Vecton — Privacy Policy

Effective date: 2026-08-26 Last updated: 2026-08-26

This Privacy Policy explains what information Vecton (“Vecton”, “we”, “us”) collects, why, and what we do with it. Vecton is a local-first desktop application for supervising AI coding agents: by design, your code and most of your work never leave your machine. This policy describes the limited data that does reach our cloud.

The data controller is Shaked Nachum, trading as “Vecton”, based in Israel, reachable via the contact in Section 12.

1. The short version

• Your code, prompts, diffs, and file contents are never sent to us. They stay in local databases on your device.
• You can use Vecton fully offline, with no account. Choosing “Continue offline” means we collect nothing except where this policy expressly says otherwise.
• When you sign in, we process your account identity and a limited set of project and organization metadata needed to sync across your devices and teammates.
• We derive product metrics server-side from data you already transmit for the service to work (your account and task status). We do not run a client-side analytics SDK.

2. What stays on your device (never collected)

Vecton is local-first: anything Vecton stores on your device — your work, your settings, and records of the choices you make in the app — stays on your device and is never transmitted to us unless Section 3 says otherwise. This holds for features added after this policy was last updated; if a new feature ever sends something to our cloud, it is named in Section 3.

By way of illustration, and not as an exhaustive inventory, local data includes:

• Source code, file contents, and diffs in your projects and git worktrees.
• Agent prompts, conversations, and reasoning exchanged with the coding agents you run.
• Agent output/stream logs, worker process state, and local audit logs.
• Your local kanban tasks, reviews, and review comments.
• Personal (non-organization) API keys and credentials you enter to run agents locally.

If you never sign in, Vecton runs entirely on your device.

3. What we collect

3.1 Account & identity

When you sign in with Google (via Supabase Auth), we receive and store the identity information Google returns for the account you choose: your email address, name, profile picture URL, and Google account identifier. We store it to authenticate you, associate your data with your account, and enable team features.

3.2 Cloud-synced product data

So that your work is available across devices and to teammates you invite, we store the following in our cloud database (Supabase):

• Project metadata: project name, description, ownership, and timestamps. (Not the code — the code stays local.)
• Organizations & memberships: organization name, your role (admin/developer), and co-members’ account identifiers.
• Deployment records: the named deployment-workflow step definitions, the status of each deployment run, and the short textual “proof” or status message the agent reports for each step (plus any error message).
• Shared agent configurations: for organization-shared configurations, the driver name and the configuration payload — which may include an API key. The payload is encrypted at rest (Section 7).

3.3 Server-side product analytics

To understand how Vecton is adopted and used, and to improve it, we derive usage metrics entirely server-side from data described in 3.1–3.2 — your account and your synced task status. We compute:

• Activation (e.g. first task run through to a human-approved change),
• Retention (D1 / D7 / D30 by account), and
• Funnel progression from sign-in to first shipped task.

We do this without a client-side analytics SDK, and without ever aggregating your code, prompts, diffs, or API keys. If you use Vecton offline, you are not included in these metrics.

3.4 Record of your acceptance of these documents

When you accept the Terms of Service and acknowledge this Privacy Policy in the app, we record that you did so. The record contains your account identifier, the version identifier of each document you were shown, and the timestamp of acceptance. It records nothing else about you or your use of the product.

3.5 Crash and error reports

When Vecton crashes or encounters an error, a diagnostic report is sent to our error-tracking provider (Section 5) so we can find and fix failures. Reports contain technical diagnostics such as the error, stack trace, app version, operating system, and recent in-app events — never your code, prompts, or API keys. Crash reporting works whether or not you sign in; you can turn it off in Settings.

3.6 Bug reports you send us

When you use “Report a bug” in the app, we receive what you put in the report: your description of the problem, the email address you optionally give us so we can reply, and a screenshot if you choose to attach one. It goes to the same error-tracking provider as 3.5 (Section 5), together with the technical diagnostics listed there, so we can reproduce and fix what you hit. Nothing is sent unless you submit the form. A screenshot is a picture of your screen: it may show code or other work that Vecton would otherwise never send us, which is why attaching one is your choice, made each time.

