Your privacy at Virlow

Bata Labs LLC ("Bata Labs", "we", "us") operates Virlow. This policy explains what Virlow collects, why, and the choices you have. It applies to the Virlow app and this website. By using Virlow you agree to this policy.

Information we collect

Account information. Your email address and a securely hashed password when you register. If you enable two-factor authentication, an encrypted secret used to verify your codes.

Your content, encrypted. In ordinary encrypted syncing, your private note titles, bodies, files and documents are stored as ciphertext. The optional processing described below has different access boundaries. We also store the initialization vectors and salts required to decrypt them on your device, and workspace names and note tags, which are stored in readable form so the app can organize your workspace.

Billing information. If you subscribe to Pro, Stripe collects your payment details and billing address to take payment and work out tax. We never receive your card details. We store your plan, your subscription's status and renewal date, and the identifiers Stripe gives your customer record and subscription, so the app knows which plan you are on.

Operational metadata. To run and secure the service we process data such as timestamps, item and file counts, ciphertext sizes, file MIME types, and authentication events (for example, sign-in attempts and token rotations).

Technical data. Standard server logs and limited diagnostic data, including IP address and browser type, used for security, abuse prevention, and reliability.

What we cannot read

For ordinary browser vault unlocking and encrypted syncing, your master password stays on your device and the service does not receive readable private note titles, bodies or file contents. If you forget your master password, we cannot recover your encrypted content.

Optional access outside your device

If you enable and unlock the optional hosted AI connector, the app sends your master password to Virlow's API to unlock a session that can decrypt notes for connected AI clients. The local connector runs on your machine instead. In either mode, your connected AI provider can receive readable content through the tools you allow it to use, under that provider's policies.

Running code sends the selected code to Virlow's API and a sandbox service for remote code execution. See the security model for these boundaries.

How we use information

• To provide, sync, and secure your account and your encrypted content.
• To authenticate you and protect against unauthorized access and abuse.
• To maintain reliability, diagnose errors, and improve performance.
• To communicate with you about your account and important service changes.

We do not sell your personal information, and we do not use your content to train models or serve advertising.

Third parties we rely on

We use a small number of service providers to operate Virlow. They process data on our behalf under their own terms:

• Fly.io, application hosting and database infrastructure (United States region).
• Cloudflare, network delivery, security, and basic traffic analytics.
• Stripe, payments, subscription billing and tax calculation, if you subscribe. Stripe receives your email address, name, billing address and payment details.
• Anthropic, only when you use the assistant inside the app. The messages you send it, the note content it reads to answer, any text you have selected, any files you attach, and the web searches it runs when you switch web search on, are sent to Anthropic to produce its replies. Conversations you have with the assistant, and the instructions and prompts you save for it, are stored on our servers encrypted with your key, so we cannot read them. Dictation, where your browser offers it, is done by your browser, which may send the audio to its maker; it does not pass through Virlow.
• Our code execution service, only when you run code. The code you choose to run is sent to it unencrypted, runs, and the output is returned to you.

We may disclose information if required by law. What we hold depends on the data and features involved: ordinary encrypted content is ciphertext, while account metadata and optional processing have the different access boundaries described above.

Cookies

On the web app we use strictly necessary cookies to keep you signed in. These are set as httpOnly cookies and are used only for authentication, not for advertising or cross-site tracking.

Data retention

We keep your account data for as long as your account is active. When you delete your account, we delete your account data and encrypted content from our active systems. Residual copies may remain in backups for a limited period before they are overwritten. Server logs are retained for a limited period for security and reliability. Records of payments and invoices are kept by Stripe, and by us where needed, for as long as tax and accounting law requires, even after an account is deleted.

Your rights and choices

You can access and edit your content in the app at any time, export or delete individual items, and delete your account. Depending on where you live, you may have additional rights under laws such as the GDPR or the CCPA, including the right to access, correct, or delete personal data, and to object to certain processing. To exercise these rights, contact us using the details below.

Virlow is not directed to children under 13, and we do not knowingly collect personal information from them.

Changes and contact

We may update this policy as the service evolves. Material changes will be reflected by the date at the top of this page and, where appropriate, communicated in the app. Questions or requests can be sent to team@virlow.com.