Privacy Policy

Vrge is built by TRD Ventures LLC (New Mexico, USA). We believe your data is yours. This policy explains the limited data we process, the data you can choose to send to third parties through the app, and the rights you have over both.

1. Scope and controller

This policy applies to (a) the Vrge desktop application, (b) optional add-ons, (c) the getvrge.com marketing website, and (d) any email you send us. For the limited personal data we hold (see §3), TRD Ventures LLC is the data controller.

When you enable a cloud AI provider inside Vrge, you are the controller for the content sent to that provider — the provider is your sub-processor, not ours. We never proxy or log those calls.

When you run the optional self-hosted Team server, you are the controller for the data stored on your server. We have no access.

2. What the website collects

Cloudflare Web Analytics — cookieless, does not fingerprint, does not track across sites. Cloudflare retains aggregate analytics for 6 months. Legal basis (GDPR): legitimate interest in measuring traffic to a first-party site.

The site sets no third-party cookies and contains no tracking pixels. Two third-party scripts load: the Cloudflare Web Analytics beacon described above, and the Lemon Squeezy checkout. The checkout script loads on every page rather than only the ones with a buy button, so Lemon Squeezy sees the request even if you never start a purchase.

3. What we collect when you buy or contact us

• Waitlist / early access — if you entered your email on the homepage or the download page before launch, we store that address so we can tell you when Vrge is available. It is collected through a Google Form and held in a Google Sheet on our Google account. Signing up also sends you a confirmation email through Resend, which keeps your address as a contact record from that moment on — so it lives in two places, and a deletion request clears both. We use it for the launch announcement and occasional release news, and for nothing else — it is never sold, never shared with anyone beyond those two providers, and never used to build a profile of you. We do not track opens or clicks. Every email carries an unsubscribe link, and you can ask us to delete your address at any time at privacy@getvrge.com. Legal basis: consent, withdrawable at any time.
• Purchase information — name, email, country, and payment details are processed by Lemon Squeezy as Merchant of Record. We receive your email and license key; we never see or store your card number. Legal basis: performance of the purchase contract.
• License keys — tied to your purchase for activation. Retained for the life of your license plus 3 years for warranty and tax purposes. Legal basis: performance of contract; legitimate interest in tax recordkeeping.
• Support correspondence — if you email us, we keep the conversation to help you. Retained for 3 years after the last message, then deleted. Legal basis: legitimate interest in providing support and improving the product.
• Update checks — the app pings updates.getvrge.com with your current version, OS, architecture and update lane (regular or beta) so it can offer you upgrades. No identifiers, no content. The download server also keeps a count per installer file — a number, with no record of who downloaded it. We also count those checks per day, platform, update lane and app version — a number, with no record of which copy asked. Legal basis: legitimate interest in shipping security fixes to users.

4. What the app stores and where

Vrge is offline-first. Your projects, clients, tasks, notes, invoices, emails fetched by the observer, calendar events, bank transactions, and files all live in a local SQLite database on your machine (Tauri desktop) or in your browser's IndexedDB (web build). We have no access to that data and the app sends us no telemetry or analytics. The app makes exactly two outbound calls of its own: the update check described above, and — if you have activated a license — a licence validation to our payment processor, Lemon Squeezy, on launch. That validation carries your license key and a random per-device identifier so a license can be tied to a device count. It carries none of your business data.

The app also uses local browser storage on your device for its working state — preferences (theme, industry context, company name), the pending proposal queue, source configurations (with secrets split out to the OS keychain on desktop), license state, and the consent log. All of it is strictly necessary for the app to function, and none of it ever leaves your device. Under the ePrivacy Directive this storage is covered by the "strictly necessary" exemption, so no cookie banner is required.

5. Optional cloud AI providers

The app can, if you turn it on, send prompts to a cloud AI provider to classify emails, extract clients from threads, and similar tasks. Cloud AI is off by default. When enabled, calls go directly from your device to the provider using your own API key — we don't relay them.

