← Vassal Agent

Privacy

Last updated October 1, 2026

This policy explains what Vassal Agent, the Florida business that makes Vassal Agent ("Vassal Agent", "we", "us"), collects through the Vassal Agent app and vassalagent.com, why, who else receives it, how long it is kept and how to delete it. Short version: your browsing, logins, chats and activity stay on your computer. The app has no analytics or advertising trackers, crash reports are off unless you turn them on, and we do not sell or share your personal information.

What stays on your computer

Your browsing history, cookies and logins, your chats with your AI, your workflows, schedules and exports, and the activity log of every action the app takes are stored on your computer, and we do not receive them. So does anything you copy in with "Bring my sign-ins from Chrome": the app copies Chrome's cookies into its own browser on your computer, and never reads Chrome's saved passwords, cards or history.

Passwords you choose to save in the app are stored encrypted on your computer, locked with your Mac's Keychain. They are never sent to us or to your AI: the app types them into the site for you, and your AI only learns whether the sign-in worked. You can see, change or delete them any time in Settings > Sign-ins.

Optional: syncing saved sign-ins. It is off unless you turn on "Saved sign-ins too" in Settings, under On every computer. If you do, each saved password is encrypted on your computer with a key made from a passphrase you choose, before it joins the rest of your synced Vassal. We never receive the passphrase or the key, and cannot read your passwords or see which sites they are for. Website cookies and sessions never sync.

Voice. When you talk to it, a speech model on your computer turns your voice into text. Your audio never leaves your computer.

Other apps on your computer. The app runs a local connection that AI apps use to drive its browser. It listens only on your computer and needs a key the app keeps there. Any app you give that key to (the app does this for the AI apps you connect) can use the browser as you, so connect only apps you trust.

Deleting the app's data folder removes all of this: on a Mac, ~/Library/Application Support/Vassal Agent; on Windows, %APPDATA%\Vassal Agent.

What we receive

Your account. Your email address, and a one-time code we email you to sign in. For each computer you sign in on: its name and operating system, and when it was last online (the app tells our server every few minutes while it is open). A few times a day the app checks that your subscription is active. We use this only to run your account and your subscription.

What your Vassal knows, if you use more than one computer. What it has learned about you and your work, the routes it found for your jobs, your edits to its drafts and your profile travel between your computers through our server, locked with a key that only your computers hold. We store the locked copy and cannot open it. A new computer gets the key only when one of your computers presses Allow, or with the recovery code shown in Settings. This is on when you sign in; turn it off in Settings, under On every computer.

Controlling your Vassal from your account page. If you allow a browser at vassalagent.com/account, the messages you type there, your Vassal's replies and steps, its questions and your answers pass through our server sealed with a key only that browser and your computer hold, so we cannot read them; we keep each browser's name, its public key, which computer allowed it and until when (30 days at most), and the last sealed messages until you remove that browser in the app's Settings or on your account page.

Your results summary, for Done for you clients. If you use our Done for you service, the app sends our server a summary of your results every few hours so you and your Vassal Agent team can see them at vassalagent.com/account/operations: hours saved, your workflows' names, whether each run worked, and when it ran. It never includes your pages, messages, files, passwords or what your workflows wrote, unless you also turn on "Include the results text". It is on by default for Done for you clients and off for everyone else; turn it off in the app under Chore audit and hours back, and the copy on our server is deleted.

Teams. If you run a team, we store its name, the email addresses you invite, each person's role, and what you choose to share: workflows (locked with a key only your team's computers hold; we see each one's name, who shared it and how often it is run) and your signed rules and site know-how. If you are invited, we store your email on that team's list. While you are on a team, your app sends the team's owner and admins a weekly summary of your activity in counts: runs, workflow names, questions asked and answered, actions a rule stopped, failures and time saved. It never includes your pages, messages, sign-ins or web addresses; we keep the last 26 weeks and delete yours when you leave the team. More on our security page.

Keeping the app current. The app tells our server its version number to learn whether it is still supported, and downloads our site know-how using your account. These requests do not include your pages, jobs or chats.

