Skip to main content
Vayli Logo
Legal & Privacy

Privacy Policy

Published by Modi Studio (India) · Effective Date: October 2026

1. Core Principle: On-Device & Private by Design

Vayli is an offline-first Windows desktop utility. We do not require an account, email sign-up, or profile creation to use the app. Your files, notes, copied content, and usage metrics are stored locally on your PC.

2. What Stays on Your PC (Per Tool)

All persistent user data is kept locally on your machine in %LocalAppData%\Vayli\:

  • Clipboard History: Copied text, links, and image thumbnails are stored in clipboard\history.json, encrypted using Windows Data Protection API (DPAPI, tied to your Windows user login). Vayli explicitly ignores sensitive content from password managers by skipping items marked with Clipboard Viewer Ignore, ExcludeClipboardContentFromMonitorProcessing, or CanIncludeInClipboardHistory = 0. Content is capped at 1 MB per text snippet, 5 MB per image (50 MP max), 500 unpinned items, and a 200 MB total disk cap, with automatic 7-day or 30-day retention pruning.
  • Notes: Note titles, text content, and timestamps are stored locally in plain JSON in notes.json.
  • File Shelf: Copies of files you park on the notch are stored in shelf\stored\ (default capacity of 20 files).
  • Screen Time: Active application process names (e.g., code.exe), window titles, and daily active durations in seconds are stored locally in screentime.json (last 7 to 30 days). Vayli does not log keystrokes, record your screen, or monitor mouse clicks.
  • Calendar & Reminders: Cached event entries are stored in events.json. Any webcal feed URLs you add are encrypted with DPAPI.
  • Links & Quick Search: Saved bookmarks, custom search engine templates, and click counts are stored in links.json.
  • AI Coding Usage: Token counts and session timestamps are read strictly from local session logs on your disk (such as Claude Code or Codex CLI files) and stored in aicoding\events.tsv. No prompt text, code snippets, or project contents are ever read or transmitted.

3. What Is Sent and When (Outbound Connections)

Vayli does not run background analytics pings. Network requests occur strictly via standard HTTPS for the following explicit purposes:

  • License Activation & Validation (Dodo Payments): When you activate a purchased license key in Settings → License, the app contacts https://live.dodopayments.com/licenses/activate sending your license key and your local computer name (Environment.MachineName) to register the device instance. Periodic validation requests send only the key and instance ID. When you choose "Deactivate this PC", a release request is sent to /licenses/deactivate.
  • Free Trial Check: In trial mode, Vayli checks our trial server to establish your 3-day trial period. The request transmits only a one-way, salted SHA-256 hash of your Windows MachineGuid (vayli-trial-device-v1|<MachineGuid>). Your actual Windows MachineGuid, serial numbers, and personal identifiers are never transmitted.
  • Weather Forecasts & Geolocation: If the Weather tool is enabled, Vayli queries Open-Meteo (api.open-meteo.com) for local temperature, conditions, and UV index. When automatic location is turned on, coordinates are resolved via Windows Location and locality names via BigDataCloud (with an IP-based fallback if GPS is unavailable). You can turn this off at any time by selecting a manual city or disabling the Weather tool.
  • Currency Rates: When using the Currency converter in the Units tool, exchange rates are fetched from open.er-api.com every 12 hours with a standard User-Agent: Vayli header. No user identifiers are sent.
  • Calendar Feeds: Public holiday feeds from Google Calendar and any custom webcal:// or https:// calendar feeds you configure are fetched directly on an hourly schedule.
  • Link Favicons: When you copy a URL with link preview enabled, Vayli fetches the website's favicon using Google's public favicon service (google.com/s2/favicons?domain=...).
  • User-Connected Integrations: Only if you explicitly add credentials: Stripe connects to api.stripe.com with your restricted key to display payout balances. Plausible, DataFast, or Google Analytics connect to their respective APIs using your API tokens or Google OAuth2.

4. What Is NOT Collected

  • No Telemetry or Usage Tracking: The application contains zero analytics trackers, usage analytics, or background telemetry SDKs. We do not track feature usage, launch counts, session durations, or user behavior.
  • No Advertising: There are no advertisements, trackers, or marketing SDKs.
  • No Keystroke or Input Hooks: Vayli does not use low-level input hooks (SetWindowsHookEx is never called). Global shortcuts use standard RegisterHotKey, and Screen Time uses Windows foreground window events (SetWinEventHook).
  • No Camera or Microphone Access: Vayli contains no camera, microphone, or audio recording capabilities.

5. Payment Processing (Merchant of Record)

All order transactions, currency processing, and invoice generation are conducted by our online Merchant of Record, Dodo Payments. Dodo Payments handles billing data, payment cards, and applicable taxes (GST/VAT). Modi Studio does not store, process, or view your credit card details or payment credentials.

6. Local Diagnostics & Crash Reports

If Vayli encounters an unexpected failure, diagnostic reports are recorded locally in %LocalAppData%\Vayli\logs\crashes\.

  • Reports are strictly capped at 10 files (max 16 KB per report).
  • They contain only the app version, Windows version, active tool, and technical stack frame tokens. Exception messages, user content, file paths, and memory dumps are strictly excluded.
  • Diagnostics are never automatically uploaded.
  • In Settings → About, "Copy diagnostics" copies the summary to your clipboard, and "Export diagnostics" creates a scrubbed zip on your Desktop so you can inspect it before sending it to support.

7. How to Delete Your Data

You have complete control over your data:

  • In Settings → Privacy: You can clear individual categories (Clipboard history, Notes, Shelf files, Screen Time, Calendar, etc.) at any time, or click Clear all data… to wipe all application data from your PC and restart as new.
  • Uninstall Behavior: The standard installer removes the program binaries from %LocalAppData%\Programs\Vayli and removes the startup entry. To prevent accidental data loss during upgrades, user files in %LocalAppData%\Vayli\ and credentials in Windows Credential Manager remain intact until manually deleted. The Microsoft Store (MSIX) package removes application binaries upon uninstall; generic credentials in Credential Manager persist.
  • For complete removal: Open Settings → License and choose "Deactivate this PC", then open Settings → Privacy and choose "Clear all data…" before uninstalling the application.

8. Children's Privacy

Vayli is a general desktop productivity tool and does not knowingly collect any personal information from children under the age of 13.

9. Changes to This Policy

If our data handling practices change, we will update this document and the effective date above. We encourage you to review this page periodically.

10. Publisher Information & Contact

Vayli is published by Modi Studio, based in India. For any questions regarding this privacy policy or your data, please contact:

[email protected]