Security details

Vidura helps you care for relationships using contacts you choose to add and source-backed public moments. You review every message and send it yourself. This owner-authored page describes current product behavior and outstanding reviews; it is not a certification, independent security assessment, or final legal privacy notice.

Your contacts and your choices

LinkedIn ZIP and CSV exports are decoded in your browser; imported relationship records are then stored with your account. Vidura does not scrape LinkedIn or X and does not automatically contact your network. Growth-sharing features remain unlaunched.

What is stored and processed

Account identity, uploaded or manually added contacts, relationship context, employment history, buckets, moments, drafts and activity are stored. Scans send selected names and companies to the configured search service. AI features send relevant contact and moment context; Ask Vidura may include location, relationship strength and why someone matters. Do not add sensitive information you do not want processed by those services.

Export and deletion

Settings provides relationship CSV exports and an owner-data JSON download. The download covers app-accessible account, relationship and usage records, not every provider record or backup. A confirmation is required for account deletion. Provider copies, backup expiry and legally retained financial records require separate owner-reviewed procedures. Account deletion does not itself cancel a paid subscription; use Plan & Usage to manage it first.

Security and encryption: evidence still needed

Private data access is restricted in the application and database. App service integrations use HTTPS URLs. Production transport settings, database and backup encryption, key management and operational access still require provider configuration evidence. No application-level field encryption or end-to-end encryption is implemented. We do not claim independent certification, verified encryption coverage or regulatory compliance.

Sign-in and assessments

Sign-in options are Google, Apple and Microsoft. The app requests no additional Google data scopes in its sign-in code. Actual granted scopes, OAuth branding and Google verification status need owner/provider confirmation. CASA applicability depends on exact scopes and Google’s requirements; no assessment is claimed. The current repository is web/PWA only, so Google Play MASA is not applicable to this build; reassess if a native Android app is introduced.

Retention, consent and third parties

The owner still needs to approve retention periods, backup deletion procedures, lawful bases for third-party contact data, and a final processor register. The code integrates Lovable Cloud, Lovable AI, Stripe, optional Exa/Serper/Tavily search, and Google-hosted fonts. Actual enabled providers, contracts, processing locations and provider retention/training settings are not yet verified. Google, Apple and Microsoft also participate as sign-in providers.

Privacy requests and reporting concerns

Use Settings for available export and account-deletion controls. An owner-approved privacy/security contact and complete legal notices are pending before public launch. This page does not substitute for those notices.

Owner-authored product information · Reviewed against code on October 15, 2026 · External verification pending