Privacy Policy

Vinculum is operated by Whalefall Media LLC ("we," "us"), based in the State of Idaho, USA. This policy describes what we collect, what we don't, what we do with it, and what rights you have. Plain English, no dark patterns.

Where your data lives

Vinculum is local-first. Your repository and the work your agents do in it stay on your machine: the runner works in your own checkout, and embeddings are computed there. We never receive your code unless you or your agents write it into an entry.

A hosted account stores four things on our servers, all in the United States:

• Entries — what you and your agents write, plus the threads, projects, links and media around them
• Account details — your sign-in identity and email
• Billing — your Stripe customer ID and subscription status
• Logs — server and access logs

The rest of this policy is the detail behind that list.

If you self-host Vinculum from our open-source repository, this policy does not apply — you are the operator. Your data lives on your own infrastructure.

This policy applies to vinculum.run and the hosted Pro/Team tier.

What we collect

Account information

When you sign in with GitHub OAuth, we receive and store:

• Your GitHub user ID and login name
• Your primary email address (from GitHub)
• An OAuth access token, used only to verify the sign-in and immediately discarded after we mint our own session token

We do not request or store your GitHub password. We do not request scopes beyond read:user and user:email.

Content you create

Vinculum is, fundamentally, a database of typed entries you choose to write. We store, exactly as you wrote it:

• Entries — decisions, specs, notes, questions, implementations, and other typed content
• Threads, branches, projects — the organizational structure around your entries
• Links between entries
• Media — images and screenshots you upload
• Ingested conversations — Claude.ai conversation exports you choose to import
• Sessions — metadata about Claude clients connected to your projects, including focus declarations, peer activity, and timing

Derived data

To make the product work, we generate:

• Vector embeddings of entry content for semantic search and clustering, computed on your own paired runner, not by a third party
• Delta classifications and thread title summaries (via Anthropic's Haiku model on the Pro/Team tier) so the dashboard can label and prioritize work
• Audit log entries for tool invocations, useful for debugging and security incident response

Operational data

The standard set, kept for as short a window as is useful:

• IP address and user-agent of HTTP requests, retained in server access logs for 30 days
• Stripe customer ID and subscription status (we do not see your card; see Third parties)
• Crash reports and structured server logs
• Visit counts from Umami, the analytics we host ourselves at data.innervate.agency: page views, the referring page without its query string, device class, country, and clicks on a few named buttons. It sets no cookie and stores no IP address, name, email or account ID. If your browser sends Do Not Track, it records nothing. Only the hosted vinculum.run sends it; a self-hosted install sends nothing. Details in the cookie policy

What we don't collect

• We do not run ad pixels, session recorders, fingerprinting, or any analytics service run by another company. The one analytics tool, Umami, is ours (above)
• We do not collect or attempt to derive precise location data
• We do not read or scan the code in repositories you have authorized GitHub access to — Vinculum does not request repo scope
• We set one cookie, your sign-in session. Nothing we run uses a cookie to track you

How we use it

We use the data above to:

1. Run the product. Storing, indexing, and serving back the entries you write.
2. Generate intelligence features you turned on — embeddings, semantic-related lookups, auto-titled threads, delta classifications.
3. Bill you if you are on a paid tier (via Stripe).
4. Keep the lights on — debug crashes, investigate security incidents, prevent abuse.
5. Reach out about your account — service notices, security alerts, billing receipts. We do not run a marketing list. If you opt into any future product-update email, you can unsubscribe at any time.

We do not use your content to train any model, ours or anyone else's. We do not sell or rent your data. We do not share your content with other Vinculum customers. Cross-tenant access is enforced at the database layer (Postgres row-level security per project, plus application-layer ownership checks).

Third parties

We use the following third-party processors. Each handles a specific slice of the workflow; none receive more than what's needed for that slice.

If you self-host, none of these necessarily apply — you choose which integrations to enable via environment variables. Anthropic features no-op cleanly if the API key is not configured.

We do not engage data brokers. We do not engage advertising networks.

How we protect it

• All traffic to vinculum.run is TLS-encrypted end to end, terminated on our own server
• Database access is scoped per role: vinculum_app for the application, vinculum_observer for read-only infrastructure tools
• Multi-tenant isolation is enforced via Postgres row-level security and application-layer ownership checks
• The database volume is encrypted at rest (LUKS)
• Backups are encrypted on our server (restic) before they are uploaded to OVH object storage
• We rotate authentication secrets on a defined schedule and on demand if a leak is suspected
• Pre-disclosed access to your data is limited to the operator (Steve Duskett) and is logged

No system is invulnerable. If we discover a security incident affecting your data, we will notify affected accounts within 72 hours of confirming the impact, with what we know and what we're doing about it. See the security page for the vulnerability disclosure process.

Your rights

Regardless of where you live, you can:

• Access what we have on you. Use the dashboard's data export (Settings → Account → Export my data) for a JSON dump of every entry you've authored, plus your account record and subscription history.
• Delete your account and the data tied to it. Settings → Account → Delete my account. Cascading deletion runs on entries you authored in solo projects; entries you authored in shared projects are anonymized (the entry stays, your name is replaced with deleted-user) so peer references in the graph remain intact. Billing transactions are retained for tax purposes for the period required by US law. Deleted data leaves our backups within 12 months (see Data retention).
• Correct information by editing your entries directly, or by contacting us for account-level corrections.
• Object to processing by deleting your account.
• Lodge a complaint with your local data protection authority if you are in a jurisdiction that has one.

For users in the EU/UK: we are a US-based controller, and your data is stored in the United States: the application database on OVH in Hillsboro, Oregon, and backups in OVH's US-East region. Anthropic, where its features are active, is also US-based. Sub-processors are listed above. We rely on Standard Contractual Clauses where appropriate. An EU-hosted region is planned; until it exists, hosted data is stored in the US.

For users in California: you have the rights described above plus the right to know what we collect (this document) and the right to non-discrimination if you exercise any of these rights.

Data retention

Children

Vinculum is not designed for or directed at anyone under 13. We do not knowingly collect data from anyone under 13. If you believe a child has signed up, contact us and we will delete the account.

Changes to this policy

We will update this policy as the product evolves. The last-updated date below is pulled from the document's git history — every change is auditable. Material changes (a new third-party processor, a new category of data collected, a change in how we use your data) will be announced via in-product notice and email at least 14 days before they take effect, and you will have the option to delete your account before they apply.

Old versions of this policy live in the public git history at content/legal/privacy.md.

Contact

Questions, requests, complaints:

• Email: privacy@vinculum.run
• Mail: Whalefall Media LLC, [postal address — pending_legal_review]
• Security disclosures: see SECURITY.md

We respond to privacy requests within 30 days.