Privacy policy

Effective from 28 October 2026

Virgil is an app for keeping your own log: your day, habits, training, sleep, measurements, test results, goals, experiments and personal finances. This policy describes what data the Virgil instance at https://virgil.pl processes, for what purpose, where it is stored and who receives it.

Virgil is a free hobby project, run without a company's resources and provided without warranty, as the terms of service explain. That does not change the safeguards described below: we describe what the app actually does.

1. Controller

The controller of your personal data is:
Data Craze Krzysztof Bury
Piaski 50, 30-199 Rząska, Poland
Tax ID (NIP): PL 79 22 12 13 65
Email: [email protected]

In this policy we call them the operator. For anything about your personal data, write to the operator at [email protected].

2. What data we process

Account data:

• email address, display name, chosen language and account role,
• your password, if you set one, stored only as a bcrypt hash (the password cannot be read back from it),
• the two-factor authentication (TOTP) secret, if you turn it on, encrypted with the instance key, and recovery codes stored only as hashes,
• one-time sign-in links sent by email, invites and personal API tokens, stored only as SHA-256 hashes, with their creation, expiry and use dates,
• the date of your last sign-in.

Data you enter or import yourself:

• your daily log, energy, notes and daily plan,
• habits, including the Freedom module, where you can record slips with pornography or alcohol and the emotions and triggers around them,
• training sessions, exercises and training notes,
• body measurements, blood test results and other measurements,
• your onboarding profile (sex, age, height, weight, family situation, habits, daily and training routine),
• goals, experiments and their summaries,
• account balances and assumptions in the personal finance module,
• sleep, readiness, activity, heart rate and workout data from your Oura ring, if you connect it (section 10),
• your API keys for AI providers and your Oura application details, encrypted with the instance key.

Technical and security data:

• security events (sign-in, failed sign-in, sign-out, changes to the password, two-factor authentication and tokens, account changes made by an administrator) with the date and IP address,
• the server's request log (method, path, response code, time), without the content of your entries; secrets in invite links are replaced in it,
• the data any website normally receives, such as your IP address and browser headers, processed by Cloudflare (section 9).

Your email address is needed to create an account and sign in. Everything else you enter voluntarily, and you decide which modules you use.

3. Special categories of data

Test results, measurements, sleep and heart rate data, training and entries in the Freedom module are data concerning health, and entries about pornography may also concern your sex life. These are special categories of data under art. 9 GDPR. We process them only because you choose to enter, import or fetch them, and only for the purpose you do so for: keeping your log and showing it to you.

You give it by ticking the box accepting the terms and this policy when you create your account, and then by entering or importing such data, turning on the Freedom module, connecting an Oura ring or starting an AI feature that uses them. This is your explicit consent to their processing as described here (art. 9(2)(a) GDPR). You can withdraw consent at any time by deleting those entries, turning off the module or feature, disconnecting Oura or erasing all your data (section 15). Withdrawing consent does not affect the lawfulness of processing before the withdrawal.

4. Purposes and legal bases

• Running your account, sign-in and the app itself: art. 6(1)(b) GDPR (the contract to provide the service under the terms of service).
• Data concerning health and sex life: your explicit consent, art. 9(2)(a) GDPR (section 3), and, as far as providing the service itself goes, also art. 6(1)(b) GDPR.
• Security, protection against abuse, the security event log, the request log and backups: the legitimate interest of the operator and users in protecting accounts and data, art. 6(1)(f) GDPR.
• Visit statistics for the public pages: the operator's legitimate interest in knowing the aggregate number of visits, art. 6(1)(f) GDPR (section 14).
• Correspondence: art. 6(1)(b) or (f) GDPR, depending on its content.

We do not sell data or use it for advertising or marketing profiling. Virgil does not make decisions about you based solely on automated processing that would have legal effects. Summaries and plans written by AI are only suggestions.

5. Where and how we store data

Each account has its own SQLite database on the instance's server. The account registry (email address, display name, password and token hashes, security events) is a separate database on the same server.

