Summary
Vurro runs on your device. The browser extension stores your data in your browser, and the mobile app stores your Substack session and app data on your phone. Vurro never receives your Substack password, your session, or the content of your messages.
A few things can leave your device, and each one is optional or described below:
- Notifications (mobile, opt-in): your device's push token, so Vurro can send content-free "wake-up" messages. See Notifications.
- Vurro Premium (paid, opt-in): your purchase record, your license, and, if you turn sync on, your read position and notification settings, so they match across your devices. See Vurro Premium.
- Announcements: the extension and app download a public announcements file. The request carries nothing about you. See Announcements.
Browser Extension
The extension runs on your device. Your bookmarks, watched users and settings are stored in your browser with the browser's built-in storage. So is the date you started using Vurro and a count of the days you've used it, kept only to decide when to ask you for a store review; they never leave your browser.
It contacts two places besides Substack:
- The announcements file at support.vurro.net, about every 6 hours, to show you notices about Vurro. You can turn this off in the extension's options.
- Vurro's backend, only if you enter a Vurro Premium license key. See Vurro Premium.
Vurro requests these browser permissions:
- storage and unlimitedStorage: to save your bookmarks, watched users and settings in your browser, without the browser's default size limit cutting them off.
- Host access to substack.com: to enhance Substack's chat pages. Vurro only activates on Substack chat pages.
- Access to Vurro's backend (optional): requested only when you connect a Premium license, and removed when you disconnect.
- alarms: to schedule Premium sync. It does nothing unless Premium sync is on.
Mobile App
The Vurro mobile app is a third-party Substack client. It talks directly to Substack. What it can send anywhere else is described under Notifications, Vurro Premium and Announcements.
Signing in
You sign in to Substack inside an in-app web view by entering your credentials directly on substack.com. Vurro never sees your email, password or 2FA code. After Substack signs you in, the app captures your Substack session cookie from the web view and stores it on your device in the platform's secure keystore (Android Keystore / iOS Keychain). The web view is then closed.
Requests to Substack are made directly from your device using that stored cookie. Vurro does not proxy, log or transmit your Substack activity.
On Android, after you sign in, the app also saves a small restore key in Android's credential store. It holds your Substack user id and handle, and nothing else: not your session or your password. Android may include it in your end-to-end encrypted Google backup, so that on a new phone Vurro can greet you by name before you sign in again. It never reaches Vurro. Signing out deletes it, and so does uninstalling the app.
What is stored on your device
- Your Substack session cookie (in the OS secure store)
- On Android, the restore key described above
- Your bookmarks, watched users, in-thread search history, and app settings (in the app's local storage)
- A short-lived cache of recently viewed threads and messages, to make navigation feel instant
- The date you started using Vurro and a count of the days you've used it, kept only to decide when to ask you for a store review
Uninstalling the app removes all of it. If you use Vurro Premium sync, a copy of your read position and notification settings is also kept on Vurro's backend; see Vurro Premium.
What is not collected
- No analytics SDKs
- No advertising identifiers
- No crash reporting that includes your data
- No tracking across apps or websites
- Your Substack credentials, session, and message content are never sent to Vurro or to any third party other than Substack itself.
Notifications
Notifications are optional. Everything in this section only happens if you turn them on.
When you enable notifications, the app registers your device's push token with Vurro's notification backend. The token is sent encrypted over HTTPS. The backend stores only that push token, your platform (iOS or Android) and the build variant. It doesn't store your Substack credentials, your account identity or any message content.
To limit abuse, when your device registers, the backend also keeps a salted one-way hash of your IP address for less than half an hour. Your IP address itself is not stored, and the hash can't be linked to your push token or anything else.
On a schedule, the backend sends content-free "wake-up" push messages to your device. When your device receives one, Vurro checks substack.com directly using your own on-device session and decides on your device whether to show you a notification, based on your settings. Message content and the decision never leave your device.
The app may also show you a notification about Vurro itself, such as a service notice, using the same permission. Those come from the announcements file described below.
To stop this, turn notifications off or sign out. Either one unregisters your token. The backend also deletes tokens that have been inactive for 60 days.
Permissions
The app requests only the permissions its features need:
- Internet: to fetch chat content from Substack.
- Camera, photo library or file access (only if you attach something): to pick an image or video to send. The file is uploaded directly to Substack; Vurro never holds a copy.
