What Vrge can see

On launch and every four hours, the desktop app asks updates.getvrge.com whether a newer build exists. The request carries your platform, chip architecture, current version and update lane. That is the whole URL. Our worker adds one to a counter per UTC day, platform and version, and one to a counter per installer file when you download. It stores no IP address, no user agent and no per-request row; there is nothing to correlate. It reads the user agent only to decide whether a download was a crawler, and stores that verdict as a number. If you downloaded from a link we posted with a channel tag, the tag is counted per day. It describes our link, not you.

Cloudflare terminates the connection, so Cloudflare sees your IP address the way it does for any site it fronts. Our code never reads it. There is no setting to turn the check off.

Once you have activated a licence, every launch sends your licence key, and the per-device activation id it issued, back to Lemon Squeezy, our merchant of record, to confirm the key is still valid. A trial copy makes no such call. The request goes to Lemon Squeezy, not to us; we operate nothing in its path, and if Lemon Squeezy is unreachable the app trusts the stored licence and carries on. Lemon Squeezy holds your name, email, country, payment details and licence. We receive your email address and licence key and keep them for the life of the licence plus three years, for warranty and tax.

A Team server you run yourself does the same for its own key: it asks Lemon Squeezy at start-up and once a day, and keeps running if it gets no answer.

Before anything leaves your machine, the app encrypts your database with AES-256-GCM under a key derived by PBKDF2-SHA256 (600,000 iterations) from a recovery code generated on your device. The code is kept in your OS keychain and is never sent. There is no escrow, no master key and no support override: lose the code and the backup cannot be opened by anyone, including us. See the recovery code in the guide.

What we store: the sealed file, up to seven of them, filed under a SHA-256 digest of your licence key rather than the key itself; each file’s size and timestamp; the device label you chose (it defaults to your platform’s name); and, in the subscription database, your licence key in plaintext with the Lemon Squeezy order and subscription ids. We can delete a backup. We cannot read one.

Cancelling stops new uploads at the end of the period you paid for and deletes nothing. Listing, downloading and deleting keep working, so nobody is stranded, which also means your snapshots outlive the subscription until you remove them yourself.

Cloudflare’s request logging is switched on for this worker too, so Cloudflare holds a per-request record for at most seven days. The worker itself prints only error messages, never a byte of a snapshot, which it could not read in any case.

When you subscribe, the app sends its prompts to ai.getvrge.com and we forward them to Anthropic on our account. The prompt is derived from your email and documents and redacted according to your setting, and on this tier the setting has a floor: full content can never be sent through us. If you have chosen full content, the app substitutes a summary made locally, or strict redaction, before the call leaves your machine. The prompt passes through the worker in memory and is not written down; the usage table has no column that could hold it.

What is written, per call: the timestamp, task, model, token counts, status and redaction mode, keyed on your licence key, plus an opaque member id in team mode. Those rows are kept indefinitely (there is no purge routine) and they survive cancellation. Cloudflare’s request logging is also switched on for this worker, so Cloudflare holds a per-request record (the request, the response and related metadata, in Cloudflare’s words) for at most seven days. The worker itself prints one alarm line about mis-priced subscription events; it never prints a prompt.

Plaid requires our confidential secret on every request, so unlike every other source, each bank-transaction read is proxied: your app sends the request to oauth.getvrge.com, the worker adds the secret, forwards it to Plaid and returns Plaid’s answer verbatim. Merchant names, amounts and dates therefore cross our infrastructure. We write nothing about them down: that handler writes to no store, and this worker’s configuration does not switch on Cloudflare’s request logging. Cloudflare enables that logging by default on new Workers, so assume Cloudflare may hold a per-request record for up to seven days here, as it does for the two workers where we switched it on ourselves. What the worker keeps is a rate-limit counter per IP address and hour and, when a new bank connection is created, one per hashed licence key, both expiring about an hour later. Creating that new connection is the one request that carries your licence key: the worker checks it with Lemon Squeezy and refuses without an active licence. Reads, refreshes and removal of an existing connection never involve it. The Plaid access token stays on your device.

These three providers require a client secret a desktop app cannot safely hold, so signing in (exchanging a one-time code for tokens) and later token refreshes go through oauth.getvrge.com. The tokens are returned to your device and not retained. Reading your data afterwards goes straight from your machine to the provider. During the browser hand-off, the one-time sign-in code (and, for QuickBooks, the company id) is parked for up to ten minutes and deleted after retrieval. The same per-IP rate-limit counter applies. Each of the three also has an advanced path where you supply your own credentials and nothing touches us.

Everything else (Gmail, Outlook, IMAP, Google Calendar, Outlook Calendar, CalDAV, .ics feeds, a local folder, a bank CSV) connects from your machine to the provider directly, or reads a file you already have. None of it touches a server we operate. See the sub-processor list for every vendor by name.

If you write to support@getvrge.com, privacy@ or security@, the conversation sits in our Google Workspace mailbox and is kept for three years after the last message. If you joined the waitlist before launch, that address is in a Google Sheet and at Resend, which sent your confirmation; it stays until you unsubscribe or ask us to delete it, and a deletion clears both.