Open for new projects
Built Clean.
Privacy-First. No Exceptions.
Static websites and mobile apps with zero trackers, GDPR-clean architecture, and strict security headers from the first deploy, not added later.
What We Offer
Consultancy Services
Advice on the systems you already run, or a website or app built for you. Either way it arrives without trackers and with strict security headers.
IT Consultancy
Advisory work on the systems you already run. Security architecture review, network and firewall policy, segmentation and access-control design, hardening plans, and GDPR-clean system design. Technology selection before you commit budget. You get written findings and a plan you own outright, not a retainer you cannot leave. We advise and report; we do not install or operate your systems. Findings describe a system at the time we examined it, and no review can guarantee security. Our GDPR advice is technical, not legal. See Terms sections 09–10.
Landing Pages
Fast, static landing pages for product launches, app releases, and campaigns. No CMS, no backend, no plugin to expire. With no server and no plugins, there is nothing to update after launch.
Business Websites
Multi-page sites for professional services, restaurants, studios, and shops. Static HTML, email-based contact, strict security headers from the first deploy. No subscription required after handoff.
Secure Web Infrastructure
Strict security headers, hardened hosting, GDPR-clean architecture, and no tracking, by default, in every site and app we deliver at no extra cost. Where your wider network and hardware estate is in scope, we advise on its design and hardening rather than installing it; see IT Consultancy above.
Mobile Apps
iOS & Android application development, from design to deployment on App Store and Google Play. Native experience, cross-platform efficiency.
11 Templates · Pick Your Brief
Templates
Pick the closest match to your project. Each template lists the stack and what you get. We scope and quote from there.
// landing pages
L
Template · Product Launch
Launchpad
Pre-launch capture page · Any product or service
A single static page: hero, feature teasers, email capture form that sends to your inbox, optional countdown. No trackers and no CMS, so it stays up for as long as the launch takes, months if needed, with nothing to maintain. Visitors who subscribe before launch prove market interest before you ship anything.
Static HTML/CSSEmail captureCountdown timerCloudflare Pages
// Timeline confirmed on quote
A
Template · Mobile App Download
AppPage
iOS & Android download page · Mobile apps
Detects the visitor's device and shows the correct store button first; desktop gets both. Feature overview, screenshots, support email link. No tracking pixel, analytics SDK or cookies, just a fast page that lets the app speak for itself. Store links update in one place; the rest stays unchanged.
Static HTML/CSSDevice detectionNo trackingCloudflare Pages
// Timeline confirmed on quote
C
Template · Events & Campaigns
CampaignPost
Single-event or time-bound campaign page
Schedule, offer or speaker cards, countdown to the date, registration via email. All static, with no CMS, backend or plugin to expire. Works for a webinar, a product reveal, a seasonal sale, or a local event. After the date, the page archives or redirects with one header change. Nothing left running.
Static HTML/CSSEvent schemaEmail registrationZero cookies
// Timeline confirmed on quote
// business websites
S
Template · Professional Services
ServeSite
4–7 pages · Services, about, contact
The standard for professional services: about, services list, contact form → email, optional team or FAQ page. There is no CMS: content lives in HTML and we update it on request. Strict security headers from the first deploy. It suits lawyers, accountants, clinics and consultants, anyone whose credibility depends on a site that loads fast and looks the part.
Static HTML/CSSEmail contactCloudflare PagesCSP/HSTS
// Timeline confirmed on quote
G
Template · Visual Portfolio or Catalog
GalleryBase
Photography, ceramics, art, product range
An image-heavy static build that lazy-loads, so 20 to 100 or more photos stay quick. Gallery grid or product card layout, per-item descriptions, order or booking request via email. No CMS login, no subscription, no plugin to expire. The images are the content; the site gets out of the way. Updating a price or adding a new item is one line of HTML.
Static HTML/CSSLazy-load imagesNo CMSEmail orders
// Timeline confirmed on quote
B
Template · Personal Brand
BrandPage
Trainer, consultant, freelancer, coach
One page. Bio, what you offer, three to five testimonial quotes, booking form that sends to email. Mobile-first because your clients find you on their phones. No analytics and no retargeting pixel following visitors after they leave. You meet the client in person; the site just makes sure they can find you.
Static one-pagerEmail bookingNo trackingCloudflare Pages
// Timeline confirmed on quote
// mobile apps
U
Template · Utility App · Android
UtilKit
Privacy tool, productivity utility, offline-first
Android-first (Kotlin) utility app built for offline, local-only operation. No backend, no account and no analytics SDK; data stays on the device. Same architecture as LockedPages: local data, local logic, local storage. Ideal for encryption tools, secure notes, calculators, or any utility where users should not need to trust a server.