• API keys for AI providers, Oura application details and tokens, and two-factor authentication secrets are encrypted with the instance key.
• Passwords are stored as bcrypt hashes, and sign-in links, recovery codes and API tokens as SHA-256 hashes.
• The connection to the service is encrypted (HTTPS).
• On this instance, an account with a password must have two-factor authentication turned on.
• Your other entries are stored in your account's database without additional encryption. Only the operator has access to the server. The operator does not browse your entries and uses access to the files only to maintain the service, to restore data from a backup or at your request.

6. Backups

Local copies: the app makes a copy of each account's database on the server, by default once every 24 hours, and keeps the latest 7 copies by default. You set the frequency and number of copies, or turn them off, in Settings > Data. The account registry is copied once a day, keeping the latest 7 copies. An extra safety copy is made before a database schema update and before a data import.

Off-site copies: once a day an encrypted copy of the whole instance goes to Cloudflare R2 storage. The copy is encrypted on the server with age before it is uploaded, and the key to decrypt it is kept neither on the server nor at Cloudflare, so Cloudflare cannot read it. Daily copies are deleted after 30 days and monthly copies after 365 days.

Erasing your account's data or deleting your account deletes every local copy of that account's database and queues the deletion of its files from every off-site copy, daily and monthly. Older copies of the account registry, both local and off-site, still contain the deleted account's row (email address, display name, password hash, encrypted TOTP secret) until they expire: regular local copies within about 7 days, off-site copies after 365 days at most, and the 3 latest safety copies made before a database schema update until copies from later updates replace them. They do not contain your entries.

7. AI features

Some features use a language model. You start each of them yourself:

• the profile summary after onboarding (the profile data from section 2),
• the morning briefing (off by default; the day's data, habits including Freedom streaks if that module is on, and today's Oura data),
• the A.N.D.Y. daily plan (goals, weekly plan, training schedule and logged training),
• workout note parsing (the text of the note),
• experiment summaries (the experiment's entries and that week's Oura data),
• lab result import (the uploaded PDF file or pasted text).

When you use them, the data they need is sent to a language model provider:

• If you add your own API key (Settings > AI), the data goes to the provider you chose, under your own agreement with that provider. You and your provider are responsible for that flow and its costs.
• If you have no key of your own and an administrator has allowed your account to use the server's key, the data goes to the model provider the operator chose, for example OpenAI, Anthropic, Google, Mistral or xAI. The operator can change it at any time, and this page always names the current one: currently OpenAI. The provider may process data outside the EEA (section 11). Without that permission, AI features do not use the server's key.

An uploaded lab results file waits on the server encrypted with the instance key and is deleted once the results are saved, or after 24 hours at the latest. AI answers can be wrong; always check them.

8. Your own AI assistant (API and MCP)

You can create a personal token (Settings > AI) and connect your own AI assistant through Virgil's API or MCP server. You choose the token's scope: read, write, sensitive data (the Freedom module) and finances. Data the assistant fetches goes to the assistant's provider. That flow is under your control and subject to your assistant provider's terms. You can revoke a token at any time.

9. Recipients of data

We entrust data only to the providers the service needs, and only as far as their tasks require:

• Hosting: a VPS rented from mikr.us; the physical server is in a data centre in Finland (EU). The databases and local copies are on it.
• Cloudflare, Inc. (USA): DNS, the TLS certificate and Cloudflare Tunnel. All traffic to the service passes through Cloudflare, which sees the IP address, device data and request content as far as needed to deliver and protect it. Cloudflare R2 stores the encrypted backups, which it cannot read (section 6).
• Outgoing email: sign-in links, signup links and invites are sent through the SMTP server of the Polish hosting company zenbox.pl. It receives the recipient's email address and the content of the message.
• The language model provider for the server's key (currently OpenAI), only when you use AI features on the server's key (section 7).
• Oura Health Oy (Finland), if you connect an Oura ring (section 10).
• Plausible Insights OÜ (Estonia): visit statistics for the public pages (section 14).

The operator receives technical notifications through a chat webhook (for example about a failed backup or a change to server settings). They contain counts and the administrator's email address, not account data.

