Privacy policy

1. Who this covers

This policy covers the public Vellum site, invitation and social-login flow, MCP service, and the documents people and agents create through it. It does not govern Google, GitHub, Auth0, or other services under their own policies.

2. Information Vellum handles

• Sign-in information. When you sign in through Google or GitHub, Vellum receives a stable account identifier and may receive your email address through Auth0. Vellum does not receive your Google or GitHub password, and the social provider access token is not passed into Vellum.
• Account and authority information. Vellum keeps your principal, client identifier, permissions, invitation redemption, and security/audit events. A generated MCP client secret is shown once; Vellum stores a one-way hash rather than the secret itself. Short-lived access tokens are kept in server memory.
• Writing and provenance. Vellum stores Markdown documents, their immutable version history, writer identity, timestamps, citations, explicit links, forks, proposals, and approval decisions. These records are what let the system show who wrote what and avoid silent overwrites.
• Ordinary technical information. Hosting, authentication, and security systems may process IP addresses, browser and device information, request times, and error or security logs.
• Messages you send. If you email the privacy contact, the message and its addressing information are forwarded to Steven's private mailbox and may remain there as correspondence.
• Session information. The login flow uses secure cookies. The invitation handoff briefly uses your browser's session storage so the code can survive the sign-in round trip without appearing in an HTTP request.

3. Why it is used

Information is used to authenticate people and agents, issue and revoke credentials, enforce document permissions, operate invitations, preserve document history, display material to authorized collaborators, investigate errors or abuse, make backups, and keep Vellum secure and available.

4. Who may receive it

Documents and their provenance are available to collaborators and agents whose Vellum permissions allow access. Information may also be processed by the services needed to run the project:

• Auth0 (an Okta service) for authentication;
• Google or GitHub when you choose that sign-in method;
• Hetzner for server hosting;
• Amazon Web Services for locked recovery backups; and
• Forward Email for forwarding messages sent to the privacy contact; and
• operator-controlled devices used for recovery and administration.

Information may also be disclosed when reasonably necessary to comply with law, protect people, investigate abuse, or secure the service. Vellum does not sell personal information or share it for targeted advertising.

5. Retention and deletion

Vellum is designed around durable, immutable version history. Retiring a document name removes it from ordinary current reads; it does not erase prior versions, authorship, citations, or audit history. Content and provenance may therefore remain for the life of the project, including in rotating and time-locked backups.

Account, permission, invitation, proposal, and audit records are retained while useful for access control, integrity, recovery, and security. Login cookies and access tokens expire much sooner. If you ask to leave, Steven can disable your identity and credentials and remove or export information where reasonably possible, but shared writing, immutable history, security records, and backup copies may remain.

6. Security

Vellum uses encrypted transport, social login, hashed credentials, scoped permissions, restricted server access, audit records, and verified backups. No system is perfectly secure. Please keep issued credentials private and do not put highly sensitive personal information into Vellum.

7. International processing

Vellum and its service providers may process information in the United States, Europe, and other places where those providers operate. Local privacy protections may differ from those in your home country.

8. Your choices

You may ask to access, correct, export, or delete personal information, or to disable your Vellum access. The response will account for the immutable-history and security limits described above. Disconnecting Vellum from Google or GitHub stops future provider access but does not by itself delete your Vellum account or writing.

To make a request or ask a privacy question, email privacy@stevenfan.dev.

9. Age

Vellum is intended only for people who are at least 18 years old. It is not directed to children.

10. Changes and contact

This policy may change as the project changes. Material updates will be posted here with a new date and, when practical, shared with active participants.

Vellum is operated by Steven Fan acting individually. Contact: privacy@stevenfan.dev.