Privacy Policy

Vexlynk is operated by Vexlynk LLC ("Vexlynk", "we", "us"). This policy explains what Vexlynk collects and stores when you use the website, the web app and the desktop app, including connected accounts, Google user data and the AI assistant.

Want the simple version? Read Your Info Is Secure.

Data We Collect

If you join our waitlist or newsletter, we collect:

  • Waitlist data: email address, selected language, source, signup timestamp, and confirmation status.
  • Forms you send: if you contact support, we keep your name, email and message so we can answer you (see Data Retention).
  • Technical data: basic request information may be processed by hosting, security, analytics, or email delivery systems to keep the service reliable.

Account Data

When you create a Vexlynk account, we collect your email address, authentication status, plan and entitlement state, workspace preferences, and product activity needed to run the service.

We use that data to operate Vexlynk, secure your account, provide support, improve the product, and send you important service notices. This paragraph covers your account data only — Google user data is governed exclusively by the Google section below.

  • How you found us: if you open the Vexlynk web app through a link that carries campaign tags (such as utm_source) or an invite code, we save them with your account once, when you sign up. The campaign tags travel inside the sign-in link itself and are never stored in your browser; an invite code is kept in your browser only until it is applied to your account. If you create your account in the desktop app, we only record that it was created there. We use this to count which of our messages and posts bring people to Vexlynk.
  • Which apps you use: each time you open Vexlynk, we note which app it was (the web app, the Windows or Mac app, or the sign-up screen on a phone) and keep only the first and the latest day you used each one. Nothing about your device is recorded: no model, operating system version, IP address or browser details. We use this to see how Vexlynk is used across web, desktop and phone. It is deleted when you delete your account.
  • Welcome questions: the first time you open Vexlynk on a computer, we may ask four optional questions: how you heard about us, what best describes you, what you are looking for, and which tools you use. We save your answers and whether you answered in the web or the desktop app. You can skip them; if you skip after tapping some answers, we keep only the ones you tapped. We use them to understand who Vexlynk is for and to improve it. They are deleted when you delete your account.
  • Sources you connect: when you connect a source (for example Stripe or YouTube), we record which kind of source it is, when you connected it, whether it was your first, and your plan at that moment, once per kind of source. This includes no data from the source and no details of the connected account. We use it to see which sources people start with. It is deleted when you delete your account.

Google OAuth And Google User Data

When you choose to connect a Google account, Vexlynk requests — through Google's OAuth consent screen — only the narrowest access needed for the feature you enable, and only when you enable it. Most access is read-only; the one write permission (Google Calendar event editing) is requested separately, at the moment you first use event editing — never up-front. Vexlynk also receives your basic Google profile (name and email) to identify the connected account. The Google data Vexlynk can access today is:

