Privacy Policy

The short version

vDesign is local-first: the documents you create stay on your device - in your browser, or in files you choose - and we cannot see them. There are two exceptions. When you connect an AI assistant such as Claude, ChatGPT or Gemini, what it reads and writes passes through our servers on the way, and is deleted within a day (see Connecting an AI assistant). And when vDesign AI runs on an API key you added in the web app, each turn runs on our servers: we keep the key encrypted, and your conversation for 7 days after its last turn (see vDesign AI on a key kept by vDesign).

We collect these kinds of personal data, and no more:

• Your account - your email and name, so you can sign in and your settings follow you between machines.
• Anonymous usage analytics - which features you use and how AI turns and exports go, tied to a random id, never to your email, and never including your designs. In the desktop app and the web app this is on by default and you can turn it off; the website uses it from your first visit (see What the website collects).
• AI turns you choose to share - off by default; collected only if you switch it on.
• vDesign AI on a key you add in the web app - the key, encrypted, and your conversation with vDesign AI for 7 days after its last turn. Only if you add a key there.

We have no AI model of our own, and we do not sell your data. An API key you add in the desktop app stays on your computer; one you add in the web app is kept by us, encrypted, and used only for your turns.

Who we are, and what this covers

This policy explains what vDesign does with your personal data, and your rights over it.

It covers:

• the vDesign web app at getv.design/app,
• the vDesign desktop app, for macOS and Windows,
• connecting an AI assistant to vDesign (remote MCP),
• vDesign AI, the agent inside the apps, on your own API key,
• this website, and
• the vdesign-mcp CLI and the vDesign libraries, which are free to use, need no account and send us nothing. By default, the libraries load their fonts from jsDelivr, a public content delivery network, which receives that request rather than us.

What the desktop app collects, and why

When you use the desktop app, we collect:

• Account information - your email and name, from the sign-in provider (AWS Cognito), to authenticate you and attach your settings. An account is required to use the desktop app.
• Synced settings - your preferences (theme, model choices, onboarding state, and the name, address and model names of any custom AI provider you add), so a new machine starts where the last left off. These never include your API keys.
• Your AI provider API key - a key you add in the desktop app is stored encrypted on your device (the macOS Keychain or Windows DPAPI) and used to reach the provider you chose. It is never sent to us. A key you added in the web app is kept by us instead, and the desktop app uses it through our servers (see vDesign AI on a key kept by vDesign).
• Local models and custom providers - you can point vDesign AI at a model running on your own computer, or at another address you type. Requests go from your computer only to that address, never through us. With a model on your own computer, the turn itself never leaves your machine; only the shared turns and analytics you have agreed to are sent to us, as for any other turn.
• Shared AI turns - only if you opt in (off by default). If you turn this on, the prompt, the reply, and the head of the document worked on are uploaded so we can measure how authoring goes. You can turn it off at any time.
• Anonymous product analytics - on by default, with an opt-out (hosted in the US region). Events such as app launches, documents created, AI-turn outcomes, exports, and errors, tied to a random, opaque id - never your email and never your design content. Turn it off in Settings → Account → Privacy.

What the web app collects, and why

The web app needs an account too, and collects the same account information and synced settings as the desktop app (above). Beyond that:

• Your documents - kept in your browser's own storage on this device, or saved to files you choose. Your browser files them by account, and signing out puts them away. They are not sent to us.
• Your sign-in session - kept in your browser's storage on this device.
• Your API key, if you add one - kept by us, encrypted, so vDesign AI can run in the web app. A browser cannot keep a key safely, so in the web app vDesign AI always runs on our servers (see vDesign AI on a key kept by vDesign). You can also design with AI by connecting an assistant instead (below).
• Anonymous product analytics - on by default, with an opt-out - the same events and the same setting as the desktop app. Turn it off in Settings → Account → Privacy.
• Shared AI turns - only if you opt in - the same setting as on desktop. If it is on, turns you run in the web app are shared too.

