Privacy Policy
Last updated: July 10, 2026
VegaHed (“we”, “our”) is a personal knowledge vault: you save links, we fetch their metadata, categorise them with AI and make them searchable — for you. This page explains what data we handle, why, and the choices you have. It covers the website (vegahead.com), the app (app.vegahead.com) and the VegaHed browser extension.
What we collect
- Account information — your email, display name and, if you sign in with Google, the profile name and picture Google shares. Passwords for email sign-up are stored only as bcrypt hashes.
- Saved records — the URLs you choose to save and the metadata we fetch for them (title, description, preview image, site icon) plus the category assigned to them.
- Short links — the slugs you create and their target URLs. Public links (
/to/…) are reachable by anyone who has the link until they expire after 7 days. - Operational data — transactional email logs (type, recipient, delivery outcome) and short-lived rate-limit counters that protect the service from abuse.
The browser extension
The extension only acts when you use it. When you save a page it reads that page’s title, descriptive meta tags and icon references (roughly 1 KB) and sends them to our API so we can skip re-fetching the page. It does not track your browsing, does not read page content beyond the metadata above, and stores no tokens — it uses the same signed-in session as the website.
AI processing
To auto-categorise a save, the URL and its fetched title/description are sent to Google’s Gemini API. They are used to pick a category and are not used by us to train models.
Third-party services
- Google Sign-In — optional authentication.
- MongoDB Atlas — database hosting (records, accounts).
- Google Gemini — AI categorisation, as above.
- Resend — transactional email (welcome, password reset, link-expiry reminders).
- Google AdSense — we show ads on some signed-in pages. Google and its partners may use cookies or device identifiers to serve and measure ads; where required we ask for your consent first. See Google’s advertising policy and Ads Settings.
Cookies
We set one essential cookie: your session (httpOnly, used to keep you signed in). Theme preference is kept in your browser’s local storage. Advertising cookies, if any, come from Google AdSense as described above.
Retention & deletion
Your records stay until you delete them. Public short links expire after 7 days. Password reset tokens expire within an hour. Deactivating your account (Settings → Danger Zone) disables sign-in and deletes your saved records. For full account erasure, contact us.
Security
Passwords are hashed with bcrypt, sessions are signed JWTs in httpOnly cookies, all traffic uses HTTPS, and every data query is scoped to your account. No system is perfectly secure, but we follow current good practice and fix reported issues promptly.
Contact
Questions or requests: anhkhoa.wm@gmail.com. We’ll update this page as the product evolves and change the date above when we do.