  • YouTube data (youtube.readonly): Vexlynk reads, read-only, your channel's title, subscriber count, total views, video count, and your recent uploads' titles and view, like, and comment counts. For competitor and trending features it reads the same kind of public channel and video data for the channels or regions you specify. This is shown to you in Vexlynk and used by your in-app assistant to summarize your channel and content. Vexlynk never posts, modifies, or deletes anything on your YouTube account.
  • YouTube Analytics (yt-analytics.readonly): For your own channel, Vexlynk reads, read-only, your analytics for the date range you choose: views, watch time, average view duration, and subscribers gained and lost. This is shown to you as performance cards and used by your in-app assistant to summarize how your channel is performing.
  • Google Analytics (analytics.readonly): If you connect a Google Analytics account, Vexlynk reads, read-only, the GA4 property reports you choose — sessions, users, and page metrics for the date range you select. This is shown to you as analytics cards and used by your in-app assistant to summarize your site's performance. Vexlynk never changes anything in your Google Analytics account.
  • Gmail (gmail.readonly): If you connect Gmail, Vexlynk reads, read-only, your recent inbox metadata — sender, subject, date, and Gmail's own short snippet — to show an inbox overview card and let your in-app assistant produce a brief of your inbox. Vexlynk never fetches full message bodies or attachments, and never sends, modifies, deletes, or labels email. Replying opens Gmail itself.
  • Google Calendar (calendar.readonly): If you connect Google Calendar, Vexlynk reads, read-only, your upcoming events — titles, times, and attendees — to display them in calendar cards on your workspace and let your in-app assistant summarize your schedule.
  • Google Calendar event editing (calendar.events): Only if you use event editing in the Calendar Sync card does Vexlynk ask for this additional permission, at that moment — never up-front. It is used solely to create, update, or delete the specific events you act on in Vexlynk, mirrored to your own Google Calendar. If you never edit events, this permission is never requested.
  • Google Business Profile (business.manage): If you connect a Google Business Profile, Vexlynk reads your business locations, ratings, and reviews to display them in your workspace. Google offers no read-only permission for this data, so its management scope is required — but Vexlynk uses it strictly read-only and never edits, posts to, or deletes anything on your Business Profile.
  • Access: Vexlynk can access this data while a Google connection exists. To end it, use Settings → Connected accounts → Disconnect: that revokes access at Google and deletes the tokens from our servers. Removing a single Google source keeps the connection, because your other Google sources use it.
  • Use: Vexlynk uses Google data only to provide the features you enable — displaying it in your workspace and letting your in-app assistant summarize it for you — and for the security of that connection. Vexlynk does not use Google data for advertising, does not sell it, and never uses it to train AI or machine-learning models. When you use the hosted assistant, Google data on your board is sent through our server to our AI provider, OpenAI, to write the answer. Under OpenAI's API terms, it isn't used to train their models.
  • Storage: Google connection tokens are stored on our server, encrypted with a separate key for each account, for both desktop and web users. Google data shown on your cards is stored with your boards: always on the web app, and on desktop only if Sync is on (we keep the last 10 versions). It is also stored in your saved assistant chats when the assistant discusses it.
  • Sharing: Vexlynk does not sell Google user data. We do not share it except as needed to provide the service, comply with law, protect users, or follow your direction. This includes our AI provider (OpenAI) when you use the hosted assistant, and our database provider (Supabase).
  • Compliance: Vexlynk's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Google user data is used solely to provide and improve Vexlynk's user-facing features — displaying your own YouTube, Google Analytics, Gmail, Calendar and Business Profile data in your workspace, and letting the assistant summarize it when you ask. It is not used for advertising, not sold, not shared except as required to provide these features or comply with law, and never used to train AI or machine-learning models.

Social Accounts You Connect

If you choose to connect a social account (an Instagram Business or Creator account, a Facebook Page, or a TikTok account), you authorize the connection on that platform's own consent screen. Vexlynk then retrieves read-only analytics for the account you connected: account identifiers, public profile details (such as your username and display name), follower counts, reach, engagement, and post-performance metrics. Vexlynk reads this data to show it to you; it never posts, uploads, or publishes to your accounts.

These connections are managed through Zernio, our social-integrations service provider. Zernio maintains the platform connection on our behalf and processes your social account identifiers and analytics metrics so Vexlynk can retrieve them. Zernio processes this data only to provide the integration. The data passes through Vexlynk's servers, and we store snapshots of the numbers.

Note on TikTok: TikTok's authorization bundles posting permissions together with read access and cannot be requested separately. Vexlynk only ever reads analytics — the code is built so that posting is not possible.

We keep a history of your account's metric totals while the account stays connected, so trends can be shown over time. Disconnecting an account removes the connection at the provider and deletes that account's metric history from our servers. Deleting your Vexlynk account removes all of your social connections and the associated provider-side records. Numbers already shown on your cards stay there until you delete those cards.

How We Use Data

  • To run your Vexlynk account and send you service updates and, if you agree, product news.
  • To provide, secure, maintain, and improve Vexlynk. Google user data is excluded from every general purpose in this section — it is used only as described in the Google section above.
  • To support account access, product workflows, and the integrations you choose to enable.
  • To prevent abuse, investigate issues, and comply with legal obligations.

Analytics

Vexlynk may use privacy-conscious analytics, including Google Analytics, to understand how the public launch pages are used and how our website forms perform.

Analytics may help us understand page visits, general traffic sources, approximate geographic region, sign-up conversion, language preference, and site performance.

  • No email addresses: Vexlynk does not send email addresses from our forms to analytics.
  • No verification tokens: Vexlynk does not send Turnstile tokens or raw form payloads to analytics.
  • No sale of personal data: Vexlynk does not sell personal data.

