Privacy Policy (application)

2026-06-12

Vardoger Inc. Last updated: 2026-06-29

Vardoger Inc. ("Vardoger," "we," "us") is a Delaware corporation with its registered office at 131 Continental Dr, Suite 305, Newark, DE 19713, USA. We publish the Vardoger desktop application (the "Application") and operate the website at vardoger.app (the "Website").

This policy describes what information we collect, why, and what we do with it, in two contexts: purchasing a license and using the Application. Data handling for the Website itself is described in the separate Website Privacy Notice. Capitalized terms not defined here have the meanings given in our Terms of Use and End User License Agreement.

1. The Short Version

• Your files never touch our servers. The Application transfers your file data directly between your device and your own cloud storage provider. This is an architectural property of the software, not a policy promise: Vardoger operates no servers in the file transfer or storage path.
• Your cloud credentials never touch our servers. Sign-in to your cloud provider happens directly between the Application on your device and the provider, using OAuth 2.0 with PKCE. Access and refresh tokens are stored in your operating system's keychain on your device. No authorization code, token, or password ever transits Vardoger infrastructure.
• Purchases are processed by Lemon Squeezy, our merchant of record. We never see your payment card details.
• The Application contacts our license server with your license key and non-reversible cryptographic hashes of connected cloud account identifiers — never the identifiers themselves, never your name or email.
• We do not sell personal information, we do not show advertising, and we do not use third-party advertising or tracking networks.

2. When You Purchase a License

Purchases are processed by Lemon Squeezy, LLC acting as merchant of record. This means Lemon Squeezy — not Vardoger — is the seller for payment purposes: it collects your payment details, billing information, and applicable taxes under its own terms and privacy policy.

What this means in practice:

• We never receive or store your payment card or banking details. Those go to Lemon Squeezy and its payment processors only.
• We can access order records in Lemon Squeezy — your name, email address, country, order details, and license key — which we use for license management, customer support, fraud prevention, and legal compliance.
• Lemon Squeezy emails you your license key and receipt.

We retain order records for as long as needed for support, accounting, and legal obligations (typically the statutory record-keeping period applicable to the transaction).

3. When You Use the Application

The Application is local-first software. The data flows below are the complete list of network communications between the Application and Vardoger-operated infrastructure.

3.1 What we never collect

The following never transits and is never stored on Vardoger infrastructure:

• The contents of your files
• Your file or folder names
• Your cloud storage credentials, passwords, OAuth tokens, or authorization codes
• Your cloud account email addresses or usernames
• Your name or email address (the Application does not know who you are)

3.2 License validation and account-slot registry

To enforce the license terms (each license permits up to four connected cloud accounts), the Application periodically contacts our license registry service, hosted on Cloudflare Workers. Each request contains:

• Your license key (validated against Lemon Squeezy's license API; stored on our infrastructure only as a non-reversible SHA-256 hash)
• A non-reversible cryptographic hash of a stable identifier for each connected cloud account. The original identifier is used on your device to compute the hash and is never transmitted. The hash cannot be reversed to reveal which account, which provider, or which person it represents.
• The Application version and provider type (e.g., "google_drive"), used to enforce slot rules and for compatibility
• Request timestamps and signatures used to authenticate the request

The registry stores no names, no email addresses, no IP-address logs, and no identifiers that can be linked to you or your cloud accounts. Per-license records persist while your license is in use. You may request deletion of your registry record at any time (see Section 8); removing all connected accounts from the Application also releases the associated slots.

The Application tolerates being offline: it does not require a connection to our registry for day-to-day operation, subject to a periodic revalidation grace period described in the EULA.

3.3 Updates

Updates are delivered through your operating system's package manager from our signed APT (Debian/Ubuntu) and DNF (Fedora) repositories, and on Windows via a signed installer. These mechanisms send no license key and no personal identifier to Vardoger — your package manager fetches the latest signed package the same way it does for any other software.

3.4 Your cloud storage providers

When you connect a cloud account, the Application communicates directly with that provider's API or server (Google Drive, Microsoft OneDrive, Dropbox, or your own SFTP/WebDAV server) from your device. Your relationship with that provider is governed by its own terms and privacy policy. Vardoger is not a party to that data flow.

Google API Services — Limited Use disclosure. Vardoger's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In plain terms: data the Application accesses via the Google Drive API is used solely to provide the file synchronization features you initiate, is processed on your device, is never transferred to Vardoger or any third party (except as you direct, e.g., to your own storage), is never used for advertising, and is never read by humans except with your explicit consent for support, for security purposes, or as required by law.

The same principles apply to data accessed via the Microsoft Graph and Dropbox APIs and to data on servers you connect via SFTP or WebDAV.

4. Service Providers (Sub-processors)

We use a small number of service providers, each with a signed data processing agreement where personal data is involved:

Your cloud storage providers (Google, Microsoft, Dropbox, the operators of any SFTP/WebDAV server you connect, etc.) are not our sub-processors — they are services you contract with directly.

5. Legal Bases for Processing (GDPR/UK GDPR)

Where the GDPR applies, we process personal data on the following bases: performance of a contract (order records, license validation, support); legitimate interests (fraud and abuse prevention, securing our services); and legal obligation (tax and accounting records).

6. International Transfers

Vardoger Inc. is a US company. Order records are processed by Lemon Squeezy (US) and correspondence by Fastmail (Australia/US infrastructure). Where personal data of EEA, UK, or Swiss residents is transferred internationally, transfers rely on appropriate safeguards such as Standard Contractual Clauses entered into through our providers' data processing agreements.

7. Data Retention

8. Your Rights

Depending on where you live (including the EEA/UK under GDPR, Canada under PIPEDA and Quebec's Law 25, and various US states), you may have the right to access, correct, delete, or receive a copy of your personal data, to object to or restrict certain processing, to withdraw consent, and to lodge a complaint with a supervisory authority.

To exercise any of these rights, contact us at privacy@vardoger.app. For registry records, we will delete the record associated with your license key on request. For order data held by Lemon Squeezy as merchant of record, we will coordinate the request with them, and you may also contact Lemon Squeezy directly. We will respond within the timeframe required by applicable law. We do not discriminate against you for exercising your rights.

9. Children

The Application is not directed at children, and we do not knowingly collect personal information from anyone under the age of 16. If you believe a child under 16 has provided us with personal information, contact us at privacy@vardoger.app and we will delete it.

10. Security

We protect the limited data we handle through, among other measures: TLS for all network communication; storage of credentials in your operating system's keychain rather than on disk in plaintext; one-way cryptographic hashing of all identifiers stored in our license registry; request signing and rate limiting on our services; hardware-key-protected administrative accounts; and signed software releases. No method of transmission or storage is perfectly secure, but our primary security measure is structural: the most sensitive data — your files and your cloud credentials — is never in our possession to begin with.

11. Changes to This Policy

We may update this policy from time to time. We will post the updated version at this URL with a revised "Last updated" date, and for material changes affecting Application data flows we will provide notice through the Application or by email where we have it. Changes are effective when posted.

12. Contact

Vardoger Inc. 131 Continental Dr, Suite 305 Newark, DE 19713, USA privacy@vardoger.app (privacy inquiries) legal@vardoger.app (legal notices)