On-device diagnostics and data
Ralven reads hardware, Windows, storage, application, process and game installation information to display diagnostics and prepare requested operations. Preferences, history, logs and recovery backups are kept locally.
Local diagnostics and operations do not require an account. Local data is not uploaded in full through telemetry; remote transfers are limited to the flows below.
Account, authentication and integrations
When you create or use an account, email, internal identifier, first and last names, username, terms acceptance and verification status are processed for authentication, profile, security and access control. Authentication uses Google Firebase and, when selected, Google sign-in.
Passwords are sent to the authentication service over HTTPS, not saved by the app or included in diagnostics. Access tokens remain in memory; persistent sessions use Windows DPAPI protection.
If you enable two-factor authentication, information needed for verification and recovery is processed; the backend stores protected representations of recovery codes and their usage state, not plaintext codes. Optional Discord linking stores your Discord user identifier, its link to your Ralven account and timestamps, plus a protected representation of the temporary linking code. This flow does not store Discord names or email addresses; the identifier and access tier are used to synchronize roles.
When signing in with Google, Ralven receives from Google only the basic data authorized for authentication: a stable account identifier, name, verified email and profile photo when available. Ralven does not request access to Gmail, Drive, Contacts or other files in the Google account.
Profile photo: the photo you choose in the app is kept on your computer and synchronized with your account so it appears on your other computers. It is uploaded as a square PNG image of up to 512 px and 2 MiB and stored privately on Cloudflare infrastructure, indexed in the D1 database; only you, signed in to your account, can read it, and it is not part of telemetry. A photo that was already on your computer is uploaded automatically when you sign in. You can remove the photo in the app, which deletes the remote copy, and signing out deletes the local copy.
Essential diagnostics
After you confirm the current in-app privacy notice, Ralven sends essential diagnostics for stability, initialization, updates and technical operation results to Cloudflare infrastructure. These may include a random event or transaction UUID, app version, environment, Windows version and architecture, duration, outcome, technical error category or code, FiveM/GTA V detection, game edition and target count.
The healthy initialization signal is limited to once per day and version. Essential diagnostics remain active after notice confirmation and are not disabled by Optional reports.
Versions with a standalone updater may also send update stage, outcome, technical code and relevant versions. A UUID is a random event identifier, not a permanent computer identifier. Confirming the diagnostics notice does not replace separate choices for accounts, bug reports, AI or purchases.
Optional reports and failures
In Settings, Optional reports controls detailed telemetry and sanitized error and crash reports, used to understand compatibility, feature usage and failure causes. Sanitization means removing or replacing known sensitive data before transmission; it is not permission to enter secrets in free text. It is enabled on new installations, can be disabled at any time and preserves a previous opt-out.
None of these transfers starts before you confirm the current notice. Optional data may include CPU/GPU models, RAM range, Windows build, profile and action IDs, disk type, free space range, time and frequency ranges, backup and elevation context, game process count range and benchmark outcome.
Failures are sent to Sentry with sanitized exception type, message and stack trace, version and environment. Telemetry does not include personal file contents, passwords, tokens, email, computer name, Windows username, full personal paths, MAC, serial numbers or HWID.
Disabling the option also removes optional fields from pending events before further transmission.
Bug reports and support
A bug report is sent only when you request it. It may include category, reason, typed summary and description, version and profile; optionally, a follow-up email address, Windows technical information and a plain-text log excerpt up to 100 KB.
Reports are stored in Cloudflare infrastructure and accessible through a protected administrative dashboard. Do not include passwords, tokens or other sensitive data in free text.
Support messages are used to respond to your request; reports you publish on GitHub follow GitHub visibility settings and rules.
Ralven AI, when available
When you send a question to Ralven AI, the app transfers the question, recent conversation context and a structured summary of diagnostics and supported plans to the backend and OpenAI to generate a response. Context may include CPU, GPU, memory, Windows, architecture, storage and diagnostic indicators.
Known paths in text are sanitized, but do not enter personal data or secrets in your question. Your name, email and authentication token are not sent to the provider; an HMAC-derived identifier is used for safety.
Questions, responses and snapshots are not stored in D1; only usage, account, period, cost and token metadata are recorded for limits and access control. The API is called with store: false; this does not mean the provider performs no processing or operational retention under its own rules.
This user-initiated flow is separate from Optional reports.
Paid access and distribution
When a paid offer is available and you initiate a purchase, account identifiers, payment references, amount, currency, statuses and dates are processed for billing and access. In the Asaas hosted checkout, registration and card details are entered directly with the provider, not the app; card data is not included in telemetry.
Microsoft Store processes installation, distribution and any platform transactions under Microsoft policies. Availability and billing depend on the channel; this policy does not claim every feature is enabled in every version.
Recipients and network connections
Depending on the feature used, recipients are Vemryx and authorized administrators, Cloudflare (backend, D1 database and file distribution), Google/Firebase (authentication), Sentry (optional failures), OpenAI (requested AI), Discord (requested linking), Asaas (initiated checkout) and Microsoft (Microsoft Store). HTTPS connections also expose network metadata, such as IP address, to infrastructure services even when IP is not part of the telemetry payload.
Services may process data outside Brazil and follow their own policies. Implemented app flows do not include advertising, advertising tracking or selling data.
Provider policies and information
Official links about how these services process data. Links open in a new tab; listing a service does not mean it receives data from every installation.
Retention and security
The local usage telemetry queue retains pending events for up to 14 days. The remote D1 diagnostics database has no defined automatic expiration; we do not promise deletion after a deadline the service does not enforce.
Reports, profiles and access, security, AI usage and billing records are retained according to their purpose and applicable obligations, with no single automatic deadline defined in this policy. Local preferences, logs, history and backups may remain until removed; uninstalling does not guarantee deletion of all local files.
Provider retention depends on their rules. We use HTTPS, Windows session protection, payload validation, sanitization and restricted administrative access; no system guarantees absolute security.
Your choices and requests
You can disable Optional reports in Settings, avoid optional integrations, review report contents and request access, correction or deletion of personal data and information about its processing using the contact below. Account deletion is available in compatible versions through the account flow and may require reauthentication and prior cancellation of open billing links.
The deletion flow removes Firebase authentication, the remote Ralven profile and stored profile photos, including links dependent on that profile. If a step temporarily fails, the request may remain pending for retry.
Account deletion must not be interpreted as automatic deletion of all diagnostics, reports, local files or third-party data. Requests are evaluated under applicable rights, including the Brazilian LGPD, and retention obligations; identity verification may be required without asking for your password.
Send your request to contato@vemryx.com.
For a request, explain which right you wish to exercise and provide your account email, if applicable. Do not send passwords, authentication codes, tokens or personal documents in your first message. If more information is needed to locate the data or verify your identity, we will explain why and what is required.
Updates and contact
Vemryx is responsible for the Ralven services described in this policy. Privacy questions and requests can be sent to contato@vemryx.com.
Changes will be published on this page with a new date. Material changes to diagnostic data or recipients require an updated versioned in-app notice and renewed confirmation before the corresponding transfers.