KotlinAndroidLocal-onlyNo backendGoogle Play
// Timeline confirmed on quote
P
Template · Business Companion · Android
PocketBiz
Companion app for a local business or service
A lean Android app built for one specific business: menu or service list, contact, optional push notifications. There are no user accounts. The app knows what the business offers and shows it. Booking requests write an email to the owner. Menu, prices, and hours update by swapping a local config file. Built for one client, not for a platform.
KotlinAndroidLocal configEmail actionsGoogle Play
// Timeline confirmed on quote
// secure infrastructure
D
Default · Every Build
DefendBuild
Security-first architecture · Included in all projects
This is not an add-on. It is the base of every build. Strict CSP (no unsafe-inline), HSTS, X-Frame-Options, Permissions-Policy disabling every sensor API not in use. Zero third-party scripts. All JS in external files. Static-only hosting: no server to patch, no CMS to exploit. No cookies, so no consent banner is needed. This is the default, not an upgrade.
Cloudflare PagesCSP/HSTS_headers fileStatic-onlyZero tracking
// Included in every project · No extra cost
H
Service · Security Audit & Hardening
HardenKit
Existing site · Headers, CSP, GDPR, dependency review
Audit of an existing site: missing security headers, inline script exposure, third-party tracker inventory, cookie compliance, outdated dependencies. Delivered as a prioritised report with specific fixes. Most fixes are a _headers file and a script refactor; the site rarely needs rebuilding. One week, fixed scope, no retainer required.
Headers auditCSP reviewTracker inventoryGDPR check
// Timeline confirmed on quote
// commerce
W
Template · E-Commerce & Payments
ShopWorker
Real cart · Stripe Checkout · Cloudflare Worker backend
Static HTML storefront with a vanilla JS cart saved in localStorage and a Cloudflare Worker that creates the Stripe Checkout session server-side. The visitor browses, adds to the cart and clicks checkout, and the Worker validates every price against a server-side source before Stripe sees the order. Stripe handles all card data, PCI scope, SCA and 3D Secure for EU customers, and confirmation emails. No card data ever touches your domain. The Worker runs on Cloudflare's edge, and the free tier covers 100,000 requests a day. The one rule that cannot be skipped: the client-side cart total is never trusted. The Worker recomputes it. Always.
Static HTML/CSSVanilla JS cartCloudflare WorkerStripe CheckoutSCA / 3D SecureCSP: stripe.com
// Timeline confirmed on quote
© LPagesAppLabs S.R.L. · All template descriptions are original work
Why LPagesAppLabs
What You Can Check
Four things you can verify before you send us an email.
This Site Is the Sample
The measured panel further down runs on all nine of our sites. The same headers go into what we build for you.
You Own It Outright
Plain HTML, CSS and JavaScript, with no CMS or framework licence to renew. Any developer can take it over, and nothing stops working when you stop paying us.
Findings, Not a Retainer
Advisory work ends with a written report and a plan you keep. You are not signing up for a monthly fee.
A Company You Can Look Up
LPAGESAPPLABS S.R.L. is registered in Romania. The company page lists the numbers so you can check the public register first.
Portfolio
What We've Built
The best proof we can offer is our own work: a live multi-site platform, an encryption app in closed beta, and a developer tool in daily use. Everything in this section is built, deployed and running today.
// built by us · live
LP
Platform · Live · 9 Sites
LPagesAppLabs Platform
lpagesapplabs.com
This platform. Nine sites on one domain, the same strict Content Security Policy on every one, strict HSTS, zero third-party origins and no trackers. Deployed on Cloudflare Pages CDN with custom security headers. Built and maintained in-house.
Static HTML/CSS9 SitesCloudflare PagesStrict CSPHSTS
Mobile App · Closed Beta · Android
LockedPages
lockedpages.lpagesapplabs.com
AES-256-GCM file encryption app. Zero-knowledge: the password never leaves the device and the key is never stored. Designed, built, and maintained entirely in-house.
FlutterArgon2idAES-256-GCMAndroid
CT
Developer Tool · V2 Complete · Python CLI
Clip Trimmer
clip-trimmer.lpagesapplabs.com
Automated 9:16 video pipeline with face crop, punch zoom, AI captions, and CI/CD integration. 55 unit tests and CI/CD, fully documented. Built in-house to solve a real problem and in daily use; end-to-end validation on production clips is still in progress.
PythonFFmpegWhisper AI55 TestsCI/CD
© LPagesAppLabs S.R.L. · All project descriptions are original work
Capabilities
Problems We Solve
Recurring briefs this approach is built for. These are not case studies. No client is described and nothing below has been delivered. Each is a situation a static site handles well, with what we would build for it.
Website · Healthcare
The 2014 WordPress clinic site
Typical brief · bilingual practice
A plugin-heavy install from 2014 takes seconds to render on mobile, and every plugin is either an update you have to apply or a vulnerability you do not yet know about. Rebuilt as static HTML there is no database, no admin login and no update treadmill. Appointment enquiries go straight to email, and a bilingual site becomes two sets of files rather than a translation plugin.