We may also disclose data to public authorities where the law requires it.

10. Oura

If you connect an Oura ring (Settings > Connections), you enter the details of your own Oura application and sign in to Oura. Access and refresh tokens are stored encrypted with the instance key. Virgil fetches sleep, readiness, activity, heart rate, SpO2 and workout data from the Oura API, and Oura notifies the server of new data through a webhook. Oura Health Oy processes your data under your own agreement with Oura. You can remove the connection at any time.

11. Transfers outside the EEA

Cloudflare, Inc. is based in the USA, and the model provider for the server's key may process data outside the Union, so giving them data may mean a transfer outside the European Economic Area. It is based on the European Commission's adequacy decision (the EU-US Data Privacy Framework), where the provider is certified under it, or on standard contractual clauses approved by the European Commission. Hosting, Oura and Plausible operate in the European Union. If you use your own AI provider or assistant, the transfer depends on your agreement with it.

12. How long we keep data

• Account data and entries: until you erase your data or your account is deleted, or the service ends (terms of service, section 10).
• Security events with IP address: 180 days, after which they are deleted automatically.
• Backups: as described in section 6.
• Uploaded lab result files: until the results are saved, 24 hours at most.
• Sign-in links: valid for 15 minutes; invites: valid for 7 days.
• The server's request log: deleted automatically once it exceeds its size limit; the server's system journal at most 14 days.
• Correspondence: as long as needed to handle the matter, and then until the period needed to defend against claims has passed.

13. Cookies and browser storage

Virgil uses only the cookies and browser storage that are strictly necessary for the service you ask for. It uses no advertising, analytics or tracking cookies, which is why it shows no consent banner.

• virgil_session: keeps you signed in, 7 days.
• csrf_token: protects forms against requests forged by another site, 24 hours.
• virgil_lang: remembers the interface language, 1 year.
• virgil_lang_chosen: remembers a language chosen before signing in, until the next sign-in or until the browser is closed.
• virgil_link_browser: lets a sign-in link opened in the same browser sign you in without an extra click; it holds only hashes of the links, 15 minutes.
• oura_oauth_state: secures connecting Oura, 10 minutes, only while connecting.
• virgil-theme in localStorage: remembers the light or dark theme.
• Form drafts in sessionStorage: text typed into a form before you save it, removed when you save, sign out or close the tab.
• The service worker cache: the app's static files (styles, scripts, icons) and the offline page, never signed-in pages.

You can delete or block this data in your browser settings; without the session cookie, however, you cannot sign in.

14. Plausible analytics

On the public pages, that is the home page, the privacy policy and the terms of service, we use Plausible Analytics, a service of Plausible Insights OÜ from Estonia. Plausible uses no cookies or browser storage and does not track people across days, devices or websites.

We send Plausible only page views of those three paths, without the query string, the fragment or the referrer. From the request, Plausible works out the device type, browser, operating system and approximate location; the IP address is used briefly to compute a daily identifier and is not stored. Signed-in pages do not load Plausible, so none of your entries or account data reach it.

15. Your rights

You have the right to:

• access your data and get a copy: in Settings > Data you can download a JSON export, a CSV export, a Markdown summary and the database file,
• rectification: you can correct most of your data yourself in the app,
• erasure: in Settings > Data, Reset all data, after you confirm it is you, deletes all your entries and their copies and keeps only the account itself; the operator deletes the whole account at your request (the Oura connection must be removed first),
• restriction of processing,
• data portability: JSON and CSV export in Settings > Data,
• object to processing based on legitimate interest,
• withdraw consent at any time, without affecting processing before the withdrawal (section 3).

To exercise rights you cannot exercise yourself in the app, write to the operator at [email protected]. We will reply without undue delay and within one month at the latest.

You can also lodge a complaint with the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych), ul. Stawki 2, 00-193 Warsaw, Poland.

16. Changes to this policy

This policy may change as Virgil develops, or when providers or the law change. The current version and its effective date are always on this page. We will notify users by email in advance of material changes, such as a new recipient of data.