Privacy Policy

1. What We Collect

• Your account. When you sign in with Apple: Apple's identifier for you in this app, and, if you choose to share them, your name and email address (which may be an Apple private relay address). When you create an account with an email and a password: that email, and a one-way hash of the password (never the password itself, which nobody at Vurium can read); and, for each of the last ten devices it logged in on, a one-way hash of a random key that device keeps, so tries made elsewhere cannot keep you from logging in on it. When you continue with Google: Google's identifier for you, your name and, if Google has verified it, your email address (Google is asked only who you are; nothing else of your Google Account, and no access to it is kept). Members of the Vurium team may sign in with their Vurium team account instead: then its email, name and role. When you log in with an email and a password that do not open an account of Vurium AI's own, the app checks them against the Vurium team's sign-in on vurium.com's server (for Vurium's staff), which does not keep the password and records a failed try, with the email and your internet (IP) address, in its server logs. To stop accounts being made in bulk, we count the accounts made from each internet address each day, kept only as a hash of the address and the day, never with your account.
• What you send. Your messages; the photos and videos you attach; the pages, text and selections you ask about; the tasks and reminders you set up; what you ask Vurium AI to remember; the name, personality and photo you give it; and, on Vurium AI Pro or Max, the keys and passwords you keep in its vault, which are encrypted.
• Photos and videos you attach. We keep a copy of each photo at most 2000 pixels across, a video as a set of still frames with their times (not the video or its sound), and small thumbnails, with the size and length of the original. The original stays on your device, where Vurium AI edits it when you ask; a copy of an edit's result is sent to us so Vurium AI can see it.
• What Vurium AI makes for you. Its answers, images, videos, the photos and videos it edits, app plans and the results of your tasks.
• Its notes. Vurium AI keeps notes on what you talk about (people, projects, decisions, what it found), its memory across conversations: a summary of each subject, linked to the others and to the conversations it came from. A smaller model by Anthropic writes them from your conversations a few minutes after each one goes quiet. You can read and delete them in Settings, Memory, Notes; your iPhone keeps a copy so they open without the network. Free keeps 30 notes, Vurium AI Pro and Max 2,000.
• What it has learned. Vurium AI learns how to help you better from your own conversations: when you correct it, when one of its tools fails, when you give an answer a thumbs up or down, or thank it, the same smaller model by Anthropic reads that conversation once it goes quiet and keeps short lessons (how you want things, a way that worked, a mistake not to repeat), never a password, a code, a card number, an address, a phone number or an email. They are yours: used in your conversations, never sent to OpenAI. You can read and delete them, or turn learning off, in Settings, Memory, What It Has Learned. Your thumbs up or down are kept on the answer, with what you tell us went wrong.
• What it learns from everyone. With Help Improve Vurium AI on (Settings, Memory, What It Has Learned; on unless you turn it off), your lessons, never your words, your conversations or anything private in them, are also read by the same smaller model by Anthropic, apart from your account (marked with a code only our server can link back to it, so they can be taken back), together with other people's lessons, to find what works for everyone. A lesson becomes Vurium AI's own, used in everyone's conversations, only once it holds for at least three people, and it never names or points to anyone. Turn it off, delete a lesson, or delete your account, and what yours gave is taken back.
• What it did. A record of what Vurium AI did for you (answers that used its tools, task runs and reminders; kept 30 days) and of what you allowed it to do in its browser (kept 90 days).
• Its browser. Pages Vurium AI opens for you load on your device; what they show (their text and screenshots) is sent to our server and to Anthropic so it can decide what to do next. For its list of browser tasks we keep each task's site, the address of its last page (without the part after "?") and a small picture of that page.
• Its browser on our server. For the owner and on Vurium AI Pro or Max, when you leave the app in the middle of a task, or a task runs on its schedule, its browser carries on on our server instead: the app hands over the page it was on, its cookies and that site's storage, and the pages load there. Its cookies and site storage are kept encrypted for its next task, for a month after it was last used; Settings, Browser, Clear Its Browser Data deletes them. What it asks you to allow there (a payment, a tap, a password) is kept only until you answer, ten minutes at most.
• Purchases. When you subscribe or buy a credit pack, the App Store's signed record of the transaction: the product, its dates, Apple's transaction identifier and the account token the app attached. Apple takes the payment; we never see your card. Once a pack's credits are added we keep a record that its transaction was credited, so it is never credited twice; when you delete your account, that record stays without anything that says whose it was.
• Your device. A notification token, if you turn notifications on, and your device's time zone, so tasks run at your times.
• Use of your plan. The credits each conversation, task, note pass, image, video and voice message used, what is left of the month's, your credit packs' balance, and how many Quick answers you had each day.
• Reports. A reply you report, with your reason.
• Assistants you connect. If you connect another assistant to Vurium AI (such as Claude, ChatGPT or Muse), its name, the website its sign-in returns to, when you allowed it and when it last asked; a key you make for one is kept only as a one-way hash.
• Payment cards, if you save them. They stay on your iPhone, in its Keychain, and are never stored by us. With each question, the app sends each card's name, brand, last four digits and expiry, so Vurium AI knows which cards it can choose from (we keep these, without the number, so a task knows them too); the AI never receives the number or security code. When it pays, and only after you allow it with Face ID, the app types the card into that payment page; when its browser on our server pays, your iPhone sends that one card to that browser sealed with a key made for that payment alone, which only that browser can open, and the browser types it into the payment page and forgets it within ten minutes. It is never written to storage or logs, and never shown to the AI.
• GitHub, if you connect it. Your GitHub username, name, profile picture and page, how you connected it, and a token that lets Vurium AI use your repositories, kept encrypted and never shown to the AI. When you ask about your code, Vurium AI reads what it needs from GitHub (files, issues, pull requests, commits and CI runs); what it reads becomes part of that conversation. A change it prepares there (an issue, a comment, a file, a merge) is shown to you on a card and made only when you tap Approve.
• Instagram, if you connect it. Its sign-in stays on your iPhone. You connect it by signing in with Facebook and choosing the Facebook Page your Instagram professional account is linked to. Our server exchanges Facebook's one-time code for that Page's token in passing (Meta requires our app's secret for that) and hands the token to the app, which keeps it in your iPhone's Keychain with your Instagram username, name and profile picture and the Page's ID and name; we do not store the token or write it to our logs, and the AI never sees it. When you ask in the app, the app reads your Instagram account's direct messages through that Page (who wrote, what, and when) and sends what it read to our server with your question; it becomes part of that conversation. A reply Vurium AI writes waits as a draft, kept 7 days, and your iPhone sends it to Instagram only when you tap Send. Tasks that run on their own cannot read your Instagram. Disconnecting Instagram, or signing out of Vurium AI, deletes the sign-in from your iPhone.
• Your choices about OpenAI. Whether you allowed OpenAI to check answers, review code, write backup answers and run research agents, and whether it may see code from your private repositories, each with the version of the consent you answered and when.
• Voice messages, if you record them. A voice message you record in Chat goes through our server to OpenAI, which writes it out as text; the words become your message, kept as any other, with the voice message's length. We do not keep the recording or write it to our logs.
• Google, if you connect it. Your Google email address, name and picture, and tokens that let Vurium AI read your Gmail and Google Calendar and send the emails you send, kept encrypted and never shown to the AI. When you ask, Vurium AI reads the emails and events it needs; what it reads becomes part of that conversation. An email it writes waits as a draft, kept 7 days, and goes only when you tap Send. Vurium AI's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements: it is used only to do what you ask, never for advertising, and people do not read it except with your permission, for security, or as the law requires.

