Last checked: 26-10-2026
Security, ownership and NDAs, stated plainly.
This page gathers what we already state elsewhere on this site about who owns the code, what we do with your credentials and data, and how our own software is distributed, and adds a way to report a problem. It claims no certification or audit. If a point is not here, we have not claimed it.
Who owns the code, and when
On final payment, all code, repositories, credentials and infrastructure created for the engagement are yours. We work inside your GitHub organisation and your cloud account from the first commit, which means there is nothing to migrate afterwards. We retain no licence over your product and claim no rights in your data.
One exception, stated in our terms: some builds include components from our own registry. Those come to you as editable source under a perpetual, irrevocable licence to use, modify and distribute them as part of your product. We keep the right to use the same components elsewhere, because they predate your project and will outlive it.
Leaving is allowed. Either side can end an engagement in writing; you pay for work completed to that point and we hand over everything produced so far, code, credentials and documentation, in the same condition as a normal handover. We do not hold deliverables to force a renegotiation.
NDAs and confidentiality
We treat everything you share as confidential and will sign your NDA rather than insisting on ours. If you want one in place before you describe your idea, send it to hello@valentir.in before the first call and we will review it; we reply within 1 hour.
Where an engagement touches personal data we work under a data-processing agreement. Access to your systems is limited to named people, set for the length of the engagement and removed at handover.
We would like to describe our work publicly, but we ask first and we accept no. Nothing about your project appears on this site, in a proposal or in a pitch without your agreement, and anything you mark confidential stays that way indefinitely.
Your credentials and access
During an engagement we need access to systems you own. We never accept a real secret through a web form. Accounts are created under your ownership and we are added as a user, then removed at handover, and that access is limited to the project and governed by your contract. The reasoning is in never accept a client secret through a web form.
Hosting is set up in your own account, such as Vercel or AWS, so the bill and the control are yours, and you are never in a position where leaving us means losing your infrastructure. For custom software, infrastructure as code in your cloud account and a set of runbooks with a live handover week are part of the engagement.
What this website collects
The privacy page lists what this site collects, why, and which tools it uses. In short: enquiries go to our own admin panel rather than a third-party CRM, no advertising pixels, retargeting or fingerprinting scripts run on the site, and we do not sell data.
Our desktop apps: unsigned installers, and how to check one
Our Windows desktop apps are distributed as NSIS installers, and none of them is code-signed yet. Windows cannot vouch for the publisher of an unsigned installer and may show a warning when you run one. Until they are signed, each product page prints the installer's SHA-256 hash, so you can check the file you downloaded against it.
To check one, open PowerShell in the folder with the download and run Get-FileHash installer.exe -Algorithm SHA256, using the file's real name. Compare the result with the hash on the product page. If they differ, delete the file and write to us. A matching hash shows that the file is the one the page lists. It protects against a corrupted or swapped download, not against a compromise of this website, and it is not a substitute for a signature.
Some product pages describe how an app handles your data. The pages for Meetnote, LiveScribe and Searchlight describe processing on your own PC, and the pages for Logstack and Syscommand describe zero cloud telemetry. We have not widened those statements here: read the product's own page for exactly what it says.
Reporting a vulnerability
Email hello@valentir.in with "Security" in the subject. Tell us what you found, where it is (the address, or the app and its version) and how to reproduce it. Please do not access other people's data, do not run tests that disrupt the site, and give us reasonable time to fix a problem before you publish it. A person reads that inbox.
We publish no PGP key. If the detail is sensitive, send a short first message saying so, and we will reply with how to send the rest. We run no bug bounty and do not pay for reports.
What this page does not claim
We make no claim here of a security certification, an independent audit or a penetration test. We state nothing about encryption, backups or incident response beyond what is written above. If that changes, this page will say so, with who issued it and when.
Last checked: 26-10-2026. The binding terms for any engagement are in its statement of work; this page summarises what we state on our terms and privacy pages.
The things people ask first.
If the awkward question is not here, send it. We would rather have the difficult conversation now than three weeks into a build.
Ask us directlyOne reply, from whoever would build it5 answered in full
Send us your questions first.
Send your NDA or your security questionnaire before the first call. We reply within 1 hour, and where a question asks for something we do not have, the answer says so.