Cookies And Download Counts

The public website, vexlynk.app, uses a small number of cookies and similar browser storage. Each one is listed below.

Google Analytics and the attribution cookie are used only if you accept “Analytics and attribution” in the cookie banner; until then neither is loaded. You can change your choice at any time with “Cookie settings” at the bottom of the page, and we ask again after 13 months. Your language preference and the security checks on forms don't need consent.

  • Attribution cookie (vx_attr): only if you accept. It is kept for 90 days, with a copy in your browser's local storage, and holds a random identifier, the first and the latest page you visited on vexlynk.app, the campaign tags in the link that brought you (UTM tags or a referral code), and the site that referred you. It can be read by vexlynk.app and workspace.vexlynk.app. We use it to count which pages lead to downloads, sign-ups and upgrades. Rejecting deletes it.
  • Download and upgrade counts: when you click a download button, or reach the page shown after an upgrade, the website sends that event to our servers with the page it happened on and, for downloads, which installer the button was for (Windows or Mac). This count uses no cookie and no identifier. If you accepted analytics and attribution, the attribution details above are included too. It never includes your name or email address. If you create an account, any attribution details are saved with the account once, at sign-up.
  • Google Analytics cookies: set by Google Analytics only if you accept, as described in Analytics above.
  • Your cookie choice: kept in your browser's local storage so the banner doesn't ask again on every page.
  • Language preference: the language you choose is kept in your browser's local storage so pages open in it.
  • Security checks: sign-up and newsletter forms use Cloudflare Turnstile, as described in Security Verification.

Security Verification

Vexlynk uses Cloudflare Turnstile, a security check from Cloudflare, Inc., on the sign-up, sign-in, newsletter and support forms to reduce automated abuse. To do this, Cloudflare receives technical information from your browser, such as your IP address and browser details. Because it protects these forms, it runs without asking for cookie consent.

Turnstile may run in invisible mode, which means verification can happen silently without a visible challenge or widget on screen.

  • Cloudflare Turnstile: Turnstile verification is processed by Cloudflare, and Vexlynk references Cloudflare's Turnstile Privacy Addendum for that processing.
  • Purpose: Vexlynk uses Turnstile for bot prevention, abuse protection, and form security.
  • No analytics sharing: Vexlynk does not send Turnstile tokens to analytics or marketing systems.

Where Your Data Is Stored

Desktop app — your machine first. Boards, card content, agent memory, source outputs and diagnostics are stored in a local database on your own computer. Free has no cloud sync between the desktop app and the web app; on desktop, Sync is off by default and is a paid feature. With Sync off, your boards are not stored in our cloud. They still leave your device when you use the hosted AI, including the automatic Morning Brief: the request goes through our server to OpenAI. Links you ask Vexlynk to read and web searches you ask for always go through our server, even with Sync off and your own AI key. Even with Sync off, the cloud holds: your account and plan; AI usage counts; your Google, Microsoft, Trello and ClickUp connection tokens (the desktop app asks our server for a short-lived Google key each time it refreshes); an encrypted copy of the API keys of sources you connect (made when you sign in, whether Sync is on or off); snapshots of your social-account numbers; which app you used and when, your welcome-question answers and how you found us; and crash reports (with card content removed where possible).

When you turn sync on, snapshots of your boards are stored in our Supabase project under access rules that allow only your own account to read them. Before a snapshot is uploaded it is stripped of secrets, API keys and absolute file paths; the contents of files on your computer are never uploaded. Snapshots include the full text of your cards and what your sources fetched (for example revenue figures, email previews and calendar events). We keep the last 10 versions. Your assistant chats and memory are stored too.

Web app (workspace.vexlynk.app) — always in the cloud. The web version has no local storage mode. Your boards are stored in our Supabase project from the moment you create them, on every plan including Free (Free includes one workspace), and the desktop sync setting does not apply. Your assistant chats and the last 10 versions of each board are stored in the cloud too. If you want your data to stay on your own machine, use the desktop app with Sync switched off.

  • Security controls: We use server-side secrets, access restrictions, row-level access rules, input validation and abuse protection. No system can be guaranteed perfectly secure, but we design Vexlynk to limit what any single failure can expose.
  • Limits we want you to know about: Cloud snapshots are encrypted in transit and at rest by our hosting provider, but they are not additionally encrypted with a key that only you hold — which means we are technically able to access them. Access is restricted to the service systems that operate Vexlynk. Deleting a board on your own device does not by itself remove snapshots already stored in the cloud; deleting your cloud data or your account does.