Supported cloud providers and what we do with your content before it leaves your device:

• Anthropic (Claude) — privacy policy. API calls to api.anthropic.com. Data processed in the United States. Anthropic does not train on API data by default.
• OpenAI — privacy policy. API calls to api.openai.com. Data processed in the United States. OpenAI does not train on API data by default.
• Google (Gemini) — Gemini API terms. API calls to generativelanguage.googleapis.com. Data processed on Google's global infrastructure.
• Ollama (local) — runs entirely on your machine. Nothing leaves your device. Recommended if you process sensitive data.

You choose what gets sent. When you use your own cloud API key, the data goes to your own provider account (Anthropic, OpenAI, or Google) — Vrge never sees it. Because of that, the default for bring-your-own-key cloud AI is full content, which gives the observer the best extraction accuracy. You can change this in Settings → AI & Intelligence to: a redaction layer that replaces client names, emails, phone numbers, and dollar amounts with tokens; a local Ollama-generated summary that never ships raw content; or the strictest truncated-and-redacted mode. The "What gets sent" preview shows a sample of what the mode in force for your provider would send; full content can be switched on or off for each email, calendar, file or accounting source (every account of that provider together), and any source set to send differently is listed beneath the preview. Vrge Managed AI (the optional paid tier where we run inference) is different: it is always redact-by-default and never sends full raw content, because that data passes through our proxy. What it does send is a summary written by Ollama on your machine, or — when Ollama is not running, which is the common case for subscribers — the same text with emails, phone numbers, amounts, account numbers, addresses and the names of your clients and projects replaced by tokens, truncated to 800 characters. That is less than your own API key would send, which is everything, unaltered. It is not nothing: a sentence carrying none of those identifiers goes as written. We store no prompt text either way.

AI activity log. Every cloud AI call is logged locally in Settings → AI & Intelligence: when, which provider, which task, estimated cost, and whether content was redacted. No prompt text is stored. The log retains the last 30 days / 10,000 calls and is included in your data export.

Kill-switch. One toggle in Settings disables every AI call and the observer pipeline instantly, with no confirmation dialog.

5a. Optional: Vrge Managed AI (subscription proxy)

Vrge Managed AI is an optional monthly subscription where we run the cloud inference for you instead of you bringing your own key. This section covers what happens when you subscribe. If you never subscribe, this section does not apply — §5 covers BYO-key cloud AI, and that path is unchanged.

What we log. The Managed AI proxy records metadata only for every forwarded call: your Vrge license key, the timestamp, the upstream provider (e.g. Anthropic), the selected model, input/output token counts, task type, and redaction status.

What we do not log. Prompt bodies, completion text, schema definitions, user-identifying payload fields — none of these are persisted server-side. This is a schema-level guarantee: the proxy's usage log table has no column for content, so no code path can leak it even by accident.

Redaction on the proxy. The client applies redaction before sending. The proxy verifies that redaction was applied for non-manual sources and refuses the call otherwise. Belt-and-suspenders so a client misconfiguration cannot send raw content.

Hard quota, no overage billing. Each tier includes a fixed monthly token cap. When you hit the cap, the proxy refuses further calls and your app falls back to BYO keys or Ollama. You will never be billed beyond the published tier price.

Self-serve cancel, no dark patterns. Cancellation is one click through the Lemon Squeezy customer portal. Access continues through the end of your current billing period, then stops — no auto-renewal, no retention nags, no “pause instead of cancel” flows, no win-back emails. We do not retain billing-related data beyond what Lemon Squeezy requires for tax and compliance purposes — see §8.

Managed AI is optional. The app's AI works with a local model on your own machine, or with your own cloud provider key, without the proxy being involved at all. Nothing is routed through ai.getvrge.com unless you subscribe.

No training, ever. Per §5, we do not ship your content to any cloud provider for training. This applies equally to Managed AI calls — we are the forwarder, not a data aggregator. We do not sell, rent, or broker your data under any circumstance.

5b. Optional: Vrge Cloud Backup (subscription storage)

Vrge Cloud Backup is an optional subscription that keeps an off-machine copy of your Vrge database on storage we operate. If you never subscribe, nothing in this section applies and no backup data leaves your device.

What is sent. A snapshot of your local database, encrypted on your device before upload with a key derived from your recovery code. We never receive that code or key. Alongside the ciphertext, each upload carries your Vrge license key (as the credential that identifies your subscription), a snapshot identifier made of a timestamp and a short label for the device that made it, and the snapshot's size in bytes.

Where it is stored, and what we can see. Snapshots are stored on Cloudflare R2 in the United States, filed under a one-way hash of your license key rather than the key itself. We can see the metadata above — when a snapshot was made, from which device, how large it is, and your total storage in use — and nothing of its contents. We hold no key that could open one.

Retention and deletion. We keep your 7 most recent snapshots; older ones are pruned as new ones arrive. Deleting a snapshot in Settings removes it from storage. Cancelling stops new uploads at the end of the period you have paid for and does not erase what is already stored — you keep listing, downloading and deleting your snapshots after a subscription ends, so cancelling never strands your data.

6. Optional source integrations (Gmail, Calendar, etc.)

Vrge can watch your email, calendar, files, and bank activity to propose CRM entries for your review. All source integrations are off by default. You explicitly opt in to each one. When you connect a source, the app performs OAuth directly between your device (or your self-hosted team server) and the provider.

IMAP mailboxes, CalDAV calendars and calendar links use a password or a link you enter instead of OAuth. The app keeps it in your operating system's keychain on your device (macOS Keychain Services; Windows Credential Manager) and connects directly from your device to the server you name — those requests never pass through Vrge infrastructure, and disconnecting the source deletes the entry from your keychain.

For connected mailboxes, Vrge reads both received messages and messages you sent, under the same read-only access. Sent messages are used to tell who is waiting on whom — the Open Loops feature that shows client threads awaiting a reply — and are never treated as incoming signal (your own emails can never become proposed clients or projects).

A sent message to someone already in your records may also be checked for a commitment you made in it (“I’ll send that by Friday”). That check runs through the same AI provider and the same redaction settings as your incoming mail: on Ollama nothing leaves your machine; with a cloud key or Managed AI, the message goes to that provider under your chosen redaction mode. Today the result is only logged — it does not create a proposal.

Supported sources as of this policy's effective date:

• Gmail (read-only)
• Google Calendar (read-only)
• Outlook Mail (read-only)
• Outlook Calendar (read-only)
• IMAP mailboxes (read-only)
• ICS / CalDAV calendar feeds (read-only)
• Stripe (read-only in practice — see below)
• Plaid bank connections (read-only)
• Square (read-only)
• CSV bank imports
• QuickBooks Online (read-only)
• Local filesystem
• vCard contact import

When you connect a bank account through Plaid, you explicitly authorize the connection through Plaid Link, where you log into your bank directly with Plaid; we never see your bank login credentials. Plaid integration uses the read-only transactions product, which means we cannot initiate transfers, modify your account, or take any action that moves money. Square works the same way, on its own consent screen. Stripe is the one exception worth stating plainly: Stripe's Connect consent screen grants a read-write token, because Stripe offers no read-only scope for this kind of integration. Vrge never uses that write access, and this is enforced in the app rather than merely promised — every Stripe call is a read against a fixed allowlist of read endpoints, and there is no code path that can write. A least-privilege Stripe App integration is planned. Additional sources follow the read-only pattern when they ship.

6c. How OAuth credentials are handled

Some connected services (Plaid, Stripe Connect, Square) require a confidential application secret that cannot ship inside the desktop app. For these services, we operate a token-exchange relay on Vrge-controlled infrastructure that holds the secret server-side. It forwards the credential exchange to the provider and returns the resulting access token to your device. The relay does not log, persist, or store access tokens, your transaction data, or any user-identifying content; the one thing it does keep is the short-lived authorization code (and, for QuickBooks, your company id) for at most 10 minutes while the sign-in window hands back to the app, deleted after retrieval, plus per-IP rate-limit counters for about an hour. Creating a new bank connection also sends your licence key through the relay to Lemon Squeezy to confirm it is a valid, paid licence; the relay keeps a hashed per-licence counter for about an hour and does not store the key. After the initial connection, Stripe, Square and QuickBooks reads flow directly from your device to the provider and the relay is re-involved only to refresh credentials. Plaid is the exception: its API requires the secret on every request, so every Plaid transaction read passes through the relay in memory. It is never written down, but it does cross our infrastructure, and you should know that before connecting a bank.