- Notifications (if you opt in): to show the messages your settings match, and Vurro's own announcements.
You can revoke any of these in your device's settings without breaking the app's core features.
Vurro Premium
Vurro Premium is an optional paid subscription. This section applies only if you buy it.
Buying Premium. You buy Premium in the mobile app through the App Store or Google Play. Apple or Google handles the payment. Vurro never sees your name, email, Apple ID, Google account or payment details. Vurro's backend receives the store's signed purchase record, checks it with Apple or Google, and keeps the store's transaction id, which store it came from, the subscription's status and when it renews or expires. From that, Vurro creates your license key. Vurro stores only a one-way hash of the key, never the key itself. If you lose the key, Restore Purchases in the app gets the same key back.
Connecting devices. Each phone or browser where Premium is active is registered as a device on your license, up to 10. For each one, Vurro stores a random device token (as a one-way hash), the platform (iOS, Android, Chrome or Firefox), the build type, and when it was added and last synced.
What syncs. If you turn sync on, your devices send Vurro's backend:
- Read position. For each chat thread and direct-message conversation you've read: its Substack id, the time of the newest message you've read, and when that changed.
- Notification settings (mobile only; you can turn this off with "Sync across your devices"): your notification choice for each chat and direct message, the threads and reply threads you follow or mute, and your notification rule toggles. These include the Substack ids of the chats, conversations, threads and messages involved, the publication's name, and, for a reply thread you follow, the Substack user id of the person who wrote the message it replies to, so your other device can tell when someone replies to you.
- Which of your devices made each change, to help resolve conflicts between them.
Sync never includes message text, conversation names, people's names, your Substack login or session, or your email. Pauses and the master notification switch stay on each device.
This data is sent encrypted over HTTPS and stored on Vurro's backend. It isn't end-to-end encrypted, and Vurro uses it only to keep your devices in step.
How long it's kept.
- Disconnect this device removes that device from your license. Your synced data stays for your other devices.
- Devices that haven't synced for 180 days are removed automatically.
- Items you clear are removed from the backend after 180 days.
- When Premium ends, whether it lapses or is refunded, Vurro deletes your license, its devices and all synced data 30 days later.
Announcements
The extension and the mobile app download a public file of Vurro announcements from support.vurro.net, so Vurro can tell you about new features or service problems. The extension checks about every 6 hours while you use it; the app checks when it opens and at most hourly in the background. The request sends nothing about you, not even a device id. The file is hosted on GitHub Pages, so like any web request GitHub sees your IP address, under GitHub's privacy statement. Vurro receives nothing from it. You can turn this off in the extension's options. In the app, announcement notifications follow your notification settings.
Deleting your data
Most of your Vurro data lives only on your own device. Vurro's backend can hold two things: your push token, if you turn on notifications, and your Premium license and synced data, if you buy Premium.
- Sign out in the app. This clears your Substack session from your device, unregisters your push token, and on Android deletes the restore key.
- Delete synced data (Premium). In the app's Vurro Premium screen or the extension's Premium card, choose Delete synced data. This immediately deletes all read positions and notification settings stored for your license. Your devices keep their own local copies.
- Uninstall the app or extension. This removes everything Vurro stored on your device.
Server-side, Vurro keeps nothing longer than this policy says: push tokens are deleted after 60 days without activity, and a Premium license and everything synced under it are deleted 30 days after Premium ends.
Website
This website (vurro.net) does not use cookies, analytics, tracking pixels or third-party services. No data is collected from visitors.
Third Parties
Vurro does not sell or share your data with advertisers, data brokers or anyone else. Vurro uses these service providers to run the features above, and they process data only on Vurro's behalf or under their own terms:
- Supabase hosts Vurro's backend.
- Expo, Google (Firebase Cloud Messaging) and Apple (Push Notification service) deliver push notifications.
- Apple and Google process Premium payments under their own privacy policies.
- GitHub hosts the announcements file.
Changes
If this policy changes, the updated version will be posted here with a new "last updated" date.
Contacting support
If you email Vurro, Vurro receives your message and your email address, and uses them only to answer you. If the app ever asks whether you'd like to send a diagnostics report, it shows you the exact text first, and nothing is sent unless you choose to share it. Support emails are deleted once they're no longer needed to help you.
Contact
Questions, or a privacy request? Email [email protected]. For bugs and feature requests, you can also open an issue at github.com/longcut/vurro-issues.