Privacy Policy

Effective date: 2026-06-09 Last updated: 2026-04-29

This Privacy Policy explains what information Versus collects, how we use it, and the rights you have. It applies to the Versus website and application at tryversus.app (the "Service").

Versus is operated by Francis Bissonnette, a sole proprietor based in Quebec, Canada ("we", "us"). Contact: info@tryversus.app.

This is a plain-English summary that we intend to be legally binding. If you find anything unclear, write to us — we'd rather rewrite a sentence than leave you guessing.

1. Information we collect

1.1 Information you give us

Account information: email address, password (hashed), and any profile information you choose to add. If you sign in with Google, Apple, Microsoft, or GitHub, we receive a verified email address and a stable user identifier from that provider.
API keys (BYOK): by default, your provider keys (OpenAI, Anthropic, Google, Ollama, custom endpoints) are stored in your browser and never sent to us. If you opt in to server-stored keys in Settings, your keys are encrypted at rest using a key managed by our encrypt-key edge function, and decrypted only at debate time. You can revoke server storage at any time, which deletes the encrypted record.
Debates and content: the questions you ask, the agent configurations you use, the resulting debate transcripts, citations, Report Cards, tags, and any notes you attach.
Billing information: if you subscribe to a paid plan, payment is processed by Stripe. We receive a customer ID and subscription status; we do not see your card number.
Workspace information: if you create or join a workspace, we store the workspace name, member list, scoped roles, and any debates created within the workspace.
Support correspondence: anything you send us by email.

1.2 Information we collect automatically

Authentication cookies: session cookies set by Lovable Cloud / Supabase to keep you logged in. These are required to use the Service.
Operational logs: request timing, error traces, and basic event logs (debate started, debate completed, share-link created, etc.) so we can debug and improve the Service. These are scoped to your account and not sold.
Audit logs: privileged actions in the admin console and changes to your account (suspension, tier override, key encryption, etc.) are recorded for security accountability.
Cookies and similar technologies: see the Cookie Policy for the full list.

1.3 Information we do not collect

We do not train AI models on your debates, prompts, or content.
We do not sell your data.
We do not run third-party advertising trackers.
We do not see the content of your API requests to providers — those go directly from your browser to the provider you chose.

2. How we use information

We use the information above to:

Provide the Service: run debates, store your history, sync across your devices, send notifications you've subscribed to (e.g. scheduled-debate completion).
Operate billing through Stripe and enforce entitlements for your tier.
Provide support when you ask for it.
Detect, investigate, and prevent abuse — including takedown reports against public share links.
Comply with legal obligations.
Send transactional email related to your account: signup confirmation, password reset, magic link, email change, workspace invites, billing receipts, and infrequent product or security announcements. You can opt out of non-essential email at any time.

We do not use your information for any other purpose without telling you first.

You control whether each debate is private (default), unlisted, or public.

Private: only you (and your workspace, if applicable) can see it.
Unlisted: anyone with the tokenized URL can view it, but it isn't indexed.
Public: appears in /explore, is included in sitemap-shares.xml, and may be surfaced by search engines.

Before we render a public share, we strip:

your owner identity (display name, email, avatar)
the cost of the debate
exact model versions
the workspace ID, if applicable

What remains is the question, the agents' role labels, the transcript, and the synthesis. You can optionally attach a "Run by [first name]" footer with your first name only — this is off by default.

You can delete a share at any time and the public page becomes inaccessible immediately. Anyone — including non-users — can submit a takedown report against a public share via the form on the public page. Three valid reports auto-hide the share pending review by us. We may remove a share at any time if it violates the Acceptable Use Policy.

If your account is suspended, all your public shares are auto-flagged as taken down for the duration of the suspension. If you downgrade from Pro to Free, public shares above the Free-tier limit auto-hide after a 7-day grace period; nothing is deleted.

We share information only with the third parties below, only for the purposes listed, and only to the extent strictly necessary.

Lovable Cloud / Supabase — hosts our database, authentication, and edge functions. They process all account data, debates, and encrypted server-stored keys on our behalf.
Stripe — processes payments and manages subscriptions. They receive billing details directly; we never see card numbers.
AI providers (OpenAI, Anthropic, Google, your Ollama instance, your custom endpoints) — receive the prompts and debate context required to run the agents you configure, using your API key. Each provider has its own privacy policy and retention rules. Read them; they apply to your prompts.
Email delivery providers — used to send transactional email related to your account.
OAuth providers (Google, Apple, Microsoft, GitHub) — used only when you choose to sign in with one of them, to verify your identity.

We do not sell, rent, or trade your information. We may disclose information if we are legally required to (subpoena, court order, lawful request from a Canadian or applicable foreign authority), and we will tell you when permitted to do so.

If we ever sell or transfer the Service to another operator, we will tell you in advance and give you a chance to delete your data first.

5. Where data is stored

Account data, debates, and encrypted server-stored keys are stored by Lovable Cloud / Supabase in their managed infrastructure. AI provider calls go to whichever provider you configured, in whatever region they operate.

We are based in Quebec, Canada. If you access the Service from outside Canada, your information will be transferred to and processed in jurisdictions where our processors operate. We rely on the providers above to maintain industry-standard security and to honor applicable data-protection law.

6. How long we keep information

Account information: until you delete your account.
Debates: until you delete them, or — for old debates — until they're archived by the automatic archiving job (/api/public/hooks/archive-old-debates).
API keys (server-stored): until you revoke server storage in Settings or delete your account.
Audit and security logs: retained as long as necessary for security and abuse prevention, typically up to 24 months.
Billing records: retained as required by Canadian tax and consumer-protection law.
Suspended accounts: content remains stored but inaccessible; deleted on request or after a reasonable period.

You can delete your account at any time from Settings. Deletion removes your debates, server-stored keys, workspace memberships, and personal information from our active systems. Audit logs and aggregated usage statistics may be retained where legally required.

7. Your rights

Depending on where you live, you have rights over your personal information. We honor all of these regardless of jurisdiction:

Access — ask for a copy of what we have on you.
Correction — fix anything that's wrong.
Deletion — delete your account and the associated data.
Portability — get your debates exported in Markdown or PDF (built into the app) or request a structured export of your account data.
Objection / restriction — tell us to stop processing for a particular purpose.
Withdraw consent — for anything we do with your consent, you can withdraw it at any time.

To exercise any of these, write to info@tryversus.app. We aim to respond within 30 days.

If you live in Quebec, you also have the right to file a complaint with the Commission d'accès à l'information (CAI). If you live elsewhere, you can complain to your local data-protection authority.

8. Security

We take reasonable measures to protect your information: encrypted transport (HTTPS), encrypted storage of opt-in server-stored keys, Row-Level Security in the database, scoped service-role access for edge functions, and audit logging on privileged actions.

No system is perfectly secure. If we discover a breach affecting your information, we will notify you without undue delay, in accordance with applicable law.

9. Children

The Service is not intended for anyone under 16. If you believe a child has provided us with information, contact info@tryversus.app and we'll delete it.

10. Changes to this policy

We may update this Privacy Policy from time to time. Material changes will be announced by email and the "Last updated" date at the top will change. Continued use of the Service after a change constitutes acceptance.

11. Contact

Questions, complaints, or requests:

Versus Quebec, Canada info@tryversus.app