Privacy policy

The portal stores your email address, a password hash, the name you give us, the Macs you sign in from (a name, a hashed hardware identifier, and the app and macOS versions), the three onboarding answers on your account, and your subscription state as mirrored from Stripe. Payments are handled by Stripe; we never see your card number.

The Mac application sends the portal three things automatically, and nothing else:

• Sign-in — your email and password, once per Mac, with a name for the Mac, a hashed hardware id, and the app and macOS versions. The password is never stored on the Mac: only a sign-in token and an id for the Mac, both in its Keychain.
• The licence check — your account id, the Mac's id and the app version. The app looks when it opens, when the Mac wakes and on a timer while it runs, and sends the check only once a day has passed since the last one that succeeded (or the licence it holds has run out) — so about once a day — and whenever you press Refresh in its Settings.
• Your onboarding answers — once, straight after a sign-in, the app reads the three answers you gave this site when your trial started (what you shoot, which keys you prefer, and where your takes start), so the Mac does not ask them again. It carries the same account id and Mac id as the licence check, and is not part of the daily one.

It never sends photographs, file names or library contents unless you publish.

Offline, nothing changes. The app keeps the licence the portal last signed and checks that signature itself, so it never needs the portal to open. A paid subscription keeps working for 30 days past the end of its paid period without a successful check, and then turns read-only until a check succeeds; a trial ends on its last day either way. Read-only means every library still opens, browses and exports, and nothing is deleted.

Nothing you give us is used to train AI systems, and we do not sell or share personal data with advertisers. Transactional email is sent through a delivery provider; no marketing email is sent without your opt-in.

You can delete your account yourself, at the end of the account page, with your password. It is deleted at once and cannot be recovered: the account and its sign-in, the Macs it was signed in on, your onboarding answers, its subscription mirror and any invite codes on it. A subscription that is still running is cancelled at Stripe at the same moment and the rest of its period is not refunded, and your Stripe customer record is deleted, so nothing more can be charged. Your libraries are not touched: they are files on your Mac, never part of the account.

What stays, and why: Stripe keeps its own records of past payments for as long as the law requires; and our staff log keeps its lines about the account as they were written, because that log is never edited — when staff delete an account, their line names its email. Copies in the database's short-term backups expire on their own. Write to support@vixlo.app if you cannot sign in to delete it yourself.

This text is a placeholder for the real policy, which needs review before launch.