This is a factual draft, not reviewed by a lawyer. It was written by reading Vanshee's actual source code and describes what the software really does with data as of the date below. It is not legal advice and has not been checked for completeness against GDPR, CCPA, or any other law. The owner must review, complete every marked placeholder, and have it checked before anyone relies on it.
Privacy Policy
Draft · last updated 2026-08-06
This policy describes the personal data handled by the Vanshee macOS application and its website and licensing service. It reflects the behaviour of the code as written; where a decision has not yet been made, that gap is flagged inline in [OWNER: … ] highlights rather than filled with an invented answer.
1. Who is responsible for your data
The data controller for Vanshee is Filipe da Silva, an individual established in Portugal. For any privacy question or request — including access, correction, or erasure — contact fgalego@gmail.com, the address the app already uses for user feedback.
For reference, the service currently sends transactional email from
noreply@filipedasilva.com with a reply-to of filipe.silva.web@gmail.com.
2. The short version — what Vanshee does not do
No telemetry, analytics, crash reporting, or tracking. The macOS app contains no analytics or tracking SDK of any kind. Verified by searching the source: there is no Sentry, Firebase, Mixpanel, Amplitude, PostHog, Segment, Crashlytics, Bugsnag, Datadog, or advertising/ tracking beacon anywhere in the app.
Your hardware identifier never leaves your Mac. Device activation sends only a one-way SHA-256 fingerprint, not your raw hardware UUID.
No payment card data touches our servers. Card details go directly to Stripe; Vanshee never sees or stores them.
Your AI provider API keys stay on your Mac. They are stored in the macOS Keychain and are never transmitted to Vanshee's servers.
Apart from licensing traffic and two anonymous configuration downloads (described in section 6), the app does not "phone home."
3. What we collect, why, and where it is stored
Everything below is stored in a JSON file on Vanshee's own virtual private server, operated by netcup GmbH and located in Germany — inside the European Union, so this data is not transferred outside the EU/EEA. The third parties listed in section 5 are separate: some of them are outside the EU, and each is named there.
| Data | When & why | Shared with |
|---|---|---|
| Waitlist email address | When you sign up on the landing page. Used to send you a confirmation and, later, an early-access key. Duplicate sign-ups are ignored. | Resend (email delivery) — see section 5 |
| Your IP address (waitlist) | Recorded with each waitlist sign-up and used to derive an approximate country for the admin view. | ipwho.is (country lookup, over HTTPS) — see section 3 |
| Approximate country (name + 2-letter code) | Derived from the IP above; shown next to waitlist entries. | Result of the ipwho.is lookup |
| Purchase & licence details: your email, a Stripe customer id, and licence status | When you buy a licence. Used to issue your key and manage your licence. No card data is stored — Stripe holds it. | Stripe (payment); Resend (key email) |
| Licence key | Generated at purchase and emailed to you. The server keeps only a salted hash of it, never the key itself. | Resend delivers the key to you |
| Device / activation data: a SHA-256 device fingerprint, app version, macOS version, and activation timestamps | When you activate the app on a device, to enforce the device limit and issue an entitlement. | No one — only Vanshee's own API |
| Heartbeat: your licence key + device fingerprint | Once every 24 hours, to confirm the licence is still valid and re-issue an entitlement. No usage data is sent. | No one — only Vanshee's own API |
| Audit log: records of purchases, activations, and admin actions — some entries include your email or licence/device ids | Kept for dispute and anti-piracy investigation. | No one — stored server-side only |
About the IP address and country lookup. When you join the waitlist, your IP address
is sent to the third-party service ipwho.is to look up a country, which is shown
as a flag in our internal waitlist view. The request is made over HTTPS, and the result
(country name and two-letter code) is stored with your waitlist entry; your IP is not sent
anywhere else. Until 2026-08-06 this lookup used ip-api.com over plain,
unencrypted HTTP — that has been replaced.
In production the service runs behind a single Caddy reverse proxy with
TRUST_PROXY=1, so the IP recorded is your real client address rather than the
proxy's — we are stating that plainly rather than implying we see less than we do.
4. Data stored only on your own Mac
Some data never reaches Vanshee's servers at all. It lives in the macOS Keychain on your device until you clear it or delete the app:
- Your licence key, cached entitlement, and a local install id.
- Any third-party AI provider API keys you enter (for example Groq, OpenAI, or xAI).
When the app uses one of your provider keys, it talks directly to that AI vendor with your own key; that exchange is between you and your chosen vendor under their terms, and is not routed through or seen by Vanshee. We are not a party to it and act as neither controller nor processor for what you send to those vendors — whatever you or your agents send them is governed by that vendor's own privacy policy and terms, which you accepted when you obtained the key. The same applies to the CLI agent tools (such as Claude Code or Codex) that Vanshee launches on your Mac using your existing subscriptions: they communicate with their own vendors directly, not through us.
5. Third parties we share data with
Vanshee uses a small number of service providers. It does not sell personal data or use it for advertising.
- Stripe — payment processing and hosted checkout. Receives your email and payment details. See stripe.com/privacy.
- Resend — transactional email delivery (waitlist confirmation and licence key). Receives your email address and the message content. See resend.com/legal/privacy-policy.
- ipwho.is — IP-to-country lookup for waitlist sign-ups (see section 3). Receives your IP address over HTTPS. See ipwho.is/privacy.
- Google — only if you choose "Sign in with Google" to enable cloud sync. Receives the sign-in request; we receive your email address and basic profile in return. See policies.google.com/privacy.
- GitHub — only if you choose "Sign in with GitHub" to enable cloud sync. Receives the sign-in request; we receive your email address and basic profile in return. See GitHub's privacy statement.
This list was verified against the code on 2026-08-06 by auditing every outbound request the licensing service makes. Google and GitHub were added then: they are reached only by the optional cloud-sync sign-in, so they are not involved unless you use it.
6. What the app sends over the network
To Vanshee's own servers, the macOS app sends only:
- Activation — once, when you activate: licence key, device fingerprint, app version, and macOS version.
- Heartbeat — once every 24 hours: licence key and device fingerprint only.
- Configuration downloads — anonymous fetches of a tool manifest and a model catalogue, with no identifiers attached.
All other network activity you may see is something you initiated — a browser page you opened inside the canvas, a local dev server you started, or a call to an AI vendor using your own key — not Vanshee reporting on you.
7. How long we keep your data
The software does not automatically delete anything: there is no scheduled purge or expiry. In practice, data is retained until it is manually deleted or you request deletion. A refund or dispute disables the related licence record but does not erase it.
[OWNER: confirm retention policy — decide a retention period for (a) waitlist emails/IPs, (b) purchase/licence records, (c) device/activation records, and (d) the audit log, which contains customer emails — or state plainly that data is kept until deletion is requested. Do not publish an invented number.]
8. Your choices and rights
You can ask us what data we hold about you and ask us to delete it by emailing fgalego@gmail.com. Today, deletion is handled manually by the operator; there is no self-service deletion in the product, and the audit log in particular is not automatically erased.
[OWNER: decide and document the operational process for access and erasure requests, and which rights you commit to honour under the applicable law you choose.]
9. Changes to this policy
This is an early draft and will change as the product and its legal review mature. Material changes will be reflected here with an updated date.
10. Contact
Questions or requests: fgalego@gmail.com.