Privacy Policy

Last updated: September 2026

This policy explains what Vynelio collects, why, and what control you have over it. It's written in plain language on purpose — if anything is unclear, ask us on Discord.

What we collect

• Account info: your email, username, display name, and a bcrypt-hashed password (we never store or see your actual password).
• Profile info: your profile picture — either a link you paste or a photo you upload, which is resized on your device before it's sent to us.
• Activity data: focus sessions, tasks, projects, study time, XP, levels, streaks, and unlocked achievements — this is the data the whole platform runs on.
• Social data: friend connections and the rooms you create, join, or moderate, including the room's shared timer and event log.
• Assistant conversations: messages you send to the AI assistant, which are forwarded to OpenAI to generate a response (see “Third parties” below).
• Optional connections: if you link Discord or Twitch, we store your platform username and ID, and an access token (encrypted at rest) needed to keep the connection working. You can disconnect either at any time.
• Technical data: IP address and basic request metadata, used only for security, abuse prevention, and rate-limiting login/signup attempts.

What we don't do

We don't sell your data, and we don't run advertising or third-party tracking on Vynelio. See our Cookie Policy for the specifics on cookies and local storage.

Third parties

A few features rely on outside services, each governed by their own privacy policy:

• OpenAI — powers the AI assistant and AI-generated flashcards/weekly reviews. Anything you type into the assistant is sent to OpenAI's API to get a response.
• Discord & Twitch — if you choose to connect an account, the sign-in itself happens on their site under their own privacy terms.
• Infrastructure providers — our hosting, database, and realtime-messaging providers process data on our behalf purely to run the service; they don't use it for their own purposes.

How we protect it

Passwords are hashed with bcrypt, never stored in plain text. Discord/Twitch access tokens are encrypted at rest. All traffic to Vynelio is served over HTTPS.

Your data, your control

You can update or remove most of your info yourself from your profile settings — including disconnecting Discord/Twitch, leaving rooms, and removing friends. You can request full deletion of your account and associated data at any time by contacting us; we'll process it without unnecessary delay.

Children's privacy

Vynelio isn't directed at children under 13, and we don't knowingly collect data from them. If you believe a child has created an account, contact us and we'll remove it.

Changes to this policy

If this policy changes in a meaningful way, we'll update the date at the top of this page. Continued use of Vynelio after a change means you accept the updated policy.

Contact

Questions about this policy or your data? Reach out here.