6a. Google API Services — Limited Use disclosure

Vrge's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Specifically, when you connect Vrge to a Google account:

• Scopes we request: gmail.readonly and calendar.events.readonly. Read-only. Vrge cannot send email, modify calendar events, move files, or touch your Google account in any way that changes data.
• How we use Google user data: exclusively to power the features you see in Vrge — detecting new clients from email senders, extracting project details from message bodies, reading messages you sent so Open Loops can show which client threads are waiting on a reply, linking meetings to CRM entries, proposing invoice drafts, and surfacing proposals for your approval in the Inbox. No other use.
• No transfer to third parties: Google user data is never sold, rented, licensed, or transferred to any third party outside the context of delivering Vrge's features to you. If you enable a cloud AI provider (see §5), prompt content derived from your mail may be sent to that provider for inference only — never for model training. With your own API key the default is full content to your own provider account (adjustable to redacted, local-summary, or strict modes in Settings → AI); the optional Vrge Managed AI tier is always redacted before sending.
• No advertising use: Vrge does not use Google user data for advertising, ad personalization, or any ad-related purpose. Vrge does not serve ads.
• No human reading: Vrge does not allow humans to read your Google user data, except (a) with your explicit consent (e.g. support cases you initiate), (b) for security purposes (such as investigating abuse), (c) to comply with applicable law, or (d) for aggregated and anonymized operational analytics that cannot be used to identify any individual user.
• Where the data lives: on solo desktop installs, all Google data stays on your machine. Records you have accepted live in a local SQLite database encrypted at rest via SQLCipher, with a per-device 256-bit key protected by the host operating system's keychain, and OAuth tokens are independently encrypted via the OS keychain (macOS Keychain Services / Windows Credential Manager). Pending proposals are held separately, in local browser storage, not encrypted: each one keeps an excerpt of the source message (up to 8,000 characters) so it can show you what it read. That excerpt is deleted the moment you accept, reject or dismiss the proposal, and untouched proposals are archived after 30 days — also without the excerpt. So the readable copy of a message exists on your machine only while that proposal is still waiting on you. On self-hosted team installs, OAuth tokens and the proposals derived from them live on your own team server — you control the hardware, network, encryption key, and backups. Vrge does not operate a hosted team-server service, so we never have access to either.
• How to revoke: disconnect the source in Settings → Sources at any time, which deletes Vrge's stored OAuth tokens. You can also revoke Vrge's access at any time from Google's Third-party apps & services page.

6b. Microsoft 365 integrations

The same principles apply to Microsoft 365 integrations via Microsoft Graph. Vrge requests Mail.Read and Calendars.Read delegated permissions, read-only. Data is used only to surface proposals in the Inbox, never sold or transferred, never used for advertising or model training. Revoke access at any time from My Account → Privacy.

7. Optional self-hosted Team server

The Team license includes a server component you run on your own infrastructure. You control the hardware, network, and data. We have no access. If you are using a Team server provided by your employer, your employer is the controller for the data on it.

The server does make three outbound connections of its own, and none of them carries your team's data. Once a day it asks updates.getvrge.com whether a newer server version exists; that request carries no version, key, hostname or body, and UPDATE_CHECK=0 turns it off. It validates the Team license key with Lemon Squeezy, which receives the key itself. And only if the team subscribes to Vrge Managed AI, it relays those calls to ai.getvrge.com under exactly the rules in §5a. Everything else stays on your server.

8. Sub-processors and third parties

A complete, current list of sub-processors and third-party services is available on the Sub-processors page. We will update that page before adding new sub-processors that materially affect our processing.

9. International data transfers

If you are in the European Economic Area, the United Kingdom, or Switzerland, data we process may be transferred to the United States (where TRD Ventures and several sub-processors are based).

• Lemon Squeezy relies on the EU Standard Contractual Clauses and the EU–US Data Privacy Framework.
• Cloudflare is certified under the EU–US Data Privacy Framework.
• Cloud AI providers (Anthropic, OpenAI, Google) are your sub-processors, not ours, when you enable them. Review each provider's transfer mechanism on their site before enabling.

