Privacy Policy

Last updated: November 6, 2026

Vireo is a companion for prayer and reflection, built on a large language model. This page explains what the site collects, what happens to a message you send, and — just as important — what is not private about it.

There is no account to make, and no record of your conversation on our side. The site does keep a few small records that are not your words — a daily count of free questions, anonymous visit totals, a note that your subscription is paid up if you subscribe, and your email address only if you choose to give it to us: for our first-month offer, to receive your quiz report, or to start a trial. All are described exactly below.

In this policy, "we" means the team behind Vireo, which operates vireoworks.com.

In short

• There are no accounts. No sign-up, no login, no password.
• Nothing you write is stored on our servers or written to our logs.
• We keep three small records that are not your words: a daily count of free questions, against a scrambled form of your network address; if you subscribe, a record that your subscription is paid up; and anonymous running totals of how the site is used (how many visits, from which country, on what kind of device) which say nothing about any one person.
• If you pay, Stripe takes the payment. Your card details go to Stripe and never reach us. Your email address goes to Stripe for receipts, and we only have it if you give it to us: for our first-month offer, to receive your quiz report, or when you start a trial.
• Giving us your email address is optional. If you do, we use it only for what you gave it for (the offer, your report and one reminder, or your trial's emails), send news only if you ask, and delete it whenever you ask.
• Your conversation lives in your browser tab and ends when you close it.
• If you take the Bible character quiz, the AI is told only which character you got (to set the tone of its replies) and, if you tap the button asking about that character's story, what you said weighs on you. Your other answers are never sent to it. Answers are counted only in anonymous totals, and we keep nothing about you.
• To answer you, every message is sent to Anthropic, which runs the model. That is how the site works.
• Nothing here is covered by the seal of confession, by clergy-penitent privilege, or by any other privilege. That point has its own section below, because it matters more than the rest of this page.

This is not confession

What you write to Vireo is not confidential in the way confession, or a conversation with your pastor, is.

There is no pastor or priest here. There is no seal of confession, no clergy-penitent privilege, and no professional confidentiality of any kind. Vireo is software. Your words are processed by a third-party AI provider in order to produce a reply. We have built the site to hold on to as little as possible, but "as little as possible" is not the same as protected.

So write as though a third party will process what you send, because one will. If something belongs with your pastor or priest — or, in the churches that practice it, in the sacrament of confession — bring it to them. If a detail could harm you or someone else in the wrong hands — a name, an address, an accusation, an illness, an offense — please leave it out. You can bring what is actually on your heart without naming names, and the companion works perfectly well that way.

No accounts

You do not identify yourself to use this site, and we do not ask you to. We collect no name and no phone number, and the only time we ask for your email address is our optional first-month offer (see "If you leave your email" below). There is nothing to log in to, no profile, and no conversation history to come back to. We do not build a picture of you across visits.

If you subscribe, Stripe asks for an email address so that it can send you receipts, and keeps it. Stripe also passes it to us once, when the subscription starts, so that we can send you one email confirming its terms and how to cancel; we do not keep it after sending. If you left your address with us for the offer, we pass it to Stripe so the checkout page is already filled in. If you write to us — to report a mistake, or to recover a lost key — we will of course have the address you write from.

What happens to a message you send

Step by step:

1. You type in your browser. The text stays in the tab — in the page's memory and in sessionStorage.
2. When you send it, your browser posts the current conversation to `/api/chat` on our server. It sends the earlier turns too, because the model needs them to follow the thread. There is no server-side memory it could read them from instead.
3. Our server holds that text in memory for the life of that single request and forwards it to Anthropic's Claude API.
4. Anthropic's model produces a reply, and our server streams it back to your browser as it is written.
5. When the request finishes, the copy in our server's memory goes with it. None of it is written to a database, a file, or a log: the one small store this site has holds only the counts, subscription records and offer email addresses described below, and the code never writes a message into it.

