Privacy Policy
What personal information Vinc processes, why and for how long, who handles it for us, and how to reach the person responsible. The Korean text is the official version.
Effective 18 October 2026
Who processes your information
Vinc (vincs.io, the desktop app and the hosted connector at mcp.vincs.io) is run by an individual operator in the Republic of Korea. No company has been registered yet; when one is, this page will name it.
Privacy officer: the operator of Vinc (representative). Requests to see, correct or delete your information: support@vincs.io, with Privacy in the subject.
What we process, why, and for how long
We process only what you give us and what signing in needs. We never ask for your name, phone number or postal address.
| Information | Purpose | Basis | Kept for |
|---|---|---|---|
| Account: email address, internal id, public handle if you set one, plan, timestamps | Signing in and running the account | Contract | Until you delete the account |
| Sign-in request: a one-way hash of the link or code, the requesting IP address | Sending the sign-in link, stopping abuse | Contract, legitimate interest | 15 minutes; removed within a day |
| Sessions: a one-way hash, last-seen time | Keeping you signed in | Contract | 30 days unused, 90 days at most |
| Connector keys: a one-way hash, name, last-used time | Connecting assistants and the desktop app | Contract | Until revoked, then 90 days |
| Your graph: everything you add (nodes, documents and their search index) | The service itself | Contract | Until you delete it or the account |
| Teams: membership and role; invitations, which carry the invitee's email address | The Team plan | Contract; the inviter's legitimate interest | Membership until removal; invitations 90 days after they are settled, 97 days if never answered |
| Release news: email address, consent and its date | Sending release news | Consent | Until you unsubscribe, then 90 days. Addresses that bounced or complained stay on a do-not-send list |
| Payment: Paddle customer and subscription ids, plan, seats, payment events | Billing and tax records | Contract; legal obligation (Act on Consumer Protection in Electronic Commerce) | 5 years |
| Logs: request lines with the IP address and a hashed account id; operator access records with a hashed id | Security and fault finding | Legitimate interest; legal obligation | Request logs 30 days; operator access records 1 year |
| Public handle and community contributions: wiki page revisions (text, editor, time, edit summary, the channel web or connector and the client name) | Running Community and its page history, which is also the CC BY-SA attribution | Contract | As long as the page exists. After account deletion the revision stays with the editor shown as "deleted user" |
| Talk threads, lounge posts, comments, reactions | Running Community | Contract | Until you delete them or the account |
| Communities you created and your operator role | Running Community | Contract | Until you leave the role or delete the account; the community itself stays |
| Reports you file and reports about your content, moderation actions | Handling reports and takedowns, abuse prevention | Legitimate interest; legal obligation (Copyright Act takedown records) | 1 year after the case is closed |
| Agent and pack shares you publish | Sharing | Contract | Until you remove them; versions others took stay with them |
On your device, the desktop app keeps your key in the operating system's keychain (or, where that is unavailable, in the app's own storage, which Settings points out) and your email and handle in the app's storage. They stay there until you sign out or uninstall.
The desktop app
From version 0.9.4 the desktop app signs in to your account, with email or Google. By default it shows your account graph, the same one the web app shows: what you read, write, search for and import goes to vincs.io, and while the window is open the app checks for changes every few seconds.
Local mode, in Settings, keeps the graph in a folder you pick instead, and your account holds no copy of it. Switching between the modes moves the whole graph, and only after you confirm.
In either mode the app asks GitHub for a newer version when it starts; that request carries nothing of yours beyond the network address it comes from. The app has no analytics, no crash reporting and no telemetry.
Who handles it for us, and where
These companies process personal information on our behalf. Apart from the servers in Korea, they are abroad, so using Vinc means your information is transferred abroad for the storage and processing the service needs (PIPA Article 28-8(1)3). The transfer happens over encrypted connections whenever you use the service. You can refuse it only by not using the service, since it cannot run without them.
| Company (country) | Task | Information | Kept for |
|---|---|---|---|
| Microsoft Corporation, Azure (servers in Korea Central; the website front in East Asia, Hong Kong) | Hosting the servers, database, storage, logs and website | Everything listed above | As listed above |
| Resend, Inc. (United States) | Sending email: sign-in links, account notices, release news | Email address, subject and body | Delivery logs 30 days |
| Paddle.com Market Limited (United Kingdom; processing also in the United States) | Selling the Team plan as seller of record | Email address, our account id, the payment details you give Paddle | As tax law requires; Paddle also keeps its own records as seller |
| Cloudflare, Inc. (United States) | DNS, and delivering mail sent to support@vincs.io | The messages you send us | In transit only |
| GitHub, Inc. (United States) | Hosting the desktop downloads and answering the update check | The network address of the request | Under GitHub's own terms |
If you sign in with Google, Google LLC (United States) confirms your email address under its own terms, and we receive only that address and the fact that Google verified it.
