Privacy

When you continue with email, we use your email address to deliver a verification link. We create an account only after that address is verified. The same account can hold no paid licence, Personal, Pro, owned Team, or an assigned Team membership. Free does not use this account.

We keep the verified email; an optional display name supplied for a Team member; customer, licence and key identifiers; plan and licence status; Team roles; device labels, operating-system metadata, activation status, and activation generation; and paid transaction, invoice, and update-entitlement state needed to reconcile Paddle purchases. Raw card details are handled by Paddle and are not received by Varc.

A device activation sends a SHA-256 device fingerprint to the licensing service so device limits and deactivation work. The app does not send that fingerprint to analytics. Device allowances are defined by the paid plan.

Activate in VARC uses a random one-time handoff that expires after five minutes. The service stores only its hash, consumes it atomically, and never places a raw licence key, customer id, device id, or trusted plan in the app URL. The raw key is returned only over HTTPS to native app code when the handoff is redeemed.

The License Manager keeps a permanent activity history of significant licence, device, Team, seat, billing, and CLI-token changes. Events include the acting and affected email address, an optional display-name snapshot, the licence involved, the time, and a small allowlisted description. Routine licence verification and refresh traffic is not recorded. Raw licence keys, CLI tokens, invitation tokens, handoff codes, checkout URLs, and complete callback URLs are never stored in this activity history.

Pages load an analytics script that records page views, clicks, the page you arrived from, approximate location derived from your IP address, and your browser and device type. It sets cookies so a returning visitor is recognised as the same person.

Those requests go to e.varc.dev, which is our own server, and are forwarded from there to PostHog. We use our own domain so that content blockers do not silently discard the measurements — not to track you in any way this page does not describe.

The License Manager is a separate application at license.varc.dev. It does not bundle or initialise the analytics client, and its responses are marked non-indexable and non-cacheable. Legacy /dashboard links redirect there without starting analytics.

Signing in to the licence dashboard also sets a __Host-varc_sessioncookie. That one is strictly necessary for signing in and is not analytics.

Varc sends anonymous product-usage events so we can see which features are used and where people get stuck. This analytics channel is separate from the optional AI assistant described below.

What is sent:

• App version, build number, release channel, operating system, architecture and interface language
• Which window kinds you open, and which UI controls you activate — identified by an internal element path and a translation key, never by their on-screen text
• Which commands you invoke (by their internal command id)
• The shape of a connection: standalone, cluster or sentinel; whether TLS is on; whether the server is Redis or Valkey, and its major version
• Which features you enter, and which settings you change — the setting's name, and its value only when that value is a true/false or a fixed choice
• Licence state, and the category of any error surfaced to you

What is never sent:

• Key names, key values, or any data stored in your databases
• Commands you run, or their results
• Script source or output, and before-images captured for rewind
• Connection names, hostnames, ports, database numbers or credentials
• Environment variables, file contents, or screenshots

This is enforced in code, not by convention: an event property must be a true/false value, a number, or a short identifier-shaped string, and anything else is discarded before it leaves your machine.

When you submit a message to the optional AI assistant, Varc sends that message and a bounded snapshot of the current Console command, script, dashboard, or widget to our API. Cloudflare Workers AI processes that material to generate the reply. Nothing is sent merely because an AI button is visible or the assistant is open.

The snapshot is the text you are working on, sent as you wrote it: the Console command in the editor, the script source, or the scripts and titles of the widgets on the dashboard. If you have typed a key name, a value, or a password into that text — SET session:abc …,CONFIG SET requirepass … — it goes with it. Alongside it we send the deployment type, the logical database number, the names of the commands your server supports, local parse diagnostics, and the public scripting API description.

What is never sent is everything Varc read on your behalf: the connection details and credentials in your OS keychain, environment-variable values, command results, script output, transformer samples, and widget results or chart history. The assistant sees what you typed, never what your server answered.

Varc does not write prompts, source context, or replies to D1, logs, analytics, exception payloads, or traces. We retain only content-free usage records such as a hashed licence or Team subject, UTC month, request count, surface, status, latency, model id, and aggregate token usage. Conversations remain in app memory and are cleared when you close the assistant or workspace, quit Varc, or disable AI features.

You can turn the feature off under Settings → AI assistant. This removes every AI trigger, cancels current client waits, closes the assistant, and clears its in-memory conversations.

On first launch the app generates a random identifier and stores it on your device. It is not derived from your hardware and is not shared with anything else.

On the first successful licence activation, future events are attributed instead to a one-way hash of your licence key.This links the machines that share one licence into a single profile.It cannot be reversed to your licence key, and analytics never carry the key itself, your email address, or a hardware identifier. A team licence gives each member their own key, so team members are distinct people here, not one shared profile.

In the app, open Settings → Diagnostics and switch offSend anonymous usage analytics. It takes effect after a restart. Crash reporting is a separate switch in the same place.

Separately from analytics, the app can send classified application diagnostics to Sentry: Rust stack traces, debug-image metadata and release/build information. Varc does not admit database contents, commands, connection details, credentials, scripts, environment variables, screenshots or local logs to that remote schema. Varc's Sentry projects are required to discard source IP addresses rather than retain or enrich them.

If you are in the UK or EU you can ask what we hold about you, ask for it to be deleted, or object to processing. Write to hello@varc.dev.

Varc is operated by [legal entity name and registered address to be added].