Static HTML/CSSCloudflare PagesBilingualNo CMS
// Timeline confirmed on quote
Landing Page · B2B SaaS
Pre-launch page on a press deadline
Typical brief · pre-launch product
You have a product and a press release going out, and nothing to point either at. A static landing page can go up in days because there is no stack to provision, and it has a strict Content Security Policy and no third-party scripts from the first deploy. For a compliance-tooling audience the absence of analytics is itself a signal, and that audience checks.
Static landing pageStrict CSPZero tracking
// Timeline confirmed on quote
Portfolio · Photography
A portfolio that outlives the shoot
Typical brief · image-heavy portfolio
Galleries of forty or more images without a CMS to maintain: lazy-loaded so the page stays fast, static so there is nothing to patch. No login to lose, no plugin to break at 2am the night before a shoot. Adding a set means dropping files in a folder and redeploying.
Static portfolioLazy-load gallery40+ imagesNo CMS
// Timeline confirmed on quote
Restaurant · Hospitality
Bookings living in Instagram DMs
Typical brief · menu and reservations
Requests get missed on a busy Friday night, and there is no record of the ones that were. The seasonal menu becomes plain HTML and the reservation form goes straight to email, so no booking platform takes a commission and no third party holds guest data. Updating the menu once a season takes minutes and needs no login.
Static HTML/CSSEmail reservationsNo booking platformGDPR-clean
// Timeline confirmed on quote
Corporate · Legal Services
The firm whose host keeps going down
Typical brief · professional practice
Shared hosting that drops twice a month is the wrong look for a practice advising clients on digital compliance. Static files on a CDN have no server to patch and no runtime to fall over. A PGP key on the contact page for sensitive matters; and no blog at all if old posts could become discoverable evidence later. That is a decision to take on purpose, not by default.
Static siteCloudflare PagesPGP contactNo CMS
// Timeline confirmed on quote
Personal Brand · Fitness
Paying monthly for nine trackers
Typical brief · bookings and services
Site builders load third-party scripts you never chose, which requires a consent banner, which visitors decline, and then they cannot find your booking page. A static page carries zero trackers, so no banner is required and nothing is there to decline. At €32 a month, a builder subscription costs €384 a year for that privilege.
Static HTML/CSSZero trackersNo consent bannerEmail booking
// Timeline confirmed on quote
Personal Brand · Real Estate
Indistinguishable on the aggregators
Typical brief · independent agent
Every agent on the same platform looks identical, and the platform takes a fee on the lead it sends you. A standalone brand site with a manually maintained listing grid takes about two minutes to add a property and two to remove it once it sells. The enquiry arrives directly, with no commission attached to it.
Static portfolioManual listing gridCloudflare PagesNo aggregator
// Timeline confirmed on quote
Product Catalog · Craft & Ceramics
A catalog that does not need a checkout
Typical brief · small-batch maker
Selling through direct messages and a market stall does not require a full store. A static catalog carries the photography, descriptions and prices, with orders by email. No checkout means no PCI scope and no monthly platform fee. Payment on delivery, the way it already works. The products need to be found, not carted.
Static catalogProduct photographyNo CMSNo checkout
// Timeline confirmed on quote
Corporate · Accountancy
The three-year-old tax calendar
Typical brief · firm with reference data
A stale deadline table sends clients in with wrong assumptions, which costs more to correct than the site cost to build. As a plain HTML table it is updated once each January in about ten minutes, with no plugin to break, subscription to renew or login to forget. Where every word is reviewed before publication, that review happens once and stays true.
Static HTML/CSSCloudflare PagesHardcoded calendarNo CMS
// Timeline confirmed on quote
© LPagesAppLabs S.R.L. · Scenarios, not client work. No engagement is described above
Verifiable, Not Claimed
Security Posture, Measured Live
We are asking you to let us build something you will be responsible for. This is the standard we hold our own pages to, read out of the page you are reading right now by your own browser. Open devtools and check any line of it.
- Third-party origins loaded
- 0
- No fonts, analytics or tag manager loaded from another host
- Cookies set
- 0
- No consent banner, because there is nothing to consent to
- Browser storage entries
- 0
- Nothing written to localStorage or sessionStorage
- Content Security Policy
- default-src 'self'
- No unsafe-inline, no unsafe-eval, no external origin permitted
- HTTPS enforcement
- 2-year
- Strict-Transport-Security with includeSubDomains
- Capabilities denied
- 9
- Camera, microphone, geolocation, payment, USB and ad-topics APIs
The values above are the ones we ship. With JavaScript enabled they are replaced by what your own browser actually observed, measured at —. A row turns red if reality disagrees with us.
Get in Touch
Let's Talk
Tell us about your project and we aim to come back with a free quote within 2 business days.
Write to us directly. A person reads every email.
contact@lpagesapplabs.com