WEBSITE / LAST UPDATED OCTOBER 4, 2026
Your information,
explained plainly.
This notice covers vrspi.com, Vrspi accounts at auth.vrspi.com, and the downloads and update checks the runtime makes.
Who operates this website
Vrspi is operated by Khaireddine Dalaa. For questions about your information, contact vrspi33@gmail.com.
When you create an account
You need a free account to run Vrspi, though not to download it. When you create one, our account server at auth.vrspi.com stores your email address, your first and last name, a salted hash of your password (never the password itself), whether you have confirmed your email address, when the account was created, and your active sign-in sessions. Repeated failed sign-ins are counted so the account can be protected against password guessing.
We use these details to sign you in, to confirm your email address, to let you reset your password, and to tell you about Vrspi modules tied to your account. We do not sell them or use them for advertising.
Emails we send
Account emails, such as the address confirmation and password reset, are sent from no-reply@vrspi.com through Brevo, an email delivery service, which processes your address and the message to deliver it. We may also write to you directly about your account, or send a notice to every account about a service matter such as security or these terms.
Release announcements go only to people who ticked “Email me when a new Vrspi version is released”, at sign-up or later in their account settings. Every announcement has a one-click unsubscribe link, and you can change the choice at any time in the account console.
We keep a record of the emails we send you (subject, date, and whether delivery succeeded) so we can answer questions about them.
Cookies
The public site does not use advertising trackers or analytics scripts. When you sign in, vrspi.com sets vrspi_session, a signed, HttpOnly cookie that keeps you signed in for up to seven days and holds your account ID, name, email address, and sign-in token. During sign-in it briefly sets vrspi_oidc, which expires after ten minutes. The account server at auth.vrspi.com sets its own session and security cookies while you use it. The private CMS uses a session cookie for administrator sign-in.
Signing in from the terminal
When you sign in from the Vrspi terminal app, it keeps a session token in account.json in its configuration folder, readable only by your user. It sends that token to auth.vrspi.com about every 12 hours to confirm the account is still active; vrspi logout deletes the file and ends the session on our server.
Downloads and update checks
The installers, vrspi update, and the runtime’s update check request the release manifest and binaries from vrspi.com. Like any web request, these reach our server logs with your IP address, the requested URL, and your browser or client information. On the same schedule, the runtime also downloads updated agent-detection rules from herdr.dev, which is run by the Herdr project that Vrspi is built on; that request reaches their servers under their policies. The runtime does not send your code, prompts, or terminal contents to us or to them. To turn off both background checks, set manifest_check = false under [update] in your config.toml.
Storage and access
The website, the account server, and their databases run on our server, hosted by Contabo. Account data is accessible to our administrators through an administration console that requires a password and an authenticator code, and every change made there is recorded in an audit log. Hosting and web-server logs may include technical request information such as IP addresses, URLs, and browser information for operation and troubleshooting.
Your choices
You can change your name, email address, or password, sign out of other sessions, and delete your account from the account console. Deleting your account removes it from the live account database; copies in existing server backups are not removed immediately. You can also email vrspi33@gmail.com from your account’s address to ask for a copy of your data, a correction, or deletion.
Earlier early-access requests
Before Vrspi shipped, we collected early-access requests: name, email address, operating system, agent selections, a workflow description, and the date and consent version. That form is closed. Existing requests stay in the website’s database until removed; email us to have yours deleted.
The runtime and external services
Vrspi runs on your machine. The coding agents you use in it handle data under their own providers’ settings and policies. The interactive demo on this website is an illustration and does not connect to agents or execute terminal commands. External links on this website lead to services with their own privacy practices.