Vasculum privacy policy

Version 1, 14 November 2026

Vasculum is a personal library of saved pages, notes, images and files. This policy covers this Vasculum server, its web app, its Android app and the Vasculum Chrome extension. The server is run by its operator, who answers at the address shown in the app's Settings.

This is a translation of the Vietnamese text, which prevails where the two differ.

What is kept

• Your account: your email, a hash of your password, and the sign-in provider you linked.
• What you save: addresses, notes, files, pictures, and the text, previews, cover pictures and transcripts the server reads from them. A video is not kept: its sound is fetched only to be transcribed and is deleted once it is.
• What the AI writes for your items: summaries, clean text, keywords and picture descriptions, and the questions you ask with their answers.
• Which version of this policy you accepted, and when.

Your library is shown only to your signed-in account. There are no advertisements, no analytics and no tracking, and nothing is sold.

Who else processes it

• Anthropic (United States), only while the AI is on for your account: your items' text and pictures, and your questions, are sent to Claude to write the summaries and answers. Anthropic keeps them for up to 30 days, longer for content it flags for safety. The operator can turn the AI off for your account.
• Speech in videos is transcribed on this server itself; it is sent to no one.
• Resend (United States) delivers the mail that verifies your address or sets your password: it receives your email address and that message.
• Cloudflare carries the connection to the server. Google, GitHub or Facebook receive your sign-in only if you choose to sign in with them. From them the server keeps only their account number for you and the email they show.

To read a saved address, the server fetches that page once from its own site.

Taking your data with you

Settings, Export library, downloads one ZIP of your library: every item with its note, Folders, highlights, AI summary and text, a bookmark file any browser imports, and the files you uploaded or the server kept. Only you can export your own account.

Deleting your data

Settings, Delete account, removes your account and everything it held at once: library, files, AI output, questions, sessions and devices. Backups of the server keep a copy for up to 30 days, then it is gone. Items you delete from Trash are removed the same way. To ask what is kept about you, or for a correction, write to the operator; you get an answer within two working days.

Removing the app from your Facebook settings unlinks Facebook from your account at once and keeps nothing from Facebook; the account and its library stay until you delete them as above. The same goes for Unlink in Settings, for any provider. If Facebook was your only way to sign in, continue with Google or GitHub under the same verified address, or write to the operator; then link Facebook again in Settings.

The browser extension

The extension reads a page only when you ask it to save something: the tab's address, title and selected text from the toolbar button, or the page, link, image or selection you chose from the right-click menu. It never reads pages in the background, your history or other tabs. Saves not yet delivered stay in its local storage; removing the extension deletes them.

What the web app keeps in your browser

The web app keeps a copy of what it last showed, and the browser caches what it loaded, so it opens at once. Signing out deletes both; a copy older than 30 days is never shown.

Changes

When this policy changes, its version goes up and the app asks you to accept it again at your next sign-in.