The result is that we cannot look up your conversation, produce it later, or hand it to anyone, because we do not have it. When something fails on that route, our code records only the shape of the failure — that an upstream request returned an error, for example — never what was written.

Anthropic, the model provider

The model behind Vireo is Claude, made by Anthropic. Anthropic processes the inputs and outputs of each request on our behalf, under its commercial terms, so that a reply can be generated.

Two things are worth knowing. Anthropic states that it does not train its models on commercial API data by default. Anthropic may retain API inputs and outputs for a limited period for trust and safety purposes. Anthropic is a United States company, so this processing may take place outside your country.

We are not going to restate Anthropic's terms here, because it explains its own practices better than we can: see Anthropic's privacy policy.

Anthropic is an independent company with no connection to any church.

Netlify, our host

The site is hosted on Netlify. Like any web host, Netlify records standard request metadata in its platform logs — IP address, timestamp, the path requested, and the browser's user agent — for operations, reliability, and abuse prevention. This is the ordinary bookkeeping of serving a website, and it happens for every page you load.

We do not add the contents of your messages to those logs. Netlify is a United States company, so this metadata may be handled outside your country.

What your browser stores

A few small things, all on your own device:

• sessionStorage, under the key `vireoworks.conversation.v1`, holds the conversation you are having, so that a refresh does not lose it. It belongs to that one tab and is discarded when the tab closes.
• localStorage, under the key `vireoworks.disclaimer.v1`, records that you accepted the disclaimer, so you are not asked again on every visit. It stores only that you accepted, nothing else.
• sessionStorage, under `vireoworks.draft.v1`, holds a question you typed or tapped on another page of the site for the moment it takes to move to the chat page, and is deleted as soon as it is read. It is kept out of the page address on purpose, so that it never appears in your browser history or in our host's logs.
• localStorage, under `vireoworks.subscriber.v1`, holds your subscriber key, if you subscribe. It is sent with each question so the server knows you are subscribed. It is the only proof of your subscription, so keep a copy of it.
• localStorage, under `vireoworks.intro.v1`, records that the short welcome panel has been shown, so it does not appear again. It stores only that, nothing else.
• localStorage, under `vireoworks.theme.v1`, remembers whether you chose the light or dark look, if you ever switched it.
• sessionStorage, under `vireoworks.quiz.v1`, holds the Bible character you got, what you said weighs on you, and the starter questions picked for you, if you take the quiz and see your result, so the chat can show your result and set its tone. If you took the quiz inside Instagram's or Facebook's own browser and tap to reveal your result, it opens in your phone's own browser instead, at an address carrying two short codes from fixed lists, one for the character you got (such as "r3") and one for what you said weighs on you (such as "w2"); the chat reads them into that tab's storage and removes them from the address straight away, and we never store them. Instagram or Facebook, which hand the address over, can see it as they see any link opened from them. Wherever the result itself is paid for (for example with a subscription), the same three things wait under `vireoworks.quizlocked.v1` until it is unlocked, which the chat never reads. Both hold only those, not your other answers. They belong to that one tab and are discarded when the tab closes.
• localStorage, under `vireoworks.notrack.v1`, and a cookie named `vireo_notrack`, both holding only "1", exist only in browsers where someone switched visit counting off (the site's own team does this on their devices, so their testing is not counted). Ordinary visitors have neither.

To clear them: use the "Clear this conversation" control in the chat, which empties the conversation immediately. Closing the tab clears it too. To remove everything, clear site data for vireoworks.com in your browser settings — the disclaimer will then appear again the next time you visit. If you are a subscriber, copy your key first (it is on the Pricing page); clearing site data removes it from this browser, though not your subscription itself. If your browser blocks storage, the site still works; you will simply see the disclaimer each time and lose the conversation on refresh.

Rate limiting

To blunt casual abuse, the server applies a best-effort limit on how many requests one visitor can make in a short window. It works like this: the IP address on the request is combined with a random secret generated by the server and hashed. Only that hash and a count are held, in the memory of one server instance.

