Privacy Policy
Last updated August 24, 2026 · Vellum, an app by SHIRO Technologies LLC
The short version. We do not sell your personal information. We do not show ads. We do not use your notes to train models. When you are signed in, your notes are stored in our cloud database so they can sync between your devices — which means we hold them, and they are not end-to-end encrypted.
1. Who we are
Vellum is operated by SHIRO Technologies LLC, 5080 Spectrum Drive, Suite 575E, Addison, TX 75001, United States. You can reach us at privacy@shiroapps.com.
2. Where this policy applies
Vellum is offered in the United States only. It is not directed at people outside the United States, and we do not currently offer it in the European Economic Area, the United Kingdom, or elsewhere.
3. Age requirement
Vellum is for people 13 years of age and older. We do not knowingly collect personal information from children under 13. If you believe a child under 13 has created an account, email privacy@shiroapps.com and we will delete it.
4. What we collect
Information you give us
- Account details — your email address, and a password or third-party sign-in identifier.
- Your notes — the content you write, plus titles, tags, and timestamps.
- Billing details — if you subscribe, our payment processor collects your payment information. We receive a customer identifier, the plan, and the status of the subscription. We never see or store your full card number.
Information collected automatically
- Basic technical data — IP address, device and browser type, and timestamps, used for security, abuse prevention, and diagnosing errors.
- Aggregate usage counts — for example how many notes sync in a day, so we can size the service. This is not tied to the content of your notes.
5. How your notes are stored
When you use Vellum signed out, notes stay on your device.
When you are signed in, your notes are transmitted over TLS and stored in our cloud database, hosted in the United States, so that they can sync between your devices. Data is encrypted in transit and at rest by our hosting provider.
Please read this carefully. Vellum is not end-to-end encrypted. Because we operate the database that stores your notes, it is technically possible for us to access their contents. We restrict that access to a small number of people, and only for reasons listed in section 6. If you need end-to-end encrypted storage, Vellum is not the right tool today, and we will say so plainly here if that ever changes.
6. When we access or disclose your information
We access the contents of notes only when one of these applies:
- You ask us to, for example when you report a bug and give us permission to look.
- We must, to investigate a security incident or abuse of the service.
- We are required to by law, such as a valid subpoena or court order.
We share personal information with service providers who help us run Vellum — cloud database and hosting, payment processing, and error monitoring. They may only use it to provide those services to us.
We do not sell your personal information, and we do not share it for cross-context behavioral advertising.
7. What we do not do
- We do not sell or rent your personal information.
- We do not show advertising in Vellum.
- We do not use the contents of your notes to train machine learning models.
- We do not use third-party advertising trackers.
8. Your California privacy rights
If you are a California resident, the CCPA/CPRA gives you the right to know what personal information we collect and how we use it, to request a copy, to request correction, to request deletion, and to not be discriminated against for exercising these rights.
We do not sell personal information and we do not share it for cross-context behavioral advertising, so there is nothing for you to opt out of — but you may still make any of the requests above.
To make a request, email privacy@shiroapps.com from the address on your account. We will respond within 45 days. You may use an authorized agent; we may ask you to verify the request.
9. Keeping and deleting data
We keep your notes for as long as your account exists. You can delete individual notes at any time, or delete your whole account, which removes your notes from our active systems. Backups are rotated out within 30 days. We may keep limited billing records where tax and accounting law requires it.
10. Security
We use TLS in transit, encryption at rest, access controls, and audit logging. No service can promise perfect security, but if a breach affects your information we will notify you as required by law.
11. Changes to this policy
If we make a material change we will update the date at the top and, for significant changes, notify you in the app or by email before it takes effect.
12. Contact
Privacy questions: privacy@shiroapps.com
General support: support@shiroapps.com
SHIRO Technologies LLC, 5080 Spectrum Drive, Suite 575E, Addison, TX 75001