Connecting an AI assistant

You can connect an AI assistant, such as Claude, ChatGPT or Gemini, so it can see and change the documents you have open in vDesign. Nothing is connected until you allow it on our consent page, and you can disconnect it at any time in Settings → Connections. While it is connected:

• The connection - we keep a record that your account allowed that assistant (its name and address) until you disconnect it.
• What it reads and writes - each request and its answer pass through our servers on their way between the assistant and your open document. We store them only to deliver them, and delete them within 1 day. Pictures sent along are deleted within 1 day too.
• Documents it makes while nothing is open - kept on our servers, for your account only, until you open them in vDesign or for 7 days, whichever comes first.

What you tell the assistant, and what it reads from vDesign, is also handled by the company that runs it, under its own terms and privacy policy.

vDesign AI on a key kept by vDesign

vDesign AI, the agent inside the apps, always runs on your own API key with a provider you choose. Where the key is kept depends on where you added it. A key added in the desktop app stays on your computer, and its turns go from your computer straight to the provider. A key added in the web app is kept by us, and every turn on it runs on our servers - in the web app, and in the desktop app when you are signed in to the same account. This section is about that second case.

What we keep:

• Your API key - encrypted with a key-management service (AWS KMS) and bound to your account, so it can only be unlocked for your own turns. Nobody is shown it again, you included, and it never appears in our logs. Beside it we keep its last four characters (so you can tell your keys apart), the list of models it opens, when it was last checked, and, for Alibaba Cloud (Qwen), the API host you gave with it. Kept until you remove it or delete your account.
• Your conversation - your prompts and vDesign AI's replies (the design changes it writes, in vDesign's design language), so that your next message can carry on from them. Deleted 7 days after its last turn (our storage removes it within a day after that), or sooner when you close the document. It includes the file names of anything you attached, but not the files.

What passes through and is not kept:

• The document you are working on - sent with each turn that edits it, used for that turn, and not stored.
• Attachments - files you attach are uploaded to temporary storage just before the turn, and deleted when the turn ends, or within 2 days if no turn uses them.
• Our logs record that a turn ran - the provider, the model, how long it took, how many tokens it used and how it ended - and never your key, your prompts, your document or the replies.

The provider you choose. To run a turn, we send your prompt, the conversation so far, the document and any attachments to the AI provider you picked, using your key, because you asked vDesign AI to do it. vDesign acts as your tool here, on your instruction: the provider receives the request as your request, on your account with it, and handles it under its own terms and privacy policy - including whether it keeps what it receives, and whether it may use it to train its models. Its charges go to your key, not to us. The providers you can choose, and where each says it processes data:

• Anthropic (Claude), Google (Gemini) and OpenAI - United States companies; see each one's privacy policy for where it processes data.
• Z.ai (GLM) - a Singapore company; where it processes data is not stated.
• DeepSeek - processes data in China (PRC).
• Moonshot AI (Kimi) - a Singapore company; where it processes data is not stated. Its terms allow it to use prompts for training unless agreed otherwise in writing.
• Alibaba Cloud (Qwen) - Singapore, through Model Studio's international service, which stores request data in that region.
• MiniMax - a Singapore company; it stores personal data in the United States.
• OpenRouter - United States; it passes each request on to the company that runs the model you picked, which may process it elsewhere.
• xAI (Grok) - United States.
• Mistral - European Union.

Custom providers and models on your own computer are only offered in the desktop app, and never run through our servers.

Analytics and shared turns follow the same choices as everywhere else. A turn is recorded as a shared AI turn only if you have switched sharing on, and a content-free analytics event is sent only if you have left analytics on. A turn run from the web app follows the same two settings.

What the website collects

This website uses anonymous analytics, hosted in the US region - page views and clicks, such as on Open app - from your first visit. The banner tells you so; there is no switch on the website. To stop it, block cookies and site data for getv.design in your browser, or use a browser or extension that blocks analytics.

What we don't collect or see, apart from the cases above

• Your designs - their content, text, layers, and file names stay on your device. The exceptions are what a connected assistant reads and writes, and what vDesign AI works on with a key kept by vDesign, which pass through our servers as described above, and the document head, only if you opt into sharing AI turns.
• Your prompts - unless you opt into sharing AI turns, or use vDesign AI on a key kept by vDesign, which keeps the conversation for 7 days.
• Your AI API key - a key you add in the desktop app never reaches us. One you add in the web app we keep encrypted, and never show or log.