We do not collect your contacts, location or advertising identifier, nor any photo or video except those you choose to send it or as its picture. Vurium AI picks photos and videos with Apple's photo picker, which shows it only those you choose; the camera is used only when you take a photo or video for it, and the microphone only when you record a voice message or take a video.

2. How We Use It

• To answer you, run your tasks, notify you, keep your conversations, plans and tasks available to you, and apply your plan.
• To keep Vurium AI safe and working: preventing abuse, reviewing reported replies, fixing problems, and meeting our legal obligations.

We do not sell your personal information, use it for advertising, or train our own models on your conversations.

3. Who Processes It

These services process your information for us, each under its own terms, only as needed for what is described:

• Anthropic, PBC writes the answers (Claude models) and searches and reads the web for them. It receives your question, the conversation so far with the photos and video frames attached to it, what Vurium AI remembers about you and the notes that bear on the question (and, to keep the notes, your conversations), the name and personality you gave it, the pages its browser opened, and what the tools it used returned.
• Runway and Kling AI make the images and videos you ask for, and change or bring to life the photos you ask them to. They receive the description of the image or video, and those photos.
• OpenAI writes out the voice messages you record. It receives the recording and returns its words; under its API terms it does not use them to train its models.
• OpenAI, only if you allow it (the app asks you, and you can change it in Settings, Second Model), is also a second model that checks Vurium AI's work. To check an answer it receives your question, the answer and an excerpt of the sources Vurium AI used (search results and the text of pages it read), with keys and passwords taken out, and may search the web for a claim. To review code Vurium AI wrote it receives what was asked, the change (a diff) and the results of its tests, without being told who wrote it; code from a private repository goes only if you also turn on Code from Private Repositories, which is off until you do. To answer when Claude is unavailable it receives your question and up to the last ten messages of that conversation, and may search the web for it. To research a question Vurium AI hands to its research agents, some of them may run on OpenAI: each receives its task, which Vurium AI writes from your conversation, and what it finds on the web (code from your repositories only with Code from Private Repositories on). It never receives what Vurium AI remembers about you or its notes, your vault, your cards, or what your Gmail, Google Calendar or Instagram show, though an answer it checks may draw on what Vurium AI remembers; and once a conversation has read your email, calendar, Instagram, notes or vault, nothing more from it goes to OpenAI. We send these requests with storage turned off (store: false), so OpenAI does not keep them for later use; it may keep them for up to 30 days in its abuse-monitoring logs, unless it must keep them longer by law or to prevent harm, and under its API terms it does not use them to train its models. If you do not allow it, nothing goes to OpenAI but your voice messages.
• Google Cloud hosts our server and stores what it keeps, in the United States, and runs Vurium AI's browser on our server.
• Apple provides Sign in with Apple, App Store purchases and notifications.
• Google (if you continue with Google) signs you in and tells us who you are: Google's identifier for you, your name and email address.
• Shops you let Vurium AI pay receive the card you allowed, on their payment page, as with any purchase you make there.
• GitHub (if you connect it) answers Vurium AI's reads with your token, and receives the changes you approve; it receives nothing else from Vurium AI. What Vurium AI reads there goes to Anthropic with your question.
• Meta (Facebook and Instagram) (if you connect Instagram) signs you in with Facebook and gives our server, in passing, the token your iPhone keeps; it answers the reads your iPhone makes with it, and receives the replies you send from it with a tap; our server receives only what your iPhone read for your question. Google (if you connect it) answers Vurium AI's reads with your tokens, and receives the emails you send with a tap. What Vurium AI reads there goes to Anthropic with your question.
• Websites and services you ask Vurium AI to use receive what it needs to open a page or make a request you asked for; a vault key goes only to the hosts you allowed for it.