Sharing And Service Providers

Vexlynk may use trusted service providers for hosting, database storage, email delivery, security, analytics, and product operations. These providers process data only as needed to support Vexlynk.

For social sources, account connections and analytics retrieval are processed by Zernio (social-integrations provider) — see “Social Accounts You Connect” above.

We do not sell personal data or Google user data.

Data Deletion Requests

You can delete your data yourself, at any time, from Settings → Account → Manage my data. No email or support request is needed.

  • Clear local data (desktop app): Removes the workspace stored on your computer — boards, media, documents and cached voice models. Your cloud data is unaffected and re-syncs the next time you sign in, and you stay signed in.
  • Delete cloud data: Removes your cloud boards and their versions, assistant chats, Operator Records, connected-account tokens and stored API keys, cloud refresh jobs, hosted-AI usage records and idea votes, and disconnects your social accounts. To also revoke access at Google, use Settings → Connected accounts → Disconnect first. It keeps your account, plan, usage counts, sign-up and survey records, your photo and uploaded images; delete your account to remove those. Data on your own device is untouched.
  • Delete my account: Permanently deletes your account, cloud boards and their versions, assistant chats, connection tokens and keys, social connections, uploaded images, usage and survey records, your photo and your email-list contact, and cancels your paid plan. On the desktop app it also clears the workspace stored on your computer. When you delete your account, we keep your email and whether you used a trial, so the same email can't get a free trial twice. If you want this record erased too, write to us and we'll remove it. Some records are kept or anonymized (see Data Retention). This cannot be undone.
  • Disconnecting one account: Settings → Connected accounts → Disconnect revokes the connection and deletes the tokens we hold. Removing a single Google source keeps the Google connection, because your other Google sources use it; Vexlynk tells you when that happens. Data already on your cards stays until you delete those cards.
  • Kept after you delete your account: your email and whether you used a trial (permanently, unless you ask us to erase it), messages you sent to support (your email and message stay; the link to your account is removed), ideas you posted (anonymized), security audit events (deleted after 90 days), visit and attribution events (deleted after 13 months), and waitlist, newsletter and docs-feedback entries (kept by email; ask us to remove them). We may also need to retain limited information where required for security, legal compliance or fraud prevention.
  • For anything else — including waitlist entries — email support@vexlynk.app from the address associated with your request.

Data Retention

  • Waitlist entries: kept until you unsubscribe or ask us to remove them.
  • Account and entitlement records: kept while your account is active, and removed when you delete your account.
  • Hosted-AI usage: kept as monthly totals used for billing and plan limits, and removed when you delete your account.
  • Cloud board snapshots: up to the last 10 versions of each synced or web board are kept until you delete your cloud data or your account.
  • Security and audit records: kept for security and legal purposes; the identity attached to them is removed when you delete your account.
  • Logs and crash reports: logs on your device are size-capped, rotated and not uploaded. Crash reports go to our error-monitoring provider (Sentry), with card content removed where possible.
  • Attribution data: the cookie expires after 90 days. The download, sign-up and upgrade events we receive are deleted automatically 13 months after they happen.
  • Assistant chats: kept with your boards until you delete your cloud data or your account.
  • Google Alerts items fetched in the cloud: 30 days.
  • Social-account number snapshots: until you disconnect that account or delete your account.
  • Uploaded images: until you delete the card, your cloud data or your account.
  • App usage, welcome answers, sign-up and source-connection records: until you delete your account.
  • Deleted-account record: when you delete your account, we keep your email and whether you used a trial, so the same email can't get a free trial twice. If you want this record erased too, write to us and we'll remove it.

Children's Privacy

Vexlynk is not intended for anyone under 18, and you must be at least 18 to create an account (see our Terms of Service). We do not knowingly collect personal information from children. If we learn that an account belongs to someone under 18, we delete the account and its data. If you believe a child has given us personal information, contact us at support@vexlynk.app and we will remove it.

Changes To This Policy

We may update this Privacy Policy as Vexlynk evolves. The effective date above will change when material updates are made.