For people in the EU and the UK: Vinc processes in the Republic of Korea, which the European Commission (Implementing Decision (EU) 2022/254) and the United Kingdom (Adequacy Regulations 2022) recognise as providing adequate protection. Our email provider in the United States is bound by standard contractual clauses. We have not yet appointed an EU or UK representative; we will before the first paying team in the EU, and this page will name it.
Who else sees it
We do not sell your information or provide it to third parties. Four kinds of recipient see parts of it because you choose them:
- The assistant you connect (Claude, ChatGPT, Cursor or another host) receives the results of the tools it calls, and that host's own terms govern what it does with them.
- Members of a team you join see your email address and what you add to the team graph. What you add stays with the team if you leave or delete your account.
- A pack you publish to the gallery is public under your handle. Copies other members took stay with them after you unlist it.
- Everyone. What you publish in Community (your handle, wiki edits, talk, lounge posts, comments, shared agents and packs) is public, readable without an account, and readable by assistants through Vinc's connector and by search engines.
Your rights and how to use them
You can ask to see, correct or delete your information, ask us to stop processing it, take a copy of your graph, and withdraw consent to release news at any time. Most of this you can do yourself: edit or delete anything in your graph in the app, export it as a pack, unsubscribe from any release mail, and delete the account at vincs.io/account.
For anything else write to support@vincs.io with Privacy in the subject. We answer within 10 days (within one month for people in the EU and the UK), and if we cannot do what you asked we say why and how to object. Someone may act for you with your written authority. For a team graph we pass the request to the team's admin, who decides for the team.
If you think your rights were infringed you can also go to: the Personal Information Dispute Mediation Committee (1833-6972, kopico.go.kr), the Personal Information Infringement Report Center (118, privacy.kisa.or.kr), the Supreme Prosecutors' Office (1301, spo.go.kr) or the National Police Agency (182, ecrm.police.go.kr). In the EU and the UK you can complain to the supervisory authority where you live.
Deleting, and what stays for a while
When a retention period ends, or you delete your account, we delete the information from the live systems for good; it cannot be restored. Deleting the account also erases your hosted graph through a signed request to the graph server. If that erase cannot be confirmed the account is kept and the deletion is retried, so the account never goes while the graph stays. We keep no paper records. Afterwards some copies remain, each for a limited time:
- Backups of the account database: up to 7 days.
- The graph server's rolling snapshot: minutes to hours.
- Request logs and our email provider's delivery logs: 30 days.
- Payment records: 5 years, as the law requires, kept apart and used for nothing else.
- What you added to a team graph stays with that team.
When you delete your account, your wiki page revisions stay in Community with the editor shown as "deleted user", because the page history is how the licence's attribution is kept and others' later edits build on yours. The link to your handle and email is removed. Talk threads and lounge posts you started are kept so that the comments others wrote under them remain, but we clear their title and text and show the author as "anonymous user". Your comments and reactions are deleted. Agents and packs you shared are withdrawn; versions others already took stay with them.
Cookies and browser storage
vincs.io sets four first-party cookies, all needed to sign in: a 15-minute sign-in-flow cookie, the session cookie (30 days after last use), a cross-site request token (30 days) and a 30-minute cookie on our operator console. Your browser's storage also keeps your theme and language. There are no third-party cookies, no advertising and no analytics. You can block or delete cookies in your browser's settings; signing in will then not work.
How we protect it
- Every connection is encrypted.
- There are no passwords. Sign-in tokens, sessions and connector keys are stored on the account only as one-way hashes.
- Every read and write in the hosted graph is limited to its owner, and a team graph to that team's members.
- Only the operator can reach the production systems. Each access is recorded, the records are kept for a year, and they are reviewed every month.
- Servers, the database and backups sit in Microsoft Azure's Korea Central region behind access controls.
Children
Vinc is not for anyone under 14. If we learn that an account belongs to someone under 14, we delete it.
Changes to this policy
We announce changes on this page at least 7 days before they take effect, and at least 30 days before for a change that takes away something you had, with an email to account holders.
History: 18 October 2026, this version (adds Community, announced on 11 October 2026); 27 September 2026, the statutory policy, replacing the working draft of 18 July 2026.
No advertising, no analytics, no selling. Questions: support@vincs.io.