Privacy Policy

1. Who we are

Vincentt ("Vincentt", "we", "us") provides the tools, hosting, and account services available at vincentt.studio and its subdomains, together with projects published to vincentt.app. For the purposes of the UK GDPR and EU GDPR, Vincentt is the data controller for the account information described in this policy.

For privacy questions, contact us at waing@vincentt.studio.

2. Information we collect

We collect a deliberately small amount of information. There are three sources.

Information you give us

Data	Why we hold it
Email address	It identifies your account, is how you sign in, and is how we send invites, password resets, and security notices.
Display name	Shown to you and to other members of any organization you join.
Password	Only if you choose password sign-in. We never store the password itself, only an `argon2id` hash of it.
Avatar URL	Optional. Only if you supply one. We do not import a photo from Google.
Theme preference	Remembers whether you prefer the light, dark, or system interface.
Organization and project names	The content you create. Project names include the address your project is published at.

Information created by using the service

Session and access tokens. When you sign in we store a hashed session record and set a secure, HttpOnly cookie. If you use our command line tools, we store a hashed personal access token. We never store the token values themselves, only hashes of them.
Organization membership. Which organizations you belong to and your role in each.
Invitations. If you invite someone, we store the email address you entered, who sent the invitation, and when. This means we may briefly hold the email address of a person who has no account with us. Invitations expire and are automatically deleted after 72 hours.
Service logs. We log the fact that a request happened: a random request identifier, the route, the response status, and where applicable the account, organization, or project identifier involved. Email addresses appearing in logs are masked (for example a***@example.com).

Information used only in memory

We derive your IP address from incoming requests and use it solely as a rate-limiting key, to prevent brute-force sign-in attempts and abuse. It is held in server memory, is never written to our database or to a log line, and is discarded when the service restarts.

3. What we do not collect

This section is as important as the one above. We do not:

use analytics, advertising, or behavioural tracking services of any kind;
set advertising or tracking cookies. The only cookies we set are the ones needed to keep you signed in and to complete a sign-in flow securely;
store your IP address or browser user-agent in our database or logs;
collect payment, financial, phone, address, or date-of-birth information;
sell or rent your personal information to anyone, for any purpose;
use your personal information or your project content to train machine learning models.

On cookies. Because we set no analytics or advertising cookies, you will not see a cookie consent banner. The cookies we do use are strictly necessary for the service to function and cannot be turned off while signed in.

4. Signing in with Google

If you choose to sign in with Google, we ask Google for three standard scopes: openid, email, and profile. These are Google's basic sign-in scopes. We do not request access to your Gmail, Drive, Calendar, Contacts, or any other Google service, and we could not access them if we tried.

From the identity token Google returns, we keep only:

your Google account identifier, so we can recognise you on your next sign-in;
your email address;
your name;
whether Google has verified your email address.

We do not store your Google profile photo, and we never receive or store a Google access token or refresh token. The identity token is verified at sign-in and discarded. You can disconnect Google from your Vincentt account at any time in your account settings, provided you have another way to sign in.

Vincentt's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

5. How we use your information

We use the information described above only to:

create and operate your account and keep you signed in;
let you create organizations, invite collaborators, and manage projects;
publish your projects and serve them to the people you share them with;
send you service email: invitations, password resets, and notices when your password changes. We do not send marketing email to accounts;
protect the service against abuse, brute-force attempts, and fraud;
diagnose faults and keep the platform reliable;
comply with legal obligations.

Where the UK or EU GDPR applies, our lawful bases are performance of a contract (operating the account and service you asked for), legitimate interests (securing the platform and preventing abuse), consent (where you opt in, such as joining the early-access list), and legal obligation where applicable.

We do not sell your information. We share it only with the service providers needed to run the platform, and only to the extent each one needs:

Provider	Purpose	What it receives
Amazon Web Services	Hosting, storage, database, and content delivery	Your account, organization, and project records, and your published project files
Resend	Sending service email	The recipient address and the message content
Google	Sign in with Google, if you use it	The sign-in request itself. Google necessarily learns you are signing in to Vincentt
Cloudflare	DNS and network protection	Network-level request metadata

Other members of an organization you join can see your name and email address. That is how collaboration works, and it is worth knowing before you accept an invitation.