We have no first-party AI model, and we do not build advertising profiles.

Legal bases (GDPR)

Where the GDPR applies, we rely on:

• Consent - for opt-in AI-turn sharing. You can withdraw consent at any time.
• Performance of a contract - to provide your account and the app's synced settings, and to run vDesign AI on a key you keep with us: storing the key and the conversation, and sending each turn to the provider you chose.
• Legitimate interests - to keep the service secure and improve the product, including anonymous analytics on the website and in the apps, balanced against your rights.

Who we share data with

We share personal data only with service providers who process it on our behalf, under contract:

• Amazon Web Services (AWS) - account sign-in (Cognito), storage of opt-in shared turns (S3), our database and API, the servers a connected assistant goes through, and the servers, storage and key-management service (KMS) that vDesign AI uses for a key kept by vDesign.
• Our analytics provider - anonymous product analytics, hosted in the US region.

When vDesign AI runs on a key kept by vDesign, each turn also goes to the AI provider you chose, on your instruction and with your key (see vDesign AI on a key kept by vDesign). That provider is not working for us: it handles the turn under its own terms with you.

We do not sell personal data and do not share it for advertising.

Where your data is stored

• Analytics are processed in the US region.
• Account, shared-turn, connected-assistant and vDesign AI cloud data are hosted on AWS in US.
• A vDesign AI turn on a key kept by vDesign is also processed by the provider you chose, where that provider processes it (listed under vDesign AI on a key kept by vDesign). For DeepSeek, that is China.

Where any processing happens outside your region, we rely on appropriate safeguards, such as standard contractual clauses.

How long we keep it

• Account data - for as long as your account exists, then deleted within 1 month.
• Analytics - retained for 6 months.
• Opt-in shared turns - retained for 6 months.
• An API key kept by vDesign - until you remove it or delete your account.
• A vDesign AI conversation - 7 days after its last turn, or when you close the document, whichever comes first. Attachments, when the turn ends, or within 2 days.
• A connected assistant's requests and answers - deleted within 1 day; documents it made while nothing was open, within 7 days or when you open them; the record of the connection, when you disconnect it.

Your rights and choices

You can access, correct, export, or delete your personal data; restrict or object to certain processing; and withdraw consent at any time. How to exercise them:

• Analytics - the opt-out toggle in Settings → Account → Privacy (desktop and web app). On the website, block cookies and site data for getv.design in your browser.
• AI-turn sharing - the toggle in the app.
• A connected assistant - disconnect it in Settings → Connections; access stops on its next request.
• An API key kept by vDesign - remove it in Settings → Connect, and we delete it at once.
• Account deletion - email us (in-app deletion isn't built yet). We delete your account along with any API keys and conversations kept for vDesign AI; your designs stay on your device regardless.
• Anything else - contact us (below).

If you're in the US or UK, you can also complain to your data protection supervisory authority.

Cookies and similar technologies

• Website - sets anonymous analytics cookies from your first visit, as its banner says. Block cookies for getv.design in your browser to stop them.
• Web app - uses your browser's storage for your sign-in session, settings and documents, and an anonymous analytics cookie unless you turn analytics off. It sets no advertising cookies.
• Desktop app - uses local, encrypted storage for your sign-in session and settings. It sets no advertising cookies.

Security

We encrypt secrets at rest on your device (the OS keychain or DPAPI) and use encrypted connections (HTTPS) in transit. An API key kept by vDesign is encrypted with AWS KMS and bound to your account, and only the service that runs your turns can unlock it. No system is perfectly secure, but we work to protect your data - and we limit what we collect in the first place.

Children's privacy

vDesign isn't directed to children under 13, and we don't knowingly collect their personal data. If you believe a child has given us data, contact us and we'll delete it.

Changes to this policy

We'll update the date at the top when this policy changes, and give notice of material changes. Continuing to use vDesign after a change means you accept the updated policy.

How to contact us

Questions, or a request about your data? Email sagar@getv.design.