Your notes stay on your Mac. Varlig has no accounts and no servers of its own, and it never receives what you write. This policy explains exactly what personal data is involved when you use the Varlig app for Mac and visit varlig.com, who handles it, and what your rights are.
At a glance
- Your notes, attachments, tags and settings are stored on your Mac. We never receive them.
- The app has no account, no advertising, no analytics and no crash reporting.
- The app only goes online for the features listed below, such as exchange rates. Those requests never include your notes.
- The website sets no cookies and uses privacy-friendly analytics that don’t identify you.
- If you email us, we use your message only to reply.
Who is responsible
The controller responsible for processing personal data under the EU General Data Protection Regulation (GDPR) is:
Mykola Bugaiov
Akademika Zabolotnoho St. 50, flat 42
03187 Kyiv
Ukraine
Email: [email protected]
The Varlig app
Your notes
Your library is stored in ~/Library/Application Support/Varlig/ on your Mac, together with its attachments. We can’t see, access or recover it.
- Locked notes are encrypted on your Mac with AES-GCM, using a key derived from your password (PBKDF2-HMAC-SHA256). We never receive your password and can’t recover it.
- Touch ID: if you allow unlocking with Touch ID or your Mac password, a key derived from your password is kept in the macOS keychain on that Mac only.
- Backups you make with File › Back Up Library… are saved wherever you choose. Notes that aren’t locked are readable in a backup, so keep backups somewhere private.
- Spotlight: if you turn on Include unencrypted notes in Spotlight, macOS indexes the text of your unlocked notes on your Mac so you can search it from Spotlight. It’s off to begin with.
- Widgets and sharing: a widget you add shows the titles and open tasks of pinned, unlocked notes. Content you share to Varlig from other apps is saved on your Mac until Varlig imports it.
When the app goes online
Most of Varlig works entirely offline. The features below connect to the internet. None of them send your notes, and none include an account, device or advertising identifier. Like any internet connection, each request reveals your IP address to the service it goes to, which handles it under its own privacy policy. We don’t receive these requests.
| Feature | When | Goes to | What it sends |
|---|---|---|---|
| Exchange rates | When a calculation first needs currency or crypto rates, then at most hourly while Varlig is open | European Central Bank (ecb.europa.eu), Coinbase (api.coinbase.com) | A standard request for the published rates |
| Rate history and inflation data | Soon after Varlig opens, then daily while it’s open | European Central Bank (ecb.europa.eu), U.S. Bureau of Labor Statistics (bls.gov) | A standard request for the published figures |
| Titles of pasted web links | When you paste a link | The website the link points to | The link’s address |
| Link cards | When you choose Show Preview for a link | The website the link points to, through Apple’s LinkPresentation framework | The link’s address |
| File › Clip Web Page… | When you use the command | The website you enter | The page’s address |
You can turn off automatic rate updates with Refresh currency and crypto rates hourly in Settings › Calculations, and link titles with Auto-fill titles when pasting web links in Settings › General.
Varlig doesn’t sync your notes: iCloud sync isn’t available in current versions of the app.
Connections you turn on
- AI assistants (MCP): if you turn on Allow local MCP connections in Settings › Advanced and connect an AI assistant, that assistant can read the notes you allow, and it may send them to its own service under its own terms. It’s off to begin with.
- Automation: if you use Varlig’s URL automation with another app, results are passed to the address that app provides.
No tracking in the app
The app contains no analytics, advertising or crash-reporting software, and it doesn’t check for updates or licenses over the internet.
Buying and downloading Varlig
- Mac App Store: Apple handles purchases, subscriptions and payment under its own privacy policy. We don’t receive your name, Apple Account or payment details. Apple gives us only sales reports that don’t identify you.
- GitHub: if you download Varlig from GitHub, GitHub, Inc. processes the download, including your IP address, under the GitHub Privacy Statement.
The website
Hosting
varlig.com is hosted and delivered by Cloudflare, Inc. (101 Townsend St, San Francisco, CA 94107, USA). To deliver pages and protect the site against attacks, Cloudflare processes technical data for each request, such as your IP address, the page requested, your browser’s user agent and the time. Cloudflare may process this data in the United States; it is certified under the EU-U.S. Data Privacy Framework. The legal basis is our legitimate interest in a secure, reliable website (Art. 6(1)(f) GDPR).
Analytics
To understand which pages are useful, the website uses Plausible Analytics, loaded from plausible.crashatlas.com. Plausible doesn’t use cookies, doesn’t store your IP address and doesn’t follow you across websites. It counts page views using the page address, the referring website, your browser, operating system and device type, and the country derived from your IP address. Visits are counted with an identifier that is recalculated daily and can’t be traced back to you. The legal basis is our legitimate interest in improving the website (Art. 6(1)(f) GDPR).
Cookies
The website sets no cookies and stores nothing on your device. Fonts are served from varlig.com itself, and the site embeds no third-party content. Links to the App Store and GitHub take you to those services, whose own privacy policies apply there.
When you email [email protected], we use your email address and message to answer you, and keep them only as long as needed for your request and any legal retention obligations. The legal basis is our legitimate interest in answering your inquiry, or taking steps toward a contract at your request (Art. 6(1)(f) and (b) GDPR).
Your rights
Under the GDPR you have the right to:
- access the personal data we hold about you
- have it corrected or deleted
- restrict or object to its processing, including processing based on legitimate interests
- receive it in a portable format
To use these rights, email [email protected]. Because the app keeps your data on your Mac, most of what we could hold about you is limited to emails you send us. You also have the right to lodge a complaint with a data protection supervisory authority, in particular in the EU country where you live or work.
Children
Varlig isn’t directed at children under 16, and we don’t knowingly collect their personal data.
Changes
We update this policy when Varlig or the website changes how data is handled. The date at the top shows when it last changed.