We may disclose information if legally required to do so, or to protect the rights, safety, or property of Vincentt or others. If Vincentt is involved in a merger, acquisition, or sale of assets, your information may transfer as part of that transaction, and we will give notice before it becomes subject to a different policy.

A note on our email. The HTML emails we send load a web font from Google Fonts. If your mail client displays remote content, this discloses your IP address to Google when you open the message. Most mail clients block remote content by default. We mention it because it is a real data flow and you should know it exists.

7. Projects you publish

When you publish a project, its files are uploaded and served from a public web address, typically yourproject.vincentt.app. Anyone with the address can view a published project. There is no access control on published projects. Do not publish anything you are not comfortable making public, and do not embed personal information or secrets in a project you publish.

You are responsible for the content of your projects, including anything they collect from the people who view them. If your project gathers information from its visitors, you are the controller of that information and you are responsible for telling those visitors about it.

Published projects run in your visitor's browser. Augmented reality features such as camera-based tracking process the camera feed on the visitor's own device. Vincentt does not receive, store, or transmit camera imagery.

8. How long we keep information

Data	Retention
Account record	Kept while your account exists
Sessions	Expire after 30 days at the latest, then deleted automatically
Access tokens	Kept until you revoke or replace them
Pending invitations	72 hours, then deleted automatically
Password reset links	Short-lived and single use, then deleted automatically
Sign-in attempt counters	Kept briefly to rate limit sign-in. We store a hash of the email address, not the address
Project addresses	Retained after a project is deleted, so an address is not silently reassigned to someone else
Service logs	Retained for a limited operational period

Deleting a project or leaving an organization removes the associated records. The published address of a deleted project is retained deliberately, so that a link someone shared previously cannot be taken over by an unrelated project.

9. How we protect information

All traffic is encrypted in transit using TLS.
Passwords are hashed with argon2id using parameters at or above current OWASP guidance. We cannot recover your password, and neither can anyone who obtains our database.
Session and access tokens are stored only as hashes.
Session cookies are HttpOnly, Secure, and SameSite=Lax, so they are not readable by scripts and are not sent from other sites.
State-changing requests are protected against cross-site request forgery.
Sign-in and password-reset endpoints are rate limited.
Access to production systems is limited to those who need it.

No system is perfectly secure. If we become aware of a breach affecting your personal information, we will notify you and the relevant regulator where the law requires it.

10. Your rights and choices

Depending on where you live, you may have the right to access, correct, delete, export, or restrict the processing of your personal information, to object to processing, and to withdraw consent. Residents of the EEA and UK have these rights under the GDPR. California residents have comparable rights under the CCPA, including the right not to be discriminated against for exercising them. We do not sell or share personal information as those terms are defined under the CCPA.

You can act on some of these directly in the product:

update your name, avatar, and theme in account settings;
change your password, or connect and disconnect Google sign-in;
sign out of all devices, which revokes every active session;
cancel a pending invitation you sent;
delete your projects and organizations.

Account deletion. Vincentt does not yet have a self-service "delete my account" button. Until it does, email waing@vincentt.studio and we will delete your account and associated personal information manually. We will respond within 30 days. We would rather tell you this plainly than imply a button exists.

To make any other request, contact us at waing@vincentt.studio. We may need to verify your identity first. If you are in the EEA or UK and are unhappy with our response, you have the right to complain to your local data protection authority.

11. International transfers

Vincentt operates internationally and our service providers are located in several countries, including the United States. If you access the service from outside the country where our infrastructure is hosted, your information will be transferred across borders. Where we transfer personal information out of the EEA or UK, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses.

12. Children

Vincentt is not directed at children and is not intended for anyone under 13, or under 16 in the EEA and UK. We do not knowingly collect personal information from children. If you believe a child has given us personal information, contact us and we will delete it.

13. Changes to this policy

We may update this policy as the product changes. When we do, we will revise the "last updated" date above. For changes that materially affect your rights or how we handle your information, we will give notice by email or in the product before the change takes effect.

14. Contact us

Questions, requests, or complaints about this policy or your personal information: waing@vincentt.studio.