Introduction

This Privacy Policy (the "Policy") describes how VRAMGlass ("VRAMGlass", "we", "our", or "us") collects, uses, and discloses information about you in connection with your access to and use of the website at vramglass.com and related widgets and APIs (collectively, the "Service"). This Policy forms part of our Terms of Service.

All browsing features of the Service are available without signing in. We store information associated with your account only when you sign in and use features such as the watchlist, price alerts, the API and MCP, and the paid Pro plan.

Information We Collect

  • Account information: Your email address, interface language, and the dates and times you registered and last signed in. If you sign in with Google, we also receive the unique account identifier, display name, and profile picture URL provided by Google. Source: you, or the Google account you choose to use.
  • Watchlist and alert settings: The GPUs you follow, the platforms for which you set alerts, your target prices and currencies, and whether each alert is enabled. Source: you.
  • API and MCP connections: The name, expiry date, and identifying hint (the first 8 and last 4 characters) of each API key you create; the key itself is stored only as a cryptographic hash. For AI apps you authorize, the name the app reports, the domain of its redirect address, and when you authorized it. The time each key and authorization was last used. To measure usage and prevent abuse, we record daily call counts per account and count calls per irreversibly hashed IP address. Source: you, or generated automatically by the Service.
  • Plan and payment records: The plan you purchase and your Pro expiry time, along with each payment's order ID, amount and currency, payment method type (card or WeChat Pay), timestamp, and status (including refunds). Card details and other payment information you enter on the Dodo Payments checkout page are processed by Dodo Payments and its payment partners; we do not receive or store them. Source: you and Dodo Payments.
  • Email delivery records: The time verification-code and price-alert emails are sent, the price that triggered an alert, and the delivery status. Source: the Service and our email delivery provider.
  • Sign-in security data: Email verification codes are stored only as cryptographic hashes and expire after 10 minutes. To prevent abuse, we count verification-code requests against cryptographic hashes of email addresses and IP addresses. Source: generated automatically by the Service.
  • Technical and access information: IP address, browser type and version, operating system, referring URL, and language preference. To prevent abuse, we count requests against irreversibly processed IP addresses and browser information. Source: processed automatically via Cloudflare.
  • Usage analytics: Page views, traffic sources, country or region, clicks and scrolling, and Microsoft Clarity session replays. Source: your browser, collected by the analytics services listed under "Service Providers" below.

We do not receive or store payment credentials such as card numbers, and we do not require your real name, phone number, or mailing address (at checkout, Dodo Payments collects your billing country or region for tax calculation).

How We Use Information

We use the information described above to:

  • Provide and operate the Service, including authenticating you, storing your watchlist and alerts, evaluating whether prices have reached your targets, and allowing AI tools you authorize to read public data from the Service via MCP;
  • Process plan purchases and reconcile payments, refunds, and disputes;
  • Send emails you request or that relate to your plan—specifically sign-in verification codes, price alerts, plan expiry reminders, and service change notices;
  • Detect, prevent, and respond to fraud, abuse, bulk registration, or violations of our Terms of Service;
  • Contact you regarding account matters, service announcements, and material updates to our policies;
  • Analyze aggregated usage to improve the Service; and
  • Comply with applicable legal obligations.

We do not send marketing emails, we do not use your personal information for behavioral targeted advertising, and we do not sell your personal information to any third party.

AI tools connected via MCP can read only public price and specification data; they do not receive your email address, watchlist, or alerts. Conversations between you and an AI tool are handled by that tool's provider under its own privacy policy and do not pass through us.

Cookies and Local Storage

The Service uses the following cookies and local browser storage items:

  • __Host-vg_session (HTTP cookie): Maintains your session after you sign in. Retained for 30 days and renewed when used; deleted when you sign out.
  • __Host-vg_oauth (HTTP cookie): Protects against request forgery while you sign in with Google. Expires after 10 minutes and is deleted once sign-in is complete.
  • __Host-vg_challenge (HTTP cookie): Records the current verification attempt while you sign in with an email verification code. Expires after 10 minutes.
  • __Host-vg_oauthtx (HTTP cookie): When an AI app asks to connect to your account, confirms that the same browser allows or denies the request. Expires after 10 minutes.
  • vg-theme, vg-currency (local storage): Remember your selected light or dark theme and display currency. Retained until you clear them manually.
  • vg-price-navigation (session storage): Restores your scroll position when you return from a price page. Cleared when you close the tab.
  • _ga, _ga_* (first-party cookies): Used by Google Analytics 4 to distinguish browsers and sessions and to measure overall traffic. Retained for up to 2 years.
  • _clck, _clsk, and similar (first-party cookies): Used by Microsoft Clarity to measure clicks and scrolling and to provide session replays. Retained for up to 1 year.
  • Cloudflare may set cookies for security purposes (such as __cf_bm), which are typically retained for 30 minutes.

