Privacy Policy

1. Overview

Cyrush LLC ("we", "us", or "our") operates Vistacker. This Privacy Policy explains what information we collect, how we use it, and the choices you have. By using Vistacker you agree to the collection and use of information in accordance with this policy.

2. Information We Collect

We collect only what is necessary to provide and improve the service:

• Account information — your email address and OAuth provider identifier (GitHub user ID or Google subject), obtained when you sign in.
• Sync data — task titles, stack names, notes, and log entries that you push to the server for multi-device sync. If you enable client-side encryption, this data is stored as ciphertext and we never see the plaintext.
• Usage metadata — server-side logs containing timestamps, vault IDs, and client version strings, used for debugging and abuse detection. Logs are retained for up to 30 days.
• Billing information — if you upgrade to Pro, payment is processed by Stripe. We store only your Stripe customer ID; we never see or store full card numbers.

3. How We Use Your Information

• To authenticate you and associate your devices with your account;
• To sync your vaults, stacks, and tasks across your devices;
• To process payments and manage your subscription;
• To detect abuse, enforce rate limits, and investigate security incidents;
• To send transactional emails related to your account (e.g. billing receipts) — we do not send marketing emails without your consent.

4. Data Sharing

We do not sell, trade, or rent your personal information to third parties. We share data only with:

• Stripe — for payment processing. Stripe's privacy policy is available at stripe.com/privacy.
• GitHub / Google — solely to complete the OAuth sign-in flow. We receive only your email and a stable user identifier.
• Infrastructure providers — hosting and object storage used to run the service. These providers have no access to your task content beyond what is necessary to operate the infrastructure.
• Law enforcement — when required by applicable law or to protect the rights, property, or safety of Cyrush LLC, its users, or the public.

5. Client-Side Encryption

Vistacker optionally supports client-side AES-256 encryption. When enabled, your task and note content is encrypted on your device before being sent to the server. The server stores only ciphertext — we have no ability to read or recover your data. The encryption key never leaves your device.

6. Data Retention

Your account and vault data is retained for as long as your account is active. If you delete your account, we will delete your personal data within 30 days, except where retention is required by law. Server logs are retained for up to 30 days and then purged.

7. Your Rights

Depending on your location you may have the right to access, correct, or delete your personal data, and to object to or restrict certain processing. To exercise these rights, contact us at the address below. We will respond within 30 days.

8. Cookies

The web account portal uses a single session cookie (vs_session) to keep you logged in. It is an HttpOnly, Secure, SameSite=Lax cookie with a 30-day lifetime. No third-party tracking or advertising cookies are used.

9. Security

All data in transit is protected by TLS. Sync traffic uses HTTP/2 over TLS terminated at our edge. We apply reasonable organizational and technical measures to protect your data, but no method of transmission over the internet is 100% secure.

10. Children's Privacy

Vistacker is not directed at children under the age of 13. We do not knowingly collect personal information from children. If you believe we have inadvertently collected information from a child, please contact us and we will promptly delete it.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by updating the "Last Updated" date above. Your continued use of Vistacker after changes are posted constitutes your acceptance of the revised policy.

12. Contact Us

If you have questions or requests regarding this Privacy Policy, please contact us at: