Privacy Policy

What I collect, and why

VKVstudio is built to need as little of your data as possible:

• Language preference — determined entirely by the page URL (/en/ or /ru/); it isn't stored in a cookie or any other persistent identifier.
• Standard hosting logs — like effectively every website, requests to this site pass through Cloudflare's edge network, which records ordinary connection metadata (IP address, user agent, timestamp, requested URL) for security and performance purposes. This site doesn't read or process those logs directly — see 'Third-party processors' below.
• Text you type into a Lab tool — handled as described in 'What stays on your device' and 'What may reach a server' below.
• Conversation history with Synapse, the AI assistant — handled as described in 'What may reach a server' and 'Data retention' below. If the backend is ever offline, the site falls back to a static mock and no conversation is sent or stored.

Cookies & local storage

This site itself sets no cookies at all — none for tracking, none for advertising or analytics, and currently none for any other purpose either. Your interface language is read from the page URL (/en/ or /ru/), not persisted anywhere. One scoped exception exists: if you open Google sign-in for Synapse, the Google Identity Services script it loads may set Google's own cookies (such as g_state) — that script is only loaded when you use sign-in, never on page load; see 'Third-party processors' below.

What the site does use is your browser's own local storage (localStorage and IndexedDB) — a different, non-cookie mechanism that isn't sent to any server automatically. It's used only for on-device functionality: remembering that you've dismissed the notice you may have seen, caching Lab-tool data and downloaded model weights on your device so they don't have to be re-fetched, and, when you use the Synapse assistant, keeping a local copy of your chat history. None of this is used for tracking or shared with anyone.

Because there's currently nothing non-essential here to opt out of, the notice you may have seen simply states this rather than offering a granular accept/reject choice. If that ever changes — for example, if cookie-based analytics is added — this policy and the notice will be updated to disclose it and, where required, to offer a real choice before any such cookie is set.

What stays on your device

The Tokenizer Profiler and Prompt Architect run entirely in your browser in JavaScript. Text you type into them is tokenized or otherwise processed locally on your device and is never uploaded anywhere by default. (The Tokenizer's exact-count mode for a few models is the one exception — it sends that text to the inference backend, which relays it to the model provider's token-counting API; see "Third-party processors" below.)

The Embedding Space Explorer computes its vectors on the inference backend, not in your browser: the passages and search queries you embed are sent to the backend (running Google's EmbeddingGemma) and turned into vectors there. If that backend is ever offline, the Explorer simply doesn't work — this feature has no local fallback. The text is embedded on the fly and is not stored by the embedding endpoint.

If you use Synapse, the AI assistant, your conversation history is also cached locally in your browser using IndexedDB. How long it lasts depends on whether you sign in: signed out, it is deleted the next time this site loads in that browser once no tab has been active for about 90 seconds — not at the instant of closing, and not at all if the site is never opened there again. On a genuinely shared machine, clear the site data or use a private window rather than relying on that timer. Sign in and it is kept, and also copied to the server (below) so it follows you to another device.

What may reach a server

A few features can, under specific conditions, send text off your device:

• Embedding Space Explorer — the passages and search queries you embed are sent to VKVstudio's own inference backend and turned into vectors by Google's EmbeddingGemma running there. They're embedded on the fly and are not stored by the embedding endpoint. If that backend is ever offline, the Explorer simply doesn't work — this feature has no local fallback.
• Exact token counts in the Tokenizer Profiler — some proprietary models (Claude, Gemini) publish no client-side tokenizer, so an exact count needs an API call. Selecting one of those models is what starts it: from then on the text in the box is sent, as you type, to VKVstudio's own inference backend, which forwards it to Google's or Anthropic's API and returns just the number. There is no separate switch to agree to — the model you pick is the choice. Every other model in the list is counted entirely in your browser and nothing is sent anywhere. If the backend is unreachable, the tool falls back to a local approximation and labels the number as approximate rather than exact.
• Synapse conversations — your message is sent to VKVstudio's own inference backend and answered by the self-hosted model running there, whether or not you are signed in. That is simply where the model lives; it is not in your browser. What signing in changes is storage: signed in, the conversation is also written to a server-side database keyed to your Google account's unique id — not your name, email, or IP address. Signed out, nothing about the conversation is written to that database and the transcript exists only in your browser. In both cases the server writes operational log lines per request; for voice requests those include the first 80 characters of the transcript and of the assistant's reply, while typed-chat requests are logged without message content.
• Synapse voice input — if you use the mic button, your browser records audio and sends it to VKVstudio's own inference backend, which forwards it to Google Cloud Speech-to-Text for transcription. Google receives the audio of what you said; the transcript then goes to the assistant as if you had typed it. The recording is not stored: it is held in memory for the length of the request and discarded. The audio is used solely to transcribe your words — never to identify or authenticate you by your voice. The transcript itself is treated exactly like a typed message — see the Synapse conversations entry above. Nothing is recorded until you press the button, and the browser asks your permission first. This control was switched off between 13 and 15 August 2026, when transcription did not work; it was restored once it did.
• Synapse spoken replies — when Synapse answers out loud, the text of its reply is sent from VKVstudio's backend to Google Cloud Text-to-Speech (Chirp 3 HD), which returns the audio. Google receives the assistant's words, which reflect what you asked it; it does not receive your microphone audio, your account, or anything else identifying you. Unlike the optional features above, this is on by default whenever the backend is running and a reply is spoken.

