Privacy Policy
Effective October 25, 2026
This policy explains what personal data Virgil collects, why, who it is shared with, and the choices you have. Virgil is operated by ? ("we", "us"), ?, United States. Questions: legal@opossumware.net.
What we collect
- Account data: your email address, an optional display name, your plan, and when you created your account and last logged in.
- Login data: one-time login codes (stored only as a hash and deleted within a day) and a session cookie that keeps you logged in for up to 30 days.
- Your content: boards and everything on them: notes, spun words, drawings, and images you upload or add from a link. When you add an image from a link, our server downloads it from that site.
- Subscription data: if you buy a paid plan, we receive your subscription's status, plan, renewal and end dates, and a link to manage it from our payment provider. We never see or store your card or bank details.
- Technical data: your IP address, used briefly in memory to limit login attempts and stop abuse. We do not keep web server access logs.
We do not use advertising, analytics, or tracking cookies, and we do not track opens or clicks in our emails. The only cookie is the session cookie, which the site needs to work.
How we use it
- To provide Virgil: log you in, save and show your boards, and apply your plan's limits.
- To send login codes and essential messages about your account or subscription.
- To keep Virgil secure, prevent abuse, and enforce our Terms.
- To meet legal obligations, such as responding to valid legal requests and reporting child sexual abuse material to NCMEC.
We do not sell your personal data, share it for advertising, or use your content to train AI models.
Who we share it with
We use these service providers, who process data only on our instructions:
- netcup GmbH: server hosting. All data is stored on servers in Manassas, Virginia, USA.
- Resend: sends login code emails (receives your email address and the code).
- Lemon Squeezy: our reseller and merchant of record for paid plans. They handle checkout, payment, tax, and invoices under their own privacy policy.
We may also disclose data if the law requires it, to protect the rights or safety of our users or others, or as part of a sale or transfer of the service (in which case this policy continues to apply).
How long we keep it
- Account data and content: until you delete them or your account.
- Login codes: deleted within 24 hours. Sessions: deleted when they expire (30 days) or when you log out.
- Subscription records: while your account exists. Lemon Squeezy keeps billing records as tax law requires.
- Backups may hold deleted data for up to 30 days before it is overwritten.
Your choices and rights
You can edit or delete your boards at any time. To get a copy of your data, correct it, or delete your account and all its content, email legal@opossumware.net from the address on your account. We respond within 30 days. California residents can use these same rights to review and change their information.
Our site does not respond differently to "Do Not Track" browser signals, because we do not track you across sites in the first place.
Users in the EU, EEA, UK, and Switzerland
? is the controller of your personal data. We rely on these legal bases:
- Contract: to provide your account, boards, and paid plan.
- Legitimate interests: to secure Virgil and prevent abuse (such as limiting login attempts).
- Legal obligation: where the law requires us to keep or disclose data.
You have the right to access, correct, delete, restrict, or object to the processing of your data, and to receive it in a portable format. To use these rights, email legal@opossumware.net. You also have the right to complain to your local data protection authority.
Your data is stored and processed in the United States. Where required, transfers rely on the European Commission's Standard Contractual Clauses or an equivalent safeguard. We have data processing agreements with our providers.
Children
Virgil is not for children under 13, and we do not knowingly collect their data. If you believe a child under 13 has an account, email legal@opossumware.net and we will delete it.
Security
Connections are encrypted with HTTPS, login codes are stored only as hashes, and your images are shown only to you. No system is perfectly secure, but we work to protect your data and will notify you of a breach where the law requires.
Changes
If we change this policy, we will update the effective date above. If a change is significant, we will tell you by email or on the site before it takes effect.