The first four items and Cloudflare's security cookies are strictly necessary to operate the Service. Ahrefs Web Analytics does not use cookies. You can clear cookies and local storage at any time through your browser settings; doing so will sign you out. You can also block analytics scripts using your browser's privacy settings or a content-blocking extension; this will not affect any functionality of the Service.

Service Providers

We engage the following service providers to operate the Service. Each receives only the data necessary for its stated function:

  • Cloudflare: Web hosting, database, content delivery, DNS, and abuse prevention. Account, watchlist, and alert data are stored in Cloudflare databases; Cloudflare also processes request metadata (IP address and User-Agent).
  • Resend: Delivery of verification codes, price alerts, plan expiry reminders, and service notice emails. Receives the recipient email address and email content.
  • Dodo Payments: Acts as Merchant of Record to process Pro plan payments, refunds, taxes, and receipts. Receives your email address, account identifier, purchased plan, and the information you enter on the checkout page (including billing country or region and payment details).
  • Google: Google Sign-In (only if you choose to sign in with Google), which receives the sign-in request and returns your account identifier, email address, display name, and profile picture to us; and Google Analytics for traffic analytics.
  • Microsoft: Microsoft Clarity usage analytics and session replay.
  • Ahrefs: Ahrefs Web Analytics for traffic analytics; and Ahrefs Bot Analytics—to analyze visits from search engines and other crawlers, our servers forward basic request metadata (request URL, IP address, User-Agent, referrer URL, and response status) to Ahrefs.

These providers process data in accordance with their own privacy policies: Cloudflare, Resend, Google, Dodo Payments, Microsoft, and Ahrefs.

Disclosure of Information

Other than to the service providers listed under "Service Providers" above, we disclose your information only: when required by law, regulation, or a competent authority; when necessary to protect the rights, property, or safety of the Service, our users, or the public; or in connection with a merger or transfer of the Service, in which case the successor will continue to process your information in accordance with this Policy.

Data Retention

  • Account, watchlist, and alerts: Retained until you delete your account.
  • Sessions: Expire after 30 days of inactivity; expired records are purged periodically.
  • MCP keys and authorizations: Take effect immediately upon expiry and within 30 seconds of revocation or disconnection; inactive records are deleted after 30 days; registered AI app records are deleted after 90 days of inactivity.
  • Verification code records: Deleted within 24 hours.
  • Payment records: Retained for the period required by applicable law for accounting, tax, and dispute-resolution purposes, and may be kept even after you delete your account.
  • Usage and anti-abuse counters: Retained for up to 7 days.
  • Alert email records: Email bodies are deleted once delivery completes; records used to prevent duplicate sends (timestamp, price, and status) are retained for 90 days.
  • Database backups: Point-in-time recovery copies in Cloudflare's database are retained for up to 30 days before being overwritten automatically.
  • Usage analytics: Retained according to each analytics provider's retention settings.

When we process your account deletion request, we delete your account information, sessions, watchlist, alerts, API keys and authorizations, plan information, and email delivery records (except payment records we are required by law to retain); copies in database backups are overwritten within 30 days.

Your Rights

Depending on the laws where you live, you may have the right to access, correct, delete, or export your personal information, to restrict or object to certain processing by us, and to withdraw your consent. You can:

  • view and edit your watchlist and alerts on your account page, and revoke API keys or disconnect AI apps at any time under MCP connections;
  • stop receiving alert emails by clicking the unsubscribe link at the bottom of any alert email; or
  • email hello@vramglass.com to request deletion of your account or make any other request, and we will respond within 30 days.

You also have the right to lodge a complaint with the data protection supervisory authority where you live.

International Data Transfers

We and our service providers process data in multiple countries and regions, including the United States. Your information may be transferred to locations outside your jurisdiction, and we will implement appropriate safeguards in accordance with applicable law.

Children's Privacy

The Service is not directed to children under the age of 13 (or under the minimum age of digital consent in your jurisdiction). If we learn that we have unknowingly collected such information, we will delete it.

Security

We take reasonable technical measures to protect your information, including: HTTPS across the entire site; session cookies that are restricted to HTTPS and cannot be read by scripts; storing only hashes of session tokens, verification codes, API keys, and access tokens in our database, never plaintext; and rate limiting of sign-in requests. No system can guarantee absolute security.

Changes to This Policy

We may revise this Policy from time to time, and we will update the date at the top of this page when we do. If we make material changes, we will post a notice on the website or notify registered users by email.

Contact Us

If you have any questions about this Policy, please contact us at hello@vramglass.com.

This Policy is available in several languages. If the versions differ, the English version governs.