Privacy Policy

Last updated: 9 September 2026

Vireo is a companion for prayer and reflection, built on a large language model. This page explains what the site collects, what happens to a message you send, and — just as important — what is not private about it.

There is no account to make, and no record of your conversation on our side. The site does keep two small records that are not your words — a daily count of free questions, and, if you subscribe, a note that your subscription is paid up. Both are described exactly below.

In this policy, "we" means OPERATOR_ENTITY_PLACEHOLDER, which operates vireoworks.com.

In short

There are no accounts. No sign-up, no login, no password.
Nothing you write is stored on our servers or written to our logs.
We keep two small records that are not your words: a daily count of free questions, against a scrambled form of your network address; and, if you subscribe, a record that your subscription is paid up.
If you subscribe, Stripe takes the payment. Your card details and your email address go to Stripe and never reach us.
Your conversation lives in your browser tab and ends when you close it.
To answer you, every message is sent to Anthropic, which runs the model. That is how the site works.
Nothing here is covered by the seal of confession, by clergy-penitent privilege, or by any other privilege. That point has its own section below, because it matters more than the rest of this page.

This is not confession

What you write to Vireo is not confidential in the way confession, or a conversation with your pastor, is.

There is no pastor or priest here. There is no seal of confession, no clergy-penitent privilege, and no professional confidentiality of any kind. Vireo is software. Your words are processed by a third-party AI provider in order to produce a reply. We have built the site to hold on to as little as possible, but "as little as possible" is not the same as protected.

So write as though a third party will process what you send, because one will. If something belongs with your pastor or priest — or, in the churches that practise it, in the sacrament of confession — bring it to them. If a detail could harm you or someone else in the wrong hands — a name, an address, an accusation, an illness, an offence — please leave it out. You can bring what is actually on your heart without naming names, and the companion works perfectly well that way.

No accounts

You do not identify yourself to use this site, and we do not ask you to. We collect no name and no phone number, and we never ask for your email address. There is nothing to log in to, no profile, and no conversation history to come back to. We do not build a picture of you across visits.

If you subscribe, Stripe asks for an email address so that it can send you receipts, and keeps it. It does not reach us. If you write to us — to report a mistake, or to recover a lost key — we will of course have the address you write from.

What happens to a message you send

Step by step:

You type in your browser. The text stays in the tab — in the page's memory and in sessionStorage.
When you send it, your browser posts the current conversation to `/api/chat` on our server. It sends the earlier turns too, because the model needs them to follow the thread. There is no server-side memory it could read them from instead.
Our server holds that text in memory for the life of that single request and forwards it to Anthropic's Claude API.
Anthropic's model produces a reply, and our server streams it back to your browser as it is written.
When the request finishes, the copy in our server's memory goes with it. None of it is written to a database, a file, or a log: the one small store this site has holds only the counts and subscription records described below, and the code never writes a message into it.

The result is that we cannot look up your conversation, produce it later, or hand it to anyone, because we do not have it. When something fails on that route, our code records only the shape of the failure — that an upstream request returned an error, for example — never what was written.

Anthropic, the model provider

The model behind Vireo is Claude, made by Anthropic. Anthropic processes the inputs and outputs of each request on our behalf, under its commercial terms, so that a reply can be generated.

Two things are worth knowing. Anthropic states that it does not train its models on commercial API data by default. Anthropic may retain API inputs and outputs for a limited period for trust and safety purposes. Anthropic is a United States company, so this processing may take place outside your country.

We are not going to restate Anthropic's terms here, because it explains its own practices better than we can: see Anthropic's privacy policy.

Anthropic is an independent company with no connection to any church.

Vercel, our host

The site is hosted on Vercel. Like any web host, Vercel records standard request metadata in its platform logs — IP address, timestamp, the path requested, and the browser's user agent — for operations, reliability, and abuse prevention. This is the ordinary bookkeeping of serving a website, and it happens for every page you load.

We do not add the contents of your messages to those logs. Vercel is a United States company, so this metadata may be handled outside your country.

What your browser stores

A few small things, all on your own device:

sessionStorage, under the key `vireoworks.conversation.v1`, holds the conversation you are having, so that a refresh does not lose it. It belongs to that one tab and is discarded when the tab closes.
localStorage, under the key `vireoworks.disclaimer.v1`, records that you accepted the disclaimer, so you are not asked again on every visit. It stores only that you accepted, nothing else.
sessionStorage, under `vireoworks.draft.v1`, holds a question you typed on the homepage for the moment it takes to move to the chat page, and is deleted as soon as it is read. It is kept out of the page address on purpose, so that it never appears in your browser history or in our host's logs.
localStorage, under `vireoworks.subscriber.v1`, holds your subscriber key, if you subscribe. It is sent with each question so the server knows you are subscribed. It is the only proof of your subscription, so keep a copy of it.