Third-party processors

• Hugging Face — hosts the tokenizer model/vocabulary files the Tokenizer Profiler downloads for some models (run locally in your browser). Your browser fetches these files directly from Hugging Face's CDN; the text you tokenize is never sent there. (The Embedding Space Explorer no longer downloads a model to your browser — it embeds on the inference backend instead; see “What stays on your device”.)
• Anthropic / Google — reached only if you use exact tokenizer verification and the inference backend is live (see above); the specific text you asked to verify is sent to whichever provider's API matches the model you selected.
• Google Cloud — two directions. Speech-to-Text transcribes Synapse voice input: the audio you record with the mic button is sent to Google for transcription. Text-to-Speech (Chirp 3 HD) synthesises the spoken replies, so the text of every reply that is read aloud is sent to Google; unlike the mic, this is not opt-in — it runs whenever the backend is up and Synapse speaks.
• Microsoft (Edge Read-Aloud) — the automatic fallback voice: if a Chirp call fails or its monthly character budget runs out, the same reply text is synthesised by Microsoft's Edge TTS service instead, and Microsoft receives that text in place of Google.
• Google Identity Services — the sign-in script (accounts.google.com), loaded only when you open Google sign-in for Synapse; Google handles the sign-in interaction and may set its own cookies (see Cookies above).
• Cloudflare — hosts this site and, as with any site behind its network, processes standard request/connection metadata for routing, caching, and abuse protection.

No sale of data

I don't sell data, and I don't share it with anyone outside the processors listed above.

Data retention

• Notice-dismissal flag (localStorage) — persists until you clear your browser's local storage for this site.
• Local IndexedDB conversation history (Synapse) — if you are signed in, it stays on your device until you clear your browser storage, delete conversations in the app, or sign out: signing out deletes this device's local copy immediately (the server copy is separate — above). If you are not signed in, it is deleted on the next visit after about 90 seconds of no activity, not at the moment the browser closes.
• Server-side conversation history (Synapse, only if you sign in with Google) — retained until you delete the conversation, or automatically purged 30 days after it was last updated, whichever comes first.
• Cloudflare request logs — retained per Cloudflare's own standard log-retention policy, outside my control; see Cloudflare's own privacy documentation.

Your rights

If you are in the Republic of Armenia, the Law of the Republic of Armenia "On Protection of Personal Data" (HO-49-N, 2015) gives you the right to:

• know what personal data concerning you is processed, and why;
• access a copy of it;
• request correction of inaccurate data;
• request erasure of your data, where there's no legitimate ground for me to keep it;
• object to, or request restriction of, processing;
• lodge a complaint with the Personal Data Protection Agency of the Republic of Armenia, the state body supervising compliance with this law.

Exercising these rights in practice

Because the site is visible internationally and used by an EN/RU audience beyond Armenia, I apply these same rights as a matter of practice to every visitor, regardless of location — in line with GDPR-style best practice.

In practice, exercising these rights is simple: clearing your browser's local storage/site data for this domain removes the notice-dismissal flag, any cached Lab-tool data, and any locally cached Synapse history immediately, and emailing me (see 'Contact' below) is enough to request access to, or deletion of, anything stored server-side. Armenian law sets the clock for erasure after a withdrawal of consent at 10 working days, and I hold myself to that same deadline for any deletion request.

International data transfer (visitors to this site)

This section is about data this website collects from you as a visitor. It is not about data handled inside a client engagement — if you are evaluating me as a supplier, the answer you need is on the Trust & Process page, not here.

Data described above may be processed outside Armenia: Hugging Face's CDN and Cloudflare's network are both globally distributed, and the APIs this site reaches — Anthropic's and Google's for tokenizer verification, Google Cloud's for speech synthesis — run on infrastructure that isn't based in Armenia. I rely on these providers' own security and compliance programs for that processing; no additional data-transfer mechanism beyond what's described in this policy is currently in place. Under Armenia's data-protection law, these transfers rest on their necessity for the processing purposes stated in this policy (Article 27 of HO-49-N).

Children's privacy

This site isn't directed at children, and I don't knowingly collect data from them. If you believe a child has submitted data to the Synapse backend, contact me and I'll remove it.

Changes to this policy

This policy will be updated whenever what the site's code actually does changes — for example, if cookie-based analytics is ever added. The 'last updated' date at the top of this page reflects the most recent revision.

Data controller & contact

• Data controller: VKVstudio — Karpov Valerii, sole proprietorship (individual entrepreneur, Ա/Ձ).
• Registered with the State Register of Legal Entities, Ministry of Justice of the Republic of Armenia, on 12 February 2026.
• Registered activity: 62.01.0 — computer programming
• Place of registration: Gyumri, Shirak Province, Republic of Armenia
• hello@vkvstudio.com — contact for privacy requests, including access to or deletion of your data