Privacy Policy

What We Collect

This website sets no cookies and makes no analytics requests unless website analytics has been enabled for a deployment and you explicitly allow it. The default Varve build has analytics disabled. If enabled, the site sends only normalized page routes and the small, enumerated properties described in thetechnical analytics disclosure.

The desktop app sends no usage stats. The website and the browser demo use GoatCounter only after you click Allow. The demo records launches, export formats, and download clicks. Nothing about your design is sent: no layer names, text, filenames, sizes, or document data.

The one thing we can see is what any web host sees: the requests its own server logs record. We do not aggregate, analyse, or retain those beyond what the hosting provider does by default.

Download counts also come from GitHub's own release statistics, which count downloads per file. They tell us how many people downloaded a build. They do not tell us who.

What We Don't Collect

• No cookies
• No analytics without an explicit Allow choice on the website or browser demo
• No browser fingerprinting
• No marketing or advertising trackers
• No social media tracking pixels
• No accounts or personal data required for core editing

Analytics never includes design contents, filenames, filesystem paths, text, images, document names, clipboard data, arbitrary URLs, or persistent identifiers.

The Application

Varve is a local-first design application. Core editing data stays on your machine. There is no mandatory cloud sync, no user accounts, and no authentication system. Nothing is sent unless you say yes. Model downloads, online font/icon search, user-configured providers, and update checks are separate network features.

The desktop app sends no usage stats. Diagnostics telemetry and crash reporting are separate consent choices. Your designs belong to you and remain on your device.

Update checks are consent-based. Varve does not contact any update server unless you choose to allow it (Settings > Updates, or the first-launch question "Keep Varve up to date?"). A check sends only your current version, platform, architecture and release channel to Varve's release endpoint; no account, document data, machine identifier or device fingerprint. Declining means no background checks. You can still check for updates manually, and you can revoke or change the choice at any time.

Update Checks

Desktop update checks are a separate consent choice from analytics, diagnostics, and crash reporting. If enabled, a check sends the current Varve version, platform, architecture, and selected release channel to the configured HTTPS release endpoint so it can return a compatible update. It does not send an account, document contents, filenames, filesystem paths, project data, or a device identifier.

The endpoint still receives ordinary network metadata such as an IP address. Update downloads are not installed silently: supported builds verify the update signature before installation, and package-managed or unsupported builds remain on their manual update path. See the Updates guide for the package-specific behaviour.

Data Storage

Varve stores your design data locally:

• Desktop (Tauri): SQLite database stored in your system's standard application data directory. No data is transmitted to external servers.
• Web (WASM): IndexedDB in your browser. Data persists in your browser's local storage and is not synced anywhere.

Local-only storage is the default. If you explicitly use a network feature, such as downloading a model, searching an online font/icon provider, configuring a cloud provider, or opening GitHub to file an issue, that feature's provider receives the data needed for that action. Core editing does not upload design content automatically.

Third-Party Services

Varve uses the following third-party services, each with its own privacy policy:

• GitHub for issue tracking, discussions, source code hosting, and release distribution. See GitHub's Privacy Policy.
• GoatCounter for consented website and browser-demo counts after you click Allow. See GoatCounter's privacy policy.

Optional website and browser-demo analytics use GoatCounter only after a fresh consent choice and deliberate production configuration. We send normalized routes, referring site origins, installer-link click categories, demo launches, export formats, and demo download clicks. A short campaign tag from our own links may be recorded with an opted-in visit. Other URL queries, page titles, design data, screen dimensions, and persistent identifiers are not sent. Session identification and individual-pageview storage are disabled in the provider account; only aggregate counts are retained. The provider necessarily receives network headers and IP addresses to serve requests, but these are not stored as visitor identities. Download clicks are not installations. See GoatCounter's privacy policy.

Consent and choices

Website analytics starts in an unknown state and fails closed. A visitor can choose “Not now” or “Allow website analytics”; the choice is stored locally only so the prompt does not reappear. Global Privacy Control and Do Not Track block website analytics. The desktop app sends no usage stats. Diagnostics telemetry and crash reporting stay separate controls and can be changed at any time.

Retention and access

The client keeps only a bounded in-memory queue and discards it on shutdown. Operational retention for GoatCounter follows the configured account policy. Only aggregate event counts are retained. Access is limited to authorized maintainers, with provider account security and deletion procedures handled as an operational responsibility.

Your Rights

Because we collect minimal data, there is little to access, modify, or delete. For privacy questions, consent requests, or concerns about data handling, emailprivacy@varve.studio. Public questions that contain no personal information can also use GitHub Discussions.

Changes to This Policy

This privacy policy may be updated as the project evolves. Changes will be posted on this page with an updated "Last updated" date. For significant changes, a notice may be posted in the project's GitHub discussions.

Contact

For privacy-related questions or concerns, contactprivacy@varve.studio:

• Start a GitHub discussion