Crash reports, only if you turn them on. They are off unless you turn on "Send crash reports" in Settings, then Advanced. When they are on, the app sends us, at most once a day, what went wrong when it crashed: the error and where in the app it happened, the app version, your operating system, its version and chip type, how often it repeated, and the last lines of the app's log. Before sending, the app shortens links to the site's name and removes file paths, email addresses, anything that looks like a key or id, and quoted text; we check again when it arrives. A report carries a random id for your computer (or a one-way hash of your license key), not your name. It never includes the pages you visit, what you ask your AI or what you type. We use crash reports only to find and fix bugs.

Messages and calls. If you email us, we keep your messages, your address and what you tell us about your work, to help you.

Only the people who run Vassal Agent can see these records, and only to run the Service.

Who else receives data

Your AI provider. Your prompts, the page content the AI reads to do a task, and what your Vassal knows about you and your work go to the AI provider you connect (such as Anthropic, OpenAI or Google), under your own account and that provider's terms and privacy policy. We do not receive them.

The companies that run parts of the Service for us, each only for its part:

Downloads the app makes for you. When you set up an AI or voice, the app downloads installers and models from their makers (Anthropic, OpenAI, Google, nodejs.org, Hugging Face and GitHub), who see your IP address.

Places you send things. If you send results to Slack, Notion, Google Sheets, email or another service, or route the browser through a proxy, those services receive what you send under their own policies. Testing a proxy asks ipify.org for the proxy's address.

The websites you visit, as with any browser, under their own policies.

Authorities or successors, if the law requires it, to protect our rights or the safety of others, or in a merger or sale of the business, under this policy.

We do not sell personal information and we do not share it for cross-context behavioral advertising. We have no advertising or analytics trackers, so there is nothing to opt out of; we treat a Global Privacy Control signal as a request not to sell or share.

Cookies

This website has no analytics or advertising cookies. When you sign in on the website, your sign-in session is kept in your browser's local storage so you stay signed in; signing out removes it. Cookies stored by the app belong to the sites you visit and stay on your computer.

Why we use data

We use what we receive to provide and license the Service, bill and support you, keep it secure, prevent fraud and abuse, and meet legal and tax duties. We do not use your data to train AI models. Where the GDPR applies, our legal bases are performing our contract with you, our legitimate interest in running and securing the Service, your consent (crash reports, which you can turn off at any time), and legal obligations.

How long we keep it

Supabase, Vercel, Resend, Google and GitHub keep data under their own policies.

Deleting your data

To delete what is on your computer, delete the app's data folder (above). To delete your account and everything we hold about you, email team@vassal.llc from the address on your account. We delete it within 30 days, except the payment and tax records the law requires us to keep.

Security

Everything the app sends us travels over HTTPS. Sign-in tokens are stored on our side only as one-way hashes, what your Vassal knows is encrypted on your computer before it syncs, and the app keeps its own secrets in your computer's keychain where it can. Data on your computer is protected by your computer's own security, so keep it locked and up to date. No system is perfectly secure. If a breach affects your personal information, we will tell you and the authorities as the law requires, without undue delay. To report a security problem, see our security.txt.

Children

The Service is not for anyone under 18, and we do not knowingly collect data from children. If you think a child has given us data, email us and we will delete it.

Your rights

You can ask us to access, correct, delete or export the personal information we hold about you, or object to or restrict its use, by emailing team@vassal.llc. California residents, and residents of other U.S. states with privacy laws, have the right to know, delete and correct personal information, to opt out of its sale or sharing (we do neither), and not to be discriminated against for using these rights; you may use an authorized agent. People in the EU, the UK and similar places have rights under the GDPR, including the right to complain to their data protection authority. We will verify your request, usually by confirming the email on your account, and respond within the time the law requires (45 days at most in California). If we turn down a request, you may appeal by replying to our answer. Some records must be kept for legal reasons.

International transfers

We are based in the United States, and data we receive is processed there. Where the law requires, we rely on appropriate safeguards, such as standard contractual clauses, for transfers.

Changes

We may update this policy. We will change the date above and, for material changes, tell you by email or in the app before they apply.

Contact

Vassal Agent, selling as Vassal Agent · team@vassal.llc