Privacy policy

Vulcan Veil is run by Crime De-Coder LLC, PO Box 123, Durham, NC 27702 ("we", "us"). This policy says what we collect when you use the Vulcan Veil website and desktop app, why, who else handles it, and what you can do about it.

The short version

• We do not keep your chats. Messages, files, and images go from your browser through our servers to the AI model that answers, and are not stored or logged on the way.
• Saved chats and library documents are encrypted in your browser before we store them. We cannot read them.
• For billing we keep monthly totals per model (requests, tokens, cost), never individual requests.
• We do not sell your data, show ads, or use advertising or analytics trackers.

Your account

When you sign up we keep your name, email address, and a scrypt hash of your password (never the password itself). We also keep your plan, balance, and Stripe customer number; whether you belong to a team, its name, and your role and monthly limit; any allowed networks you or your team owner set; and sign-in sessions, which expire after 12 hours. For a team, members' monthly spend is shown to the team's owner and managers.

Chats, files, images, and video

• When you send a message, your browser sends the conversation, the text of attached files, attached images, and a video when the model reads video, through our servers to the model provider that runs the model you picked, which produces the answer. We do not store them and we never write them to logs.
• Files are read in your browser. Images are shrunk and re-encoded in your browser first, which removes location and other photo metadata. A video is the MP4 or WebM file you attach, up to 12 MB. A saved chat keeps the video's name only, not the clip.
• Python code you run on the website runs in a sandbox inside your browser, with no network. The files you give it stay in your browser.
• With web search turned on, the model sends search queries, which can contain words from your question, to a search service, and reads the pages it finds.
• The desktop app works on files on your own computer. Only what goes into a chat request (your messages and the parts of files the assistant reads or you attach) leaves it, to reach the model provider through our servers.

During the preview, use public or synthetic data only (see the terms).

Saved chats and the library

Saved chats and library documents are encrypted in your browser with AES-GCM under a random vault key. That key is stored on our servers only after it is itself encrypted, once with a key derived from your vault passphrase (PBKDF2, 600,000 rounds) and once with a key derived from your recovery code. Your passphrase and recovery code never leave your browser. We store only encrypted data and its size and dates, so nobody here, including team owners and our own administrators, can read your saved items, and we cannot recover them if you lose both your passphrase and your recovery code.

Usage and billing

To bill you, we keep running totals for each month and model: number of requests, tokens, web searches, and what they cost. We do not keep a record of individual requests. Payments are handled by Stripe: your card details go to Stripe, never to us, and Stripe tells us when a subscription or top-up is paid.

Website visitors and the contact form

• For people who are not signed in, we count page views each day: totals per page, referring site, country, and city (with location rounded to about 10 km, from Cloudflare). To count unique visitors we use a one-way hash that changes every day and is deleted after a day. We do not store IP addresses or browser details, and nothing is counted once you are signed in.
• The contact form keeps your name, email, organization, and message so we can reply. To stop abuse it keeps a keyed one-way hash of your IP address, not the address itself.
• The sign-up form uses Cloudflare Turnstile to check that you are not a bot.

Allowed networks

If you or your team owner turn on allowed networks, we compare the address you connect from with the list at sign-in and on each request. We store the list you save, but we do not log the addresses we check.

Cookies and browser storage

We use one signed cookie to keep you signed in and to protect forms against forgery. The chat page keeps a few preferences in your browser's storage, such as the model you picked and when to compact a chat. Cloudflare may set its own cookies to protect the site from bots and attacks. We use no advertising or analytics cookies.

Email

We send emails you need: confirming your address, resetting your password, team invites, and links to allow a network. We may also send occasional announcements to account holders; each one has an unsubscribe link.

Who else handles data

• DigitalOcean hosts our servers, in New York.
• Cloudflare carries all traffic to vulcanveil.com and provides Turnstile, email delivery, and visitor location for the daily counts.
• Baseten runs the AI models and the web search tools. It receives chat requests to produce answers, under its terms with us.
• Parallel runs web searches when web search is on, through Baseten.
• Stripe handles payments and subscriptions.
• Amazon Web Services stores encrypted backups of our database, in the US (Virginia).

Our servers and backups are in the United States. Cloudflare handles traffic at the data center nearest you.

How long we keep it

• Account details for as long as the account exists. Billing totals and payment records as long as needed for accounting and tax law.
• Saved items until you delete them or your account.
• Contact-form messages until we delete them. Daily visitor counts are kept as totals; visitor hashes are deleted after a day.
• Database backups are taken twice a day and the newest 14 are kept, so deleted data leaves the backups within about a week.

Your choices

You can see and change your details on your account page, delete saved items or your whole vault at any time, and unsubscribe from announcements. To get a copy of your account data, correct it, or delete your account, write to us; we will answer within 30 days. Vulcan Veil is not for anyone under 18.

Security

Traffic is encrypted in transit, passwords are hashed, saved items are encrypted in your browser, and our servers keep no request logs with your content. No system is perfectly secure; if a breach affects your data, we will tell you.

Changes

If we change this policy in a way that matters, we will email account holders or show a notice on the site before the change takes effect.

Contact

Crime De-Coder LLC, PO Box 123, Durham, NC 27702 · [email protected] · contact form