Privacy Policy
Last updated: August 2026
What we collect
We collect the email address and display name you provide when creating an account. Payment processing is handled by Stripe — we do not store card details.
How we use it
Your email is used to manage your account, send transactional emails (receipts, password resets), and — if you opted in — product update emails. We use personal data for account management and to provide the features you use — not for advertising or profiling. We do not sell your data to third parties.
Cookies
The web app uses a session cookie to keep you signed in. The landing page sets no tracking cookies. We plan to add analytics (Google Analytics / Microsoft Clarity) with a consent prompt before activating them.
How we protect your data
We apply the following safeguards to all personal data we hold, including sensitive data such as authentication credentials and any account you connect to VirtTerm:
- Encryption in transit. All traffic between VirtTerm apps and our servers is encrypted with HTTPS/TLS 1.2 or higher.
- Encryption at rest. Data held on our servers is stored on encrypted disks, on a private network that is not directly reachable from the internet.
- Credentials. Sign-in is handled by Google Firebase Authentication — we never see or store your password. Card details are held by Stripe, never by us.
- Connected accounts stay on your device. Access tokens for accounts you connect in the desktop app (Google, Microsoft 365, IMAP mail) are stored only on your own device, encrypted using your operating system's secure credential store. They are not transmitted to or stored on our servers.
- On-device vault. Passwords, keys and notes you save in the app's vault are encrypted on your device with AES-256-GCM using a key derived from your PIN. We cannot read them.
- Access control. Access to production systems and data is restricted to authorised personnel on a least-privilege basis, protected by multi-factor authentication. Application secrets are held in a dedicated secrets manager, never in source code or app binaries.
- Monitoring and incident response. We keep system and access logs, and review them for unusual activity. If a breach affecting your personal data occurs, we will notify affected users and the relevant regulator without undue delay, and within 72 hours where the UK GDPR / GDPR requires it.
Accounts you connect (including Google user data)
If you connect a Google account, VirtTerm asks for permission one feature at a time. Connecting the mail client requests Gmail access only; Drive and Calendar permission are requested separately, the first time you actually use those features. Each request is for the narrowest permission that feature needs — VirtTerm cannot permanently delete your mail, delete your Drive files, change who your files are shared with, or delete your calendars.
- That content is fetched directly from Google to your device over an encrypted connection and is used only to provide the features you asked for. We do not copy your mailbox, files or calendar to our servers, we do not sell it, and we do not use it for advertising or to train AI models.
- If you ask VirtTerm's AI assistant to work with that content — for example to summarise a thread or draft a reply — only the content needed for that request is sent to the AI provider that processes it, solely to return your result.
- You can disconnect an account at any time in the app, or revoke access at myaccount.google.com/permissions. Disconnecting deletes the stored tokens for that account from your device.
- VirtTerm's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
Data retention
Your account data is retained until you request deletion. To delete your account and the personal data we hold for it, email . Content held only on your device is removed when you disconnect the account or uninstall the app.