Assistants you connect yourself (in Settings, Integrations) receive Vurium AI's answers to the questions they ask it for you, and those questions and answers are kept in your conversations. They are not our processors: what they do with them is up to their own terms and privacy policies. You can disconnect one there at any time, and it can no longer ask.

4. How Long We Keep It

• Conversations (with the photos and videos sent in them), plans, tasks, memory, notes, what it has learned and the vault: until you delete them, or your account. What it learned from everyone keeps no part of yours once you turn Help Improve Vurium AI off or delete your account.
• What your tasks found: 60 days.
• Drafts of replies and emails: 7 days. Google connections: until you disconnect them, or delete your account. Instagram's sign-in is kept on your iPhone, not by us, until you disconnect it or sign out.
• Assistants you connected: until you disconnect them, or delete your account.
• A photo or video you attached but never sent: one day.
• Its browser's cookies and site storage on our server: a month after it was last used, or until you clear them in Settings.
• Your account, its credits, purchase records and reports, and your choices about OpenAI: until you delete your account (a choice until you change it, and then the new one); a credit pack's record that it was credited, without who bought it, after that.
• What OpenAI found in a check or a code review, a backup answer and what its research agents found: with the conversation they belong to. What was sent to OpenAI for them: up to 30 days in OpenAI's abuse-monitoring logs, unless OpenAI must keep it longer by law or to prevent harm.
• Server logs: up to 30 days.
• Counts of new accounts by internet address (as a hash): two days.

5. Deleting Your Account

In the app, open Settings, tap your account, then Delete Account. Your conversations and the photos and videos in them, plans, tasks, memory and notes, what it has learned, vault, its activity, approvals and browser tasks, its browser's cookies on our server, the name, personality and photo you gave it, the assistants you connected, your GitHub and Google connections (a GitHub or Google sign-in is also signed out there) and Instagram's sign-in on your iPhone, notification tokens, credits (credit packs included), purchase records and reports are deleted for good, what your lessons gave to what Vurium AI learned from everyone is taken back, and Sign in with Apple is disconnected from Vurium AI (an account made with an email and a password is deleted with its password's hash, and the email can be used again; an account made with Google lets go of Google's identifier, and that Google account can make a new one). You can also email support@vurium.com from the address on your account.

Deleting your account does not cancel a Vurium AI Pro or Max subscription, which Apple bills: cancel it in the app (Manage Subscription) or in your iPhone's Settings, under your Apple Account, Subscriptions.

6. Security

Everything travels encrypted (HTTPS). Vault values are encrypted on our server (AES-256-GCM), are shown only after Face ID on your device, and go into a request only on the hosts you allowed; the AI never sees them. Access to our systems is limited to the people who run them. No system is perfectly secure; tell us at support@vurium.com if you think your account has been misused.

7. Your Rights

Depending on where you live, you may ask to see, correct, export or delete your information, or object to how it is used. Residents of the EEA and the UK have these rights under the GDPR; our legal bases are performing our contract with you (the service you asked for), our legitimate interest in keeping it safe, and, for OpenAI's checks, code reviews, backup answers and research agents, your consent, which you can withdraw at any time in Settings, Second Model, without affecting the rest of Vurium AI. California residents have the rights the CCPA gives; we do not sell or share personal information for cross-context behavioral advertising. Write to support@vurium.com; we answer within 30 days. You may also complain to your data protection authority.

8. Children

Vurium AI is not directed to children under 13 (16 in the EEA and the UK), and you must be old enough to agree to its Terms of Use where you live. If you believe a child has given us information, write to support@vurium.com and we will delete it.

9. Where It Is Processed

Our server and its storage are in the United States, and so are most of the services above. Where the law requires it, transfers from the EEA and the UK rely on the European Commission's Standard Contractual Clauses or an equivalent safeguard.

10. Changes

If we change this policy, we update the date above, and tell you in the app before a change that matters takes effect.

11. Contact

Vurium Inc. · 1142 W Lake Cook Rd, Buffalo Grove, IL 60089, United States · support@vurium.com · (847) 630-1884