10. Data retention

• License records: life of license + 3 years
• Support email: 3 years after last message
• Cloudflare analytics: 6 months (aggregate)
• Website request logs: kept briefly by Cloudflare for abuse prevention, then discarded. Separate from the aggregate analytics above, and never joined to a purchase or a license.
• Waitlist address: until you unsubscribe or ask us to delete it. Held in the Google Sheet and at Resend; a deletion request removes it from both, though delivery records for mail already sent may persist in Resend's logs for their own retention period.
• Hosted backup snapshots: the 7 most recent, and only if you subscribe to Vrge Cloud Backup. Encrypted on your device before upload; we hold no key. Deleting one removes it. Cancelling stops new uploads but does not erase what is already stored — you keep listing, downloading and deleting your snapshots after a subscription ends, so cancelling never strands your data.
• Managed AI call records: metadata only — license key, timestamp, provider, model, token counts, task type, redaction mode and call status, plus an opaque member id in team mode so an admin can see per-person consumption. Used for billing and quota. Prompt and response bodies are never written down; the table has no column for them.
• Connection relay: authorization codes for at most 10 minutes, deleted after retrieval; rate-limit counters (per address and, for new bank connections, per hashed licence key) for about an hour. Nothing else is stored.
• In-app AI activity log: 30 days or 10,000 calls, whichever comes first (stored on your device)
• In-app provenance log: append-only, retained as long as you keep the database (stored on your device)
• Your business data: retained by you, on your device, until you delete it

11. Your rights

Depending on where you live, you have rights to access, correct, delete, restrict, or object to our processing, and to data portability. Under GDPR/UK GDPR you also have the right to withdraw consent at any time and to lodge a complaint with your supervisory authority.

Because Vrge stores your business data on your device, most of these rights you exercise directly — export, edit, or delete your SQLite database yourself, anytime, even with an expired license. For the limited personal data we hold (license records, support email), send a request to privacy@getvrge.com. We respond within 30 days.

12. California residents (CCPA / CPRA)

If you are a California resident, the categories of personal information we collect map to CCPA categories as follows:

• Identifiers: email, license key, IP (via Cloudflare, aggregated)
• Commercial information: purchase records (held by Lemon Squeezy)
• Internet activity: page views on the marketing site (via Cloudflare, cookieless)

Sources: directly from you; from Lemon Squeezy on purchase. Business purpose: providing and supporting the product.

We do not sell or share your personal information as those terms are defined under the CCPA, and we have not in the preceding 12 months. We therefore do not offer a "Do Not Sell or Share" link — there is nothing to opt out of.

You have the right to know, delete, correct, and limit the use of sensitive personal information. To exercise any of these rights, email privacy@getvrge.com. We do not discriminate against you for exercising these rights.

13. Children's privacy

Vrge is a business productivity tool. It is not directed to children under 13, and we do not knowingly collect personal information from anyone under 13. If you believe a child has provided us with personal information, email privacy@getvrge.com and we will delete it.

14. Sensitive data — HIPAA notice

TRD Ventures is not a HIPAA-covered entity and Vrge is not a HIPAA-compliant system. Do not use the app to store, process, or transmit Protected Health Information (PHI) that is regulated under HIPAA. If you work in a regulated vertical (health, legal, financial) and want to use Vrge for matters that touch regulated data, use the local Ollama AI provider and keep source integrations that pull PHI-adjacent data turned off.

15. Security and breach notification

We apply industry-standard measures to the limited data we hold: bcrypt password hashing on the Team server (you host), TLS for all network calls we make, signed auto-updater payloads, and no third-party telemetry.

If we become aware of a personal-data breach affecting data held by us, we will notify affected individuals by email within 72 hours of confirmation, along with the nature of the breach, categories of data affected, likely consequences, and mitigation steps. For breaches affecting data held by a sub-processor (e.g., Lemon Squeezy), that sub-processor is primarily responsible for notification under its own obligations, and we will assist.

To report a suspected vulnerability in Vrge, email security@getvrge.com. Full responsible-disclosure policy with scope, response-time commitments, and safe-harbor language lives at /security.

16. Changes to this policy

We'll update this page if the policy changes and revise the date at the top. For material changes, we'll try to notify license holders by email.

17. Contact

General: support@getvrge.com
Privacy / data requests: privacy@getvrge.com
Security reports: security@getvrge.com

TRD Ventures LLC · New Mexico, USA