy of their own.
Privacy policy for the website and account
Who is responsible
The controller is the publisher of Lapsus. Write about anything on this page to:
info@getlapsus.comWhat you type
Lapsus fixes text typed in the wrong keyboard layout, so while it runs it has to see the keys you press in other apps. That text is processed only in memory on your computer. It is never written to disk, never sent anywhere and never used for training.
- Password fields are skipped wherever the operating system can identify them
- The typing buffer is overwritten when it is dropped, and after a minute without typing in any case
- Apps you exclude in the settings are ignored completely
- An action on selected text borrows the clipboard for a moment, then puts back what was on it
- The optional neural model runs entirely on your computer
When the app goes online
The app has no account, no telemetry, no analytics and no advertising. It connects to the internet only in these cases:
- Dictionaries
- When you install or update a dictionary, it is downloaded from GitHub (raw.githubusercontent.com). Hebrew word forms also come from kaikki.org.
- Neural models
- When you search for or download a model, the app contacts Hugging Face (huggingface.co). A search sends the text you typed into the search box.
- Updates
- The version from this website checks GitHub Releases for a newer version when it starts. The Microsoft Store version does not: the Store updates it.
- Licence activation
- Only if you enter a licence key. Then, and about once a month after that to renew it, the app sends the key and a machine identifier to our licence server (Supabase, hosted in the EU). The identifier is a salted SHA-256 hash of the operating system's machine ID; the ID itself never leaves your computer. The server keeps it as described under Activated machines in the website policy.
Each of these servers sees your IP address and ordinary request data, as with any download. GitHub, kaikki.org and Hugging Face are independent services under their own privacy policies, and the app sends them nothing else.
The licence reminder
Lapsus is free for private use and paid for organisations. To decide whether to show a licence reminder, the app checks on your computer whether it is managed by an organisation — joined to a domain or Entra ID, or enrolled in device management. The answer stays on your computer.
What stays on your computer
Settings, your list of words to leave alone, excluded apps, the licence key and its activation token, downloaded dictionaries and models, and a local error log are kept in the app's data folder and never uploaded. The Microsoft Store version keeps them inside its own package folder, which Windows deletes when you uninstall the app. The version from this website leaves them in place so that a reinstall finds your downloads; delete the Lapsus folder in your application data to remove them.
Your rights
Because of the app we hold one thing about you: the activation record of a licence key, if you entered one. The rights in the website policy apply to it, and you can release a seat in the account yourself. For anything else, write to the address above.
Changes
If this policy changes, the date at the top changes with it. A change in what the app sends is also noted in the release notes of the version that makes it.