Privacy, in plain words.

Who we are

Vamocles is the legal entity that operates vamocles.com and the Vamocles apps. We build an intelligence, command and protection system for individuals, businesses and nations. For the personal data described in this policy, Vamocles is the controller: we decide why and how it is used.

You can reach us about anything in this policy at privacy@vamocles.com. If your organisation or government deploys Vamocles under its own agreement, read Organisations and governments first.

This website

vamocles.com is a static website. It has no sign-in and no third-party code. Its only server-side parts are the briefing form and the vulnerability data and alerts behind Thymos, all described below.

• No cookies, analytics or third-party requests. Every page, image and film is served from our own domain. Nothing on the site reports your visit to anyone else.
• Your theme choice. If you choose Light or Dark in the appearance switch, your browser remembers it in local storage under the key vm-theme. It never leaves your device, and choosing Match system removes it.
• Things you choose to save. If you tick Save my progress on this device in the security assessment, your browser keeps your answers and report details in local storage under the key vamocles.security-review.v1. In Thymos, the vulnerabilities you choose to watch are kept under vm-thymos-watch-v1, and, if you turn on Thymos alerts, your alert choices (minimum severity, vendor and timing) under vm-thymos-alerts-v1 and in your browser’s cache storage, where the alert worker reads them. None of it is sent to us, except the alert choices when you turn Thymos alerts on (see Thymos alerts), and clearing it in the assessment, in Thymos or in your browser removes it.
• Answers in an open tab. While you take the assessment, your browser also keeps a copy of your answers for that tab alone, in session storage under the key vamocles.security-review.tab, so reloading the page or going back does not lose them. It is never sent to us, your browser deletes it when you close the tab, and clearing your review removes it at once.
• Server logs. Like any website, our hosting provider records standard server logs when your browser requests a page: the IP address, the page and the time, and the browser’s user agent. They are used to deliver the site, keep it secure and diagnose faults, and are deleted on the host’s regular schedule.
• The briefing form. When you send the form on our contact page, the details you enter (your name, work email, company, optional role and company size, your interests and your message) are emailed to hello@vamocles.com through our hosting provider’s mail server (or, if we enable it, our email delivery provider, Resend). We use them only to reply to you and arrange a briefing, we do not add you to a mailing list, and we delete requests that do not lead to a conversation within twelve months. To stop spam, your browser quietly solves a small puzzle from our server when you start using the form (no cookies, no third parties). Our server never keeps a copy of your request. It keeps only short-lived records, in a private folder that is not part of the website, each named by a keyed hash (a scrambled form that cannot be read back): one of your IP address, to limit repeated requests, deleted an hour after your last request; and, once your request has been delivered, one of your email address and message, deleted after 24 hours, so the same request is never sent twice. If sending fails, the page offers a draft in your own email app instead.
• Thymos vulnerability data. The Thymos page loads its list of public vulnerabilities from our own server, at vamocles.com/api/threats. Our server collects that data itself, about every 15 minutes, from public sources: the CISA Known Exploited Vulnerabilities catalogue, the NIST National Vulnerability Database, FIRST EPSS, the ENISA EU Vulnerability Database, the GitHub Advisory Database, national and regional CERTs (CERT-FR, CERT-EU, the Canadian Centre for Cyber Security and HKCERT) and the International Cyber Digest’s public RSS feed. Your browser talks only to vamocles.com, so none of those sources learns of your visit. The request carries nothing about you beyond an ordinary page request, and your watchlist never reaches our server. To limit repeated requests, our server notes the times of your requests under a keyed hash of your IP address, in a private folder that is not part of the website, and deletes that record after an hour without requests.
• Thymos alerts. Alerts are off until you turn them on in Thymos and allow notifications in your browser. When you do, your browser gives us a push address: a web address issued by your browser’s own push service (Google, Mozilla, Apple or Microsoft, depending on the browser) that lets us signal that one browser. Our server keeps that address with your three alert choices (minimum severity, vendor and timing) in a private folder that is not part of the website. We do not ask for or keep a name, an email address or a phone number. When a new record matches your choices, our server sends an empty signal to that address through the push service; it carries no text. Your browser then loads the vulnerability list from vamocles.com and writes the notification on your device. Turning alerts off in Thymos deletes the address from our server at once, and we also delete it when the push service tells us it is no longer in use. The same request limit as above applies.

The apps

The Vamocles apps for iPhone and Mac are available in preview. They are how people command the system, and they are built to keep your information on your device.

• No account. There is no sign-up and no Vamocles login.
• No company backend. The apps do not send your data to a Vamocles server. We cannot see what you keep in them.
• No analytics or advertising. The apps contain no analytics, advertising or tracking code.

Where each piece of information stays

Vanish

Vanish finds your listings on people-search and data-broker sites and prepares official requests to remove them.

• What you give it. Your legal name and any other names, where you live and have lived, a contact email for broker replies, and other emails and phone numbers that might be listed. Your date of birth is optional. Vanish never asks for passport, licence, tax or social security numbers.
• Your consent. Before it searches, Vanish asks you to authorise it to search broker sites and prepare opt-out, deletion and do-not-sell requests on your behalf, using only the identifiers you provide and limited to data removal. It records your name and the time you agreed, on your device.
• Searches. To check a site, the app requests that site’s public search page from your device, with a first and last name you gave it in the address. Your city and phone number stay on your device, where the matching happens. Each site sees the request and your IP address, as it would if you searched it yourself.
• Requests. Vanish drafts each request with the identifiers that broker needs and the legal wording that fits where you live. You send it yourself, from your own email or through the broker’s own form or portal. It goes straight from you to the broker; we do not receive a copy.
• Re-scans. About once a week, Vanish checks again to confirm which listings have gone.

