Your privacy at Virlow

Bata Labs LLC ("Bata Labs", "we", "us") operates Virlow. This policy explains what Virlow collects, why, and the choices you have. It applies to the Virlow app and this website. By using Virlow you agree to this policy.

Information we collect

Account information. Your email address and a securely hashed password when you register. If you enable two-factor authentication, an encrypted secret used to verify your codes.

Your content, encrypted. In ordinary encrypted syncing, your private note titles, bodies, files and documents are stored as ciphertext. The optional processing described below has different access boundaries. We also store the initialization vectors and salts required to decrypt them on your device, and folder names and note tags, which are stored in readable form so the app can organize your workspace.

Operational metadata. To run and secure the service we process data such as timestamps, item and file counts, ciphertext sizes, file MIME types, and authentication events (for example, sign-in attempts and token rotations).

Technical data. Standard server logs and limited diagnostic data, including IP address and browser type, used for security, abuse prevention, and reliability.

Published notes. If you choose to publish a note, its content is stored in readable form by design, because publishing is a deliberate decision to make that content public.

What we cannot read

For ordinary browser vault unlocking and encrypted syncing, your master password stays on your device and the service does not receive readable private note titles, bodies or file contents. If you forget your master password, we cannot recover your encrypted content.

Optional access outside your device

If you enable and unlock the optional hosted AI connector, the app sends your master password to Virlow's API to unlock a session that can decrypt notes for connected AI clients. The local connector runs on your machine instead. In either mode, your connected AI provider can receive readable content through the tools you allow it to use, under that provider's policies.

Running code sends the selected code to Virlow's API and a sandbox service for remote code execution. Published notes are also readable outside your device by design. See the security model for these boundaries.

How we use information

• To provide, sync, and secure your account and your encrypted content.
• To authenticate you and protect against unauthorized access and abuse.
• To maintain reliability, diagnose errors, and improve performance.
• To communicate with you about your account and important service changes.

We do not sell your personal information, and we do not use your content to train models or serve advertising.

Third parties we rely on

We use a small number of service providers to operate Virlow. They process data on our behalf under their own terms:

• Fly.io, application hosting and database infrastructure (United States region).
• Cloudflare, network delivery, security, and basic traffic analytics.

We may disclose information if required by law. What we hold depends on the data and features involved: ordinary encrypted content is ciphertext, while account metadata, published notes and optional processing have the different access boundaries described above.

Cookies

On the web app we use strictly necessary cookies to keep you signed in. These are set as httpOnly cookies and are used only for authentication, not for advertising or cross-site tracking.

Data retention

We keep your account data for as long as your account is active. When you delete your account, we delete your account data and encrypted content from our active systems. Residual copies may remain in backups for a limited period before they are overwritten. Server logs are retained for a limited period for security and reliability.

Your rights and choices

You can access and edit your content in the app at any time, export or delete individual items, and delete your account. Depending on where you live, you may have additional rights under laws such as the GDPR or the CCPA, including the right to access, correct, or delete personal data, and to object to certain processing. To exercise these rights, contact us using the details below.

Virlow is not directed to children under 13, and we do not knowingly collect personal information from them.

Changes and contact

We may update this policy as the service evolves. Material changes will be reflected by the date at the top of this page and, where appropriate, communicated in the app. Questions or requests can be sent to team@batalabs.com.