We do not sell your personal data, and we do not use it for advertising.

4. Legal bases for processing (GDPR / UK GDPR)

For users in the EEA/UK, we rely on:

• Performance of a contract — account identity (3.1) and cloud sync (3.2), which are necessary to provide the cloud features you request.
• Performance of a contract, and our legitimate interests — the record of your acceptance (3.4), retained to establish which version of these documents applies to you and to establish or defend legal claims. You may object (see Section 8), though we may then be unable to offer you cloud features.
• Legitimate interests — server-side product analytics (3.3), to understand activation and retention and improve the product. You may object (see Section 8).
• Legitimate interests — crash and error reports (3.5), to diagnose and fix failures. You may object by turning crash reporting off in Settings.
• Legitimate interests — bug reports you send us (3.6), to answer and fix what you report. You may object by not sending one.
• Consent — where we ask for it explicitly and you give it. Nothing described in this policy relies on consent; where we introduce processing that does, we will ask for it separately and you will be free to refuse.

5. Sub-processors and third parties

We share data only with service providers that help us run Vecton:

Vecton’s cloud services are currently hosted in the European Economic Area and the United Kingdom; Section 9 describes what applies if data is processed elsewhere. When you run third-party coding agents or connect to AI providers using your own keys, your interactions with those tools are governed by their terms and privacy policies, not this one.

6. Data retention

• Account & cloud-synced data is retained while your account is active. When you delete your account, we delete or irreversibly anonymize your associated cloud data within 30 days, except where we must retain it to meet a legal obligation.
• Derived analytics metrics are retained in aggregated form for 24 months.
• Crash and error reports (3.5) and bug reports you send us (3.6), including any screenshot attached to one, are retained for up to 90 days.
• Acceptance records (3.4) are retained while your account exists and for 7 years after account deletion, because the record may be needed to establish, exercise, or defend legal claims (GDPR Art. 17(3)(e)); the record is deleted when that period ends.
• Local data on your device, including local acceptance records, is retained until you delete it.

7. Security

• Access controls ensure you can only read data belonging to you or to organizations you are a member of.
• Organization-shared configuration secrets are encrypted at rest in a dedicated secrets vault and decryptable only through access-controlled paths.
• Data in transit is protected with TLS/HTTPS.
• No security measure is perfect; we cannot guarantee absolute security, particularly for code and commands that agents execute on your own machine.

8. Your rights

Depending on your location (e.g. GDPR/UK GDPR, CCPA/CPRA), you may have the right to access, correct, delete, export, or restrict processing of your personal data, and to object to processing based on legitimate interests. To exercise any of these, contact shaked.labs@gmail.com. Deleting your account removes your associated cloud data as described in Section 6. You will not be discriminated against for exercising these rights.

If you are in the EEA or the UK, you also have the right to lodge a complaint with your local data-protection supervisory authority. If you are in Israel, you may contact the Israeli Privacy Protection Authority (PPA).

9. International transfers

Your data is processed in the European Economic Area and the United Kingdom, where our cloud services are hosted (Section 5), and in Israel, where we are based and from which we administer them. Transfers between these jurisdictions are covered by adequacy: the EEA and the UK recognise each other, and the European Commission has recognised Israel, as providing an adequate level of protection for personal data.

If we transfer personal data to any other jurisdiction, we will do so under an appropriate safeguard recognised by applicable law, such as an adequacy decision or standard contractual clauses, and will update this policy accordingly.

10. Children

Vecton is not directed to, and is not intended for use by, individuals under 18. We do not knowingly collect their personal data.

11. Changes to this policy

We may update this policy as the product evolves. Material changes will be reflected here with a new “Last updated” date and, where appropriate, surfaced in the app.

12. Contact

Shaked Nachum, trading as “Vecton”, Israel Privacy inquiries: shaked.labs@gmail.com