Monitor

Monitor watches the domains and organisations you add for leaks and exposures.

• What it sends. To check a domain, the app asks three public sources about it: LeakIX, with your own API key; the Have I Been Pwned breach directory; and certificate transparency logs through crt.sh. For an organisation, it searches LeakIX by name. Each service sees the request and your IP address, under its own privacy policy.
• What it keeps. Your targets and findings stay in a file on your device.
• What it never does. Monitor never logs in anywhere and never touches the systems it reports on.

Voice, biometrics, files and contacts

• Voice mode. With your permission, the app uses the microphone and Apple’s speech recognition to turn what you say into text. Recognition runs on your device where it is supported; where it is not, or if it fails, your audio is processed by Apple’s servers under Apple’s privacy policy. Vamo’s replies are spoken by your device’s own voice.
• Face ID, Touch ID and passcode. App Lock and the Vault gate ask the operating system to confirm it is you. The app never sees your face, fingerprint or passcode; it learns only whether the check passed.
• File analysis on the Mac. When you drop files on the Scan page or the notch, the app reads their names, metadata and code signatures on your Mac. Nothing is uploaded.
• Trusted contact. If you choose a trusted contact, the app keeps that person’s name and phone number in its settings on your device. On the Mac, choosing one asks for access to Contacts, and only the contact you pick is kept. When you turn on Lock Down, that person gets a message, so someone knows you may be under attack.
• Notifications. Alerts are created on your device. None pass through a Vamocles server.

Your controls in the apps

Everything the apps keep is on your device, so you can export it or delete it yourself, at any time, without asking us.

Delete All Data leaves your LeakIX API key in the Keychain. You can replace it in Monitor’s settings at any time, and on a Mac remove it with Keychain Access, where it is listed as com.vamocles.monitor.leakix.

Organisations and governments

Organisations and governments deploy Vamocles under their own written agreements. Those agreements set out what information is handled, where it is held, who may access it and for how long, and they take precedence over this policy for that deployment.

Where we handle personal data for such a customer, we act on its instructions, as its processor or service provider. If you use Vamocles through your employer or a public body, their privacy notice explains how your information is used, and they are the first place to take a request.

When you write to us

If you email us, request a briefing or report a vulnerability, we receive your email address, your name if you include it, and whatever you write. We use it to reply and to follow up on what you asked, and for nothing else.

We keep it for as long as the conversation needs, then delete it, unless the law requires us to keep it longer.

Legal bases

Where the GDPR or the UK GDPR applies, we rely on these legal bases.

Information the apps keep on your device is not sent to us, so we do not process it. The consent you give in Vanish is your authorisation for the app to act for you, from your device.

Your rights

You have rights over your personal data wherever you live. The laws below spell them out, and we honour them for everyone.

How to exercise them

Write to privacy@vamocles.com and tell us what you would like us to do. We confirm that we have your request, may ask for what we need to be sure it is yours, and reply within the time the law sets: one month under the GDPR and UK GDPR, 45 days under the CCPA and 30 days under PIPEDA, extended only where the law allows and with our reasons.

For information the apps keep on your device, you do not need us: use Export My Data or Delete All Data, described in Your controls in the apps.

Retention

• Website logs are kept by our hosting provider for a limited period for security and operations, then deleted automatically.
• Request limits for the briefing form and Thymos are short-lived keyed hashes, deleted on the schedules described in The briefing form and Thymos vulnerability data.
• Correspondence is kept for as long as it takes to deal with it, then deleted, unless the law requires otherwise.
• App data stays on your device until you delete it. Use Delete All Data before you remove an app, because the Keychain can outlast the app.
• Organisational deployments follow the retention set in the customer’s agreement.

Children

Vamocles is not directed at children under 16, and we do not knowingly collect personal data from them. If you believe a child has sent us personal data, write to privacy@vamocles.com and we will delete it.

Security

This website is served only over HTTPS, with a strict content security policy and no third-party code. The apps keep sensitive items in the Keychain, write results on iPhone with full file protection, and can lock behind Face ID, Touch ID or your passcode.

No system is perfectly secure. If you find a vulnerability, please tell us at security@vamocles.com. Our disclosure policy explains how we work with researchers.

International transfers

We serve people in many countries, and personal data we hold may be processed outside the country where you live, for example by our hosting provider or our email service. When it leaves the UK, the EU or the EEA, we protect it with safeguards the law recognises, such as the European Commission’s standard contractual clauses and the UK’s international data transfer addendum.

The services the apps talk to on your behalf, such as broker sites, LeakIX, Have I Been Pwned, crt.sh and Apple, are independent. They operate under their own policies and from their own locations.

Changes

When we change this policy, we update the date at the top of this page. If a change affects how we handle personal data in a meaningful way, we say so clearly here before it takes effect.

11 November 2026. Thymos can now send browser push alerts. If you turn them on, our server keeps your browser’s push address and your alert choices until you turn them off (see Thymos alerts). Alert drafts, which could hold an email address or phone number in your browser, are gone, and any saved draft is removed from your browser on your next visit to Thymos.

30 October 2026. The briefing form now runs a private check in your browser to stop automated spam, can be delivered through our hosting provider’s mail server, and keeps short-lived hashes for the same purpose (see The briefing form). We also list what your browser keeps for the security assessment and Thymos (see Things you choose to save and Answers in an open tab), and explain that Thymos loads public vulnerability data through our own server, which keeps only a short-lived keyed hash to limit repeated requests (see Thymos vulnerability data).

Contact

Vamocles is the controller for the personal data described in this policy.