Privacy
What we collect, what we can see, and what we will never do with it.
1. What this product does
Varven stores notes on your own computer as plain Markdown files. You choose whether to also replicate them to our cloud service so that AI assistants can read them when your computer is off.
If you never enable cloud sync, we receive none of your notes. The local application works without an account.
2. What we collect
Account data. Email address, hashed password, subscription status, and the identifiers of devices you enroll.
Memory content — only if you enable cloud sync. The Markdown text of the notes you sync, their metadata (subject, category, scope, importance, timestamps), and numeric embeddings we compute from that text.
Connection data. Which AI clients you have authorized, and when they last connected.
Operational logs. Timestamps, error codes, and coarse request counts. We do not log the text of your search queries or the content of results.
We do not collect the contents of your computer outside the folder you select, your keystrokes, your screen, or your browsing.
3. How your data is protected — and what we can see
Data is encrypted in transit (TLS) and at rest.
**We hold the encryption keys, which means our systems can technically access the content you sync.** We are stating this plainly rather than implying otherwise. This is a deliberate design decision: for your memory to be searchable when your computer is off, our servers must be able to compute over it. End-to-end encryption and server-side semantic search are not compatible with current technology.
Access is limited to the minimum needed to operate the service, and we access account content only to: resolve a support request you have raised, investigate a security incident, or comply with a valid legal obligation.
**If this trade-off is unacceptable to you, use the application in local-only mode.** It is fully functional, and nothing leaves your machine.
4. What we do not do with your data
- We do not sell or rent it.
- We do not use it for advertising or share it with advertisers.
- We do not use your content to train AI models — ours or anyone else's.
- We do not share it with other users unless you explicitly place a note in a
5. Sub-processors
| Provider | Purpose | Data involved |
|---|---|---|
| Cloudflare, Inc. | Hosting, storage, database, vector index, embedding inference | Synced note content and metadata |
| [PAYMENT PROCESSOR] | Subscription billing as merchant of record | Name, email, billing details — we never receive full card numbers |
| [EMAIL PROVIDER] | Transactional email | Email address |
Text you sync is sent to Cloudflare's embedding service to generate search vectors. It is not used to train their models.
We will update this list before adding any new sub-processor, and notify active subscribers by email.
6. Where your data is stored
By default, in the United States. Business customers may request storage restricted to the European Union. International transfers rely on [STANDARD CONTRACTUAL CLAUSES / MECHANISM].
7. Retention and deletion
We keep synced content for as long as your account is active.
Deleting a note in the app deletes it from our systems — the Markdown, the database record, the search index entry, and the embedding — within 30 days. This is a genuine deletion, not a hidden archive flag.
Deleting your account removes all synced content, embeddings, and account records within 30 days. Backups are purged on their normal rotation, no longer than 90 days. Your local files are untouched and remain yours.
8. Your rights
Wherever you live, you may: get a copy of your data, correct it, delete it, export it, or object to processing. Under GDPR you may also restrict processing and complain to your national supervisory authority. Under CCPA/CPRA you may know, delete, correct, and opt out of sale or sharing — though we do neither.
Export is built in: your notes are Markdown files on your own disk. There is no export request to file and nothing to unlock.
Email [privacy@varven.net]. We respond within 30 days and do not charge.
9. Legal bases (GDPR)
Contract performance (operating the service you subscribed to); legitimate interests (security, abuse prevention, service improvement); legal obligation (tax, lawful requests); consent, where separately requested.
10. A note about other people
Your notes may mention other people. You are responsible for what you record about them and for having a lawful basis to do so. Please do not store information about others that they would not expect you to keep.
11. Automated content
The application uses a language model on your computer to summarize and extract information from your notes. **Model-generated content can be inaccurate.** Such entries are marked with their origin and remain editable and deletable by you. Do not treat them as verified fact.
12. Children
Not directed to anyone under 16. We do not knowingly collect their data; if we learn we have, we delete it.
13. Security incidents
We will notify affected users without undue delay, and supervisory authorities within 72 hours where GDPR requires it.
14. Changes
Material changes will be announced by email at least 30 days in advance. The effective date above always reflects the current version.
15. Contact
[LEGAL ENTITY], [ADDRESS] — [privacy@varven.net] [EU/UK representative, if required]