The secret is never written down and never leaves memory, so the hashes cannot be turned back into IP addresses, even by us. The counters are not stored in a database and are lost whenever the instance recycles. This is not a log, and it is not linked to anything you write.

The free allowance

Without a subscription you can ask a set number of questions a day. Counting them without accounts needs something to count against, and the only thing available is the network address your request comes from. So:

• What is stored is a keyed hash of that address and the current UTC date, computed with a secret held on our server, next to a number: how many questions have been answered today. The address itself is not stored.
• Because the date is part of the hash, the rows from different days cannot be linked to one another.
• Each row is deleted automatically the day after the day it counts.
• Only answered questions are counted. An error, or a reply that did not arrive, is not.

Two honest limits. First, someone who had both our server secret and a particular address could compute that address's row for today and read its count; that is as far as it goes, and it does not include anything you wrote. Second, people who share a network — an office, a university, some mobile carriers — share an allowance, and may find it runs out sooner.

These rows are held by our storage provider (Upstash), which processes them on our behalf.

Payments

Payments are handled entirely by Stripe. When you subscribe, start a trial, or buy your quiz report, you are taken to Stripe's own checkout page; your card details, billing address and email address go to Stripe. Your card details and billing address never pass through our servers. Your email address does only if you gave it to us, for the first-month offer, to receive your quiz report or to start a trial, in which case we pass it to Stripe to fill in the checkout page. Stripe processes them under its privacy policy.

The quiz result itself is free. For the full report, Stripe is also told which Bible character you got (a fixed id such as "ruth"), so that the report can be shown when you come back from paying, even if your browser lost the quiz on the way, and so that it can be emailed to you. Stripe is never told what you said weighs on you, or any other answer: the report picks its passages for that in your own browser, and a report opened from the email asks you. A report is a one-time payment: no subscription record is kept for it. We keep a scrambled form of your address (a one-way hash) with the date when you pay for a report or leave a report checkout unfinished, so that we never send a reminder to someone who has paid and never send anyone a second one. These notes are deleted automatically after a year.

If you start a trial of Vireo Unlimited (offered after buying your quiz report, and in the chat once the day's free questions are used up), it is a subscription like any other and kept in the same record. Its address is the one you paid your report with (Stripe tells us), or the one you type into the trial offer in the chat, which Stripe's page then shows as the trial's address. We also keep that address with the trial's subscription id until we send the one reminder a few days before the trial ends, and then delete it (at the latest about two weeks after the trial started); and a scrambled form of the address (a one-way hash) with the date, so the trial goes to each address only once. That note has no expiry, and is deleted along with your address if you ask.

To know that you have paid, we keep one record per subscription, held by the same storage provider:

• a hash of your subscriber key (the key itself is never stored, so a copy of our records would not let anyone use your subscription);
• the Stripe customer id and subscription id;
• whether the subscription is active, and when the current billing period ends;
• whether it began with the first-month discount, which decides whether the full quiz report is included.

A Stripe customer id is not your name, but Stripe can connect it to the email address you gave them, so we treat this record as personal data. It is kept while your subscription runs and deleted automatically about a year after it last changed.

If you leave your email

You never have to. On the Pricing page, and when the day's free questions run out, we offer a discount on the first month of a subscription to anyone who leaves an email address. Hearing from us beyond that is a separate, optional box. To buy your quiz report, or to start a trial from the chat, we ask where to send it. If you leave your address:

• What we keep: the address you typed, when you first and last left it, where you left it (the offer, the Pricing page, or the quiz), and whether you checked the optional box asking for news (and which wording of it you checked). Nothing else goes with it: not your questions, not your quiz answers, not your subscriber key, not your network address.
• For a trial: one email when it starts, with its terms and how to cancel, and one a few days before it ends. Both are about the subscription you started, so they are sent whether or not you asked for news.
• For the quiz report: we send your report to the address once you have paid. If you start paying but do not finish, we send one reminder about an hour later, with a link back to it, and nothing more. That link, like the page address while the report's checkout sheet is open, carries a short code for which character you got (such as "r3"), never anything about you. We do not send news unless you ask for it.
• What it is for: one email from us with your offer and a link back to it, and a copy of the address to our own inbox so we know it was left. If you checked the news box, also occasional news about Vireo; if you did not, we will not send you anything else. When you continue to checkout we also pass the address to Stripe, so the payment page is filled in and your receipt goes to the same address.
• If you use the discount: once a checkout with the first-month discount is completed, we also keep a scrambled form of the address (a one-way hash: it can be matched against an address, but not read back as one) and the date, so that the discount goes to each address only once. Nothing else is kept with it, and it is deleted along with the address if you ask.
• Legal basis: for the offer email, that you asked for the offer; for the quiz report, delivering what you bought; for the one quiz reminder, our legitimate interest in letting you finish a purchase you started (reply "stop" to it and we will not email you again; ask us to delete your address and none is sent); for news, your consent, given when you check the box. You can withdraw it at any time, and doing so does not affect a subscription you already have.
• Unsubscribing and deletion: reply to any email we send, or write to chris@vireoworks.com, and we will stop emailing you. Ask us to delete the address and we will remove it from our records.
• Where it is held: by our storage provider (Upstash), which processes it on our behalf. The emails are sent from our own mailbox at Zoho Mail, so the address and the emails we send also sit in that mailbox.
• How long: until you ask us to delete it.

Counting visits

We want to know how the site is used: how many people come, when, from which countries, on phones or computers, which pages they open, and whether they go on to ask a question or subscribe. So the server keeps running totals.

How it works, and what it leaves out:

• Counters, not records. Each visit or action adds one to a number — for example "page views from Germany today", "visits from a phone this hour", "questions answered today". There is no row for you, and no list of what any one person did. A total cannot be taken apart again.
• What is counted is a page being opened (which page, the country your network address is in, the kind of device, system and browser, the hour, and the website that linked you here if there was one); a topic button being tapped (only its fixed name, such as "Grief"); the welcome panel being shown, closed or used; a ready-made question being tapped (only its topic's fixed name, never the question), the verse of the day being tapped, or a typed question being sent on to the chat page (only that one was, never what it said); a suggested next question under an answer being tapped (only that one was, never which); the Bible character quiz — its first screen being seen, the quiz being started and finished, the option chosen for each question (only its fixed name, such as "Catholic"), where it was skipped, the character worked out, the screen saying your match is ready, the tap to reveal it, its being handed to your phone's own browser or kept in the app (and its arriving there), the result being shown, the offer of the full report being opened, its buy button being tapped, that offer being closed (and, if you pick one, the reason from a fixed list, such as "The price"), the payment page for the report being opened (or failing to open), paid for or left to lapse, a reminder being sent or its link opened, the page being reopened in your own browser to pay, the example report being opened, whether you tapped that it fit you or not, the trial being offered or tapped (under a report, or in the chat), its payment page being opened, a trial starting, its reminder being sent and its reaching its first renewal, and the button on to the chat being tapped, all counted only in totals and never linked to a person or to anything you ask; accepting the disclaimer; a question being answered (only that one was, never what it was); reaching the free limit, and tapping the button there to continue with a subscription; the first-month offer being shown, and an email address being left for it (only that one was, never which); opening the payment page; and a subscription starting.
• What is never kept: your network address, your browser's identifying text, anything you typed or the model replied, and anything that identifies you. The country, device and browser are read from the request, reduced to a short label like "mobile" or "DE", and the rest is discarded.
• Different visitors are estimated with a scrambled token made from your address, your browser and the date, under a secret held on our server. It changes every day, so it cannot follow you from one day to the next, and it is stored in a form that can estimate a number but cannot list the tokens. These tokens are deleted automatically after about forty days. The totals themselves are kept.
• No cookies and nothing stored on your device for this, except in a browser where counting was switched off (see "What your browser stores"). If your browser sends Do Not Track or Global Privacy Control, nothing is counted at all. Search-engine bots and automated tools are not counted.
• Who sees it. The totals are held by our storage provider (Upstash) and shown to us on a private page protected by a password. They are not shared with anyone, and no third-party analytics service is involved.

We do this to understand and improve the service, which is our legitimate interest. Because it keeps no record about you, there is nothing in it we could look up, correct or delete if you asked.

What we do not do

Not as a promise for the future, but as a description of the build as it stands:

• No advertising, no third-party analytics or trackers, no pixels, and nothing that follows you from one visit, or one website, to the next. The one kind of measuring we do is the anonymous counting described under "Counting visits" above.
• No cookies beyond what is strictly needed to serve the site. Nothing is set to identify or follow you.
• No marketing emails unless you ask for them. We only have your email address if you left it for our first-month offer and checked the box agreeing to hear from us; then we may send you that offer and occasional news, and you can unsubscribe at any time. Otherwise Stripe has your address, and uses it only for receipts and billing notices.
• No selling or renting of personal information, and no sharing beyond the providers named on this page.
• No profiling, no scoring, and no automated decisions about you. The quiz's character is worked out in your own browser for you to read; we keep it only as an anonymous total. The AI is told the character only to set the tone of its replies, and it never decides anything about you.
• No human at our end reading conversations, because none of them are kept.
• No passing along of the Scripture you open. Bible references in answers, and the verse of the day, are links to Bible Gateway (biblegateway.com), a separate service. Nothing is sent to it unless you tap one. If you do, the passage opens in a new tab, Bible Gateway sees your IP address and the passage you asked for, and its own privacy policy applies. We learn nothing about what you open.

Children and young people

Vireo is not directed to children under 13, and they should not use it. Anyone under 16 should use it only with a parent or guardian's knowledge and involvement.

We should be plain about the limits here. There is no age verification. The disclaimer you accept before your first conversation asks you to confirm your age, and that self-attestation is all the site can check. We do not knowingly collect information from children. Apart from an email address someone chooses to leave for our first-month offer, we collect nothing tied to any user. A parent or guardian with a concern can write to us at chris@vireoworks.com, and we will delete any such address.

Your rights

Depending on where you live, you may have rights over your personal data — to ask what is held, to get a copy, to correct it, or to have it erased.

Honesty is more useful here than a list of procedures. We hold no stored conversation and no account. What we do hold is this:

• The daily count of free questions. We cannot find "your" row without your network address and today's date, and it deletes itself within a day, so there is in practice nothing to produce.
• Anonymous totals of how the site is used. These are numbers, not records about people, so there is nothing in them to look up, correct or erase for any one person.
• A subscription record, if you subscribe. Send us your subscriber key, or the Stripe customer id on your receipt, and we can tell you exactly what the record says, correct it, or delete it. Deleting it ends your access, so cancel the subscription from the billing page first.
• Your email address, if you left it for the first-month offer. Write to us from that address and we will tell you what we hold, correct it, or delete it.

Some things are outside our hands, and you should direct requests about them to the companies that hold them. Stripe holds your payment details and email address under its privacy policy. Anthropic's limited retention of API inputs and outputs is covered by its privacy policy. Netlify's request logs are held by Netlify as our host. Without an account or any identifier, neither we nor they can reliably tie a specific conversation to you. Write to us at chris@vireoworks.com if you want help understanding this, and we will do what we can, which is mostly to explain and to pass on what we are able to.

Security

The site is served over HTTPS, and our API key for the model is held on the server and never sent to your browser. The strongest protection here is structural rather than technical: we do not keep your conversation, so there is nothing on our side to be lost or stolen. No system is perfectly secure, and we cannot promise otherwise.

Changes to this policy

If the site changes in a way that affects this description, we will change this page and update the date at the top. Significant changes will be stated plainly rather than buried. This page describes what the site actually does; if you ever find it does not, tell us and we will fix one or the other.

Contact

Questions about this policy: chris@vireoworks.com.