Vdex privacy policy

Last updated 3 November 2026. Applies to the Vdex web app, the Vdex desktop app for Windows, Mac and Linux, and the Vdex app on Google Play.

Using Vdex is also covered by the terms of service.

1. Who is responsible

Vdex is made and published by its developer, TheCrowBro, at vdex.crowmade.app. Questions about this policy can be sent to the support address at crowmade.app.

2. What Vdex stores, and where

Vdex keeps the information you enter in the app's own storage on your device: the browser's storage for the web app, and the app's folder for the desktop app. That information can include:

• Bookings: the job, the client and their contacts, addresses, dates, the schedule, notes, and the hours you worked.
• Call sheets, quotes and invoices made from those bookings.
• Budgets on your bookings: cost lines with estimates, actual costs and who they are paid to.
• Stripboards on your bookings: scenes, sets, cast names, page counts and your notes on each strip.
• Crew: names, roles, phone numbers, email addresses and day rates.
• Equipment: items, serial numbers, values, warranties and service history.
• Venues: addresses, access notes and map coordinates.
• Insurance policies and their dates.
• Your own profile: your name, contact details and the QR contact card made from them.
• Timecode notes, scripts you import, and your settings.

None of this is sent to us. You can see or erase all of it at any time, and save a copy of it once you have a licence, under Settings → Backups & data.

3. Your PIN and fingerprint or face unlock

If you set a PIN, Vdex encrypts its storage with a key derived from that PIN using AES-256-GCM. The PIN itself