Scope
This policy is published by Wevir Labs LLC, a software company registered in the United States ("we"). It covers wevirlabs.com, wevir.si and the software we publish: Wevir (desktop, command line, iOS and Android apps, and the push gateway and relay they use), XuyiX, Edgeweir, ClashMax and iSquat.
Where a product shows its own privacy notice in the product or on its website, the more specific of that notice and this policy applies to that product.
Principles
- Whatever can happen on your device or your own server does not go through ours.
- No ads. We do not sell or rent personal data, and we do not track you across apps or websites.
- Our software contains no third-party analytics, advertising or tracking SDKs.
- Features that must go through our servers are off by default or used only when you use them, and are end-to-end encrypted wherever possible so that we cannot read the content.
Wevir
Wevir is an open-source agent harness that runs on your own computer; the iOS and Android apps are its phone companion. Wevir has no accounts and no telemetry: no usage statistics, crash reports or device information are collected.
Desktop and command line
Project files, sessions, memories, settings and the model keys you enter stay on your computer. Requests to models go directly from your computer to the provider you choose (for example Anthropic, OpenAI, Google, DeepSeek, or a local model you run), under that provider's terms. We do not receive them.
When checking for updates or downloading installers and on-demand components (such as dictation models or the document preview component), your computer fetches files from our download hosts (GitHub, Cloudflare R2, Bunny CDN). These requests carry no account or device identifier, but as with any download, the host sees your IP address and the file requested.
iOS and Android apps
The phone app has no account and only shows content from computers you have paired. All traffic between phone and computer is end-to-end encrypted with the Noise protocol (X25519, ChaCha20-Poly1305, SHA-256), either directly on your local network or Tailscale, or through a relay you turn on.
Messages, photos and dictation recordings you send from the phone go encrypted to your own computer, where dictation is transcribed. We do not receive them.
The app's local cache is encrypted, and device keys are kept in the system Keychain (iOS) or Keystore (Android). Uninstalling the app deletes all of its data from the phone; removing the phone in Settings → Devices on the desktop stops it from connecting to that computer.
System permissions and what they are for: Camera scans the pairing QR code and takes photos to attach; Photos picks images to attach; Microphone records dictation; Local Network finds and connects to your computer; Face ID unlocks the app and confirms high-risk approvals. You can turn any of them off in system settings at any time.
Push notifications (optional, off by default)
Apple and Google only accept pushes from the app's developer, so notifications go through the push gateway we operate at push.wevir.si and are delivered by the Apple Push Notification service (APNs) or Firebase Cloud Messaging (FCM). It is used only after you turn on push on the desktop.
Notification contents are encrypted on your computer and can only be decrypted on your phone. The gateway, Apple and Google cannot see titles, session names or any message content.
- Data the gateway processes: the device's push token and platform, your computer's route ID (a public key), and when pushes are sent and their size.
- Data the gateway stores: only a SHA-256 hash of route ID, platform and token, never the token itself. Bindings unused for 180 days are removed automatically, and immediately when you remove the phone or turn push off.
- IP addresses are used only for rate limiting and are not logged.
Relay and web client (optional, off by default)
When a phone or browser cannot reach your computer directly, you can turn on the official relay at web.wevir.si, which runs on Cloudflare. The relay only forwards ciphertext: it has no keys and does not store or log message contents. It sees your computer's route ID, when connections open and close, and the size of messages; IP addresses are used only for rate limiting and are not logged. You can also run your own relay and bypass ours entirely.
Edgeweir and ClashMax
Edgeweir is deployed on your own servers, with no call-home and no telemetry. The traffic, logs and configuration it handles are entirely under your control and never reach us.
ClashMax runs locally on your Mac with no telemetry. Profiles and network traffic travel only between your Mac and the servers you configure.
XuyiX and iSquat
XuyiX and iSquat are online services and process the data needed to provide them:
- Account information, such as the email address or sign-in identifier you register or sign in with.
- Content you submit: prompts and uploaded or generated images in XuyiX; ratings, reviews and photos in iSquat.
- iSquat uses your location when you search for restrooms nearby, only to return results.
This data is used only to provide and improve the service, never for advertising, and is not sold to anyone. You can ask for a copy or for deletion at any time; see Your rights.
This website
wevirlabs.com is hosted on Vercel and uses Vercel Web Analytics to count page views. It sets no cookies, does not track you across sites, and only reports aggregate statistics. As with any website, the host processes your IP address and browser information in short-lived server logs for security and operations.
The language you pick in the navigation bar is saved in your browser's local storage and is not sent to us.
Retention and deletion
- Push bindings: deleted when you remove the phone or turn push off, and automatically after 180 days unused.
- Support email: kept as long as needed to resolve your request; you can ask us to delete it.
- Account data in online services: kept while you use the service and deleted when you close your account or ask us to, except where the law requires us to keep it.
- Data stored on your devices is under your control; deleting the app or its data files removes it.
Your rights
Wherever you are, you can email hi@wevirlabs.com to access, correct, export or delete the personal data we hold about you, or to withdraw consent you gave earlier. Depending on where you live (for example under the GDPR in the EU and UK, or the CCPA/CPRA in California), you may have further rights. We will respond as the law requires and will not treat you differently for exercising them.
Children
Our products are not directed to children under 13, and we do not knowingly collect their personal data. If you believe we have, contact us and we will delete it.
International transfers and security
We are based in the United States, and our providers may process data in other countries. We protect data with encryption in transit, minimal collection and access controls. No system is perfectly secure; if a security incident affects your data, we will notify you as the law requires.
Changes
When this policy changes, we update the date at the top of this page. For material changes we say so prominently here and, where appropriate, in the affected app.
Contact
Wevir Labs LLC · United States
Privacy questions and requests: hi@wevirlabs.com
Email supporthi@wevirlabs.com