To clear them: use the "Clear this conversation" control in the chat, which empties the conversation immediately. Closing the tab clears it too. To remove everything, clear site data for vireoworks.com in your browser settings — the disclaimer will then appear again the next time you visit. If you are a subscriber, copy your key first (it is on the Pricing page); clearing site data removes it from this browser, though not your subscription itself. If your browser blocks storage, the site still works; you will simply see the disclaimer each time and lose the conversation on refresh.

Rate limiting

To blunt casual abuse, the server applies a best-effort limit on how many requests one visitor can make in a short window. It works like this: the IP address on the request is combined with a random secret generated by the server and hashed. Only that hash and a count are held, in the memory of one server instance.

The secret is never written down and never leaves memory, so the hashes cannot be turned back into IP addresses, even by us. The counters are not stored in a database and are lost whenever the instance recycles. This is not a log, and it is not linked to anything you write.

The free allowance

Without a subscription you can ask a set number of questions a day. Counting them without accounts needs something to count against, and the only thing available is the network address your request comes from. So:

What is stored is a keyed hash of that address and the current UTC date, computed with a secret held on our server, next to a number: how many questions have been answered today. The address itself is not stored.
Because the date is part of the hash, the rows from different days cannot be linked to one another.
Each row is deleted automatically the day after the day it counts.
Only answered questions are counted. An error, or a reply that did not arrive, is not.

Two honest limits. First, someone who had both our server secret and a particular address could compute that address's row for today and read its count; that is as far as it goes, and it does not include anything you wrote. Second, people who share a network — an office, a university, some mobile carriers — share an allowance, and may find it runs out sooner.

These rows are held by our storage provider (Upstash, which also provides Vercel's key-value store), which processes them on our behalf.

Payments are handled entirely by Stripe. When you subscribe you are taken to Stripe's own checkout page; your card details, billing address and email address go to Stripe and never pass through our servers. Stripe processes them under its privacy policy.

To know that you have paid, we keep one record per subscription, held by the same storage provider:

a hash of your subscriber key (the key itself is never stored, so a copy of our records would not let anyone use your subscription);
the Stripe customer id and subscription id;
whether the subscription is active, and when the current billing period ends.

A Stripe customer id is not your name, but Stripe can connect it to the email address you gave them, so we treat this record as personal data. It is kept while your subscription runs and deleted automatically about a year after it last changed.

What we do not do

Not as a promise for the future, but as a description of the build as it stands:

No analytics, no advertising, no third-party trackers, no pixels.
No cookies beyond what is strictly needed to serve the site. Nothing is set to identify or follow you.
No marketing emails. We do not have your email address; Stripe has it, and uses it only for receipts and billing notices.
No selling or renting of personal information, and no sharing beyond the providers named on this page.
No profiling, no scoring, and no automated decisions about you.
No human at our end reading conversations, because none of them are kept.

Children and young people

Vireo is not directed to children under 13, and they should not use it. Anyone under 16 should use it only with a parent or guardian's knowledge and involvement.

We should be plain about the limits here. There is no age verification. The disclaimer you accept before your first conversation asks you to confirm your age, and that self-attestation is all the site can check. We do not knowingly collect information from children, and since we collect nothing tied to any user, there is no record for us to delete on request. A parent or guardian with a concern can write to us at CONTACT_EMAIL_PLACEHOLDER.

Your rights

Depending on where you live, you may have rights over your personal data — to ask what is held, to get a copy, to correct it, or to have it erased.

Honesty is more useful here than a list of procedures. We hold no stored conversation and no account. What we do hold is this:

The daily count of free questions. We cannot find "your" row without your network address and today's date, and it deletes itself within a day, so there is in practice nothing to produce.
A subscription record, if you subscribe. Send us your subscriber key, or the Stripe customer id on your receipt, and we can tell you exactly what the record says, correct it, or delete it. Deleting it ends your access, so cancel the subscription from the billing page first.

Some things are outside our hands, and you should direct requests about them to the companies that hold them. Stripe holds your payment details and email address under its privacy policy. Anthropic's limited retention of API inputs and outputs is covered by its privacy policy. Vercel's request logs are held by Vercel as our host. Without an account or any identifier, neither we nor they can reliably tie a specific conversation to you. Write to us at CONTACT_EMAIL_PLACEHOLDER if you want help understanding this, and we will do what we can, which is mostly to explain and to pass on what we are able to.

Security

The site is served over HTTPS, and our API key for the model is held on the server and never sent to your browser. The strongest protection here is structural rather than technical: we do not keep your conversation, so there is nothing on our side to be lost or stolen. No system is perfectly secure, and we cannot promise otherwise.

Changes to this policy

If the site changes in a way that affects this description, we will change this page and update the date at the top. Significant changes will be stated plainly rather than buried. This page describes what the site actually does; if you ever find it does not, tell us and we will fix one or the other.

Contact

Questions about this policy: CONTACT_EMAIL_PLACEHOLDER.