Last changed 10 September 2026 · applies to Viruxa Cloud 0.3.1
This describes what the software does, not what a lawyer would like it to say. Everything below can be checked against the program you are running: each claim names the flag that causes it and the host it talks to, and a scan tells you at the top which of them are switched on.
Your code stays on your machine. Scanning happens locally. There is no account to create, nothing to sign in to, and the scanner works with the network unplugged.
There is no telemetry. No analytics, no usage counting, no crash reporting, no "anonymous statistics". We do not know how many people run this, how often, or on what. That is not a setting you can turn off, because it was never written.
Four things can leave, and each one is a choice you make. They are listed below with what goes and where. One of them sends parts of your code, is off unless you ask for it, and says so on screen before it runs.
| What | When | What is sent |
|---|---|---|
| Vulnerable dependencies | On by default. --offline stops it. |
The name, ecosystem and version of each installed
package, to api.osv.dev. Nothing else — not the path the
lockfile was found at, not the project name, not a line of code.
Advisory ratings also come from cisa.gov and
deps.dev.
|
| Credential checks | Only with --verify. |
A credential the scan found, sent to the vendor it belongs to and nobody else, to ask whether it still works. A GitHub token goes to GitHub; a Stripe key goes to Stripe. Never in a URL, always over HTTPS, and a redirect is refused rather than followed. |
| Container images | Only with --layers. |
A request to the registry your Dockerfile already names, for the image it already names, to read the package list inside it. Six public registries are allowed; a private one is reported as not-checked rather than reached for. |
| Cloud accounts | Only with --cloud. |
Read-only calls to your own AWS, Azure, GCP or other account, using credentials already on your machine. Those calls go to your provider. They do not come to us. |
--review asks a language model to look at files the scan found
problems in. With --review=anthropic the contents of
those files are sent to api.anthropic.com.
It is off unless you ask for it, --offline overrides it, and
before it runs the scan prints a line saying how many files are about to be
sent and where. Pointed at a model running on your own machine instead, the
same line says nothing leaves.
--push sends finished scans to a server you have configured
with viruxa connect — one you run, or one we host if you have
asked us to. It is off unless you set it up.
Be clear about what a finding contains: the rule, the severity, the file path, the line number, and up to 200 characters of the matching line. That last part is a fragment of your code. It is there because a dashboard listing findings with no evidence is a dashboard nobody can act on — but it is a fragment of your code leaving your machine, and a page that told you otherwise would be lying to you.
The scan also sends your machine's hostname and the project name, so the dashboard can tell two machines apart.
A licence key is an Ed25519 signature checked on your own machine. Installing one, and every check afterwards, contacts nobody. It works on a disconnected network, and we cannot see when, where or whether you are using it.
That is not a convenience. A tool that would not read your code until it had phoned a licence server would have broken the promise at the top of this page before it started — and it would break it for exactly the people who most need the promise kept.
When you buy, the payment is handled by Razorpay, who receive your payment details; we never see a card number. We keep the name and email you gave at checkout, because a licence is issued to a name and sent to an address, and we need those to reissue a key you have lost.
~/.viruxa/config.json — your licence key if you have one,
the server you connected to if you did, and how many free scans have been
run. Readable by you and deletable by you.
Deleting the .viruxa directory removes all of it. The desktop
app has a way to forget its tabs, because somebody who scanned a client's
repository on a shared machine should be able to remove the record of
having done it.
This is a developer tool and is not directed at children. We do not knowingly collect anything from anybody under 16 — which is easier to promise than usual, because we do not knowingly collect anything from anybody.
If this page changes, the date at the top changes with it, and the version it applies to is named beside it. A change that makes the software send something it did not send before will be described here in the same terms as the rest — the flag that causes it and the host it goes to.
viruxacloud@gmail.com — for anything here, including a request to delete what we hold. Viruxa Cloud is a product of Brainybolt, which is the name that appears on your card statement.