What Validro stores, and what it never sees.

Validro reads your Claude Code sessions. That is an unusual amount of trust to ask for, so this page is specific about where the boundary sits.

What leaves your computer

The Validro companion runs as a Claude Code Stop hook on your machine. After each response it reads only the new lines of the session transcript and, before anything is sent, removes credentials and rewrites your home directory to ~. What it then uploads is:

• the text of your messages and Claude's replies in that session
• a list of the actions taken — tool names with file paths or commands, such as Edit app/page.tsx or Bash npm test
• the working directory name, session identifier, and timestamps

What never leaves your computer

• File contents. Only paths are recorded, never the code inside a file or the body of an edit.
• Command output. Tool results are discarded before upload.
• Credentials. API keys, tokens, passwords, and private keys are pattern-matched and replaced with [REDACTED] locally.
• Sessions outside the folders you choose. Capture is scoped to the folders you explicitly connect.

Because redaction is best-effort pattern matching, treat it as a strong safeguard rather than a guarantee. If you work with unusually formatted secrets, connect only the folders you are comfortable sharing.

Where it goes

Data is stored in Supabase (Postgres) and is readable only by your workspace. Session text is sent to OpenAI to extract moments and write drafts; OpenAI does not train on API data. Nothing is published to any social platform unless you take that action yourself.

How long it is kept

Captured sessions, moments, and drafts are kept until you delete them. A capture that fails to process keeps a filtered copy of its payload for up to seven days so it can be retried, then expires automatically.

Deleting your data

Settings has a permanent delete that removes your workspace and everything in it — sessions, moments, stories, drafts, and connected devices — and revokes all capture tokens. It cannot be undone. You can also run validro disconnect on any computer to revoke that device and remove the hook.

Contact

For anything not covered here, reach the operator of this instance through the account you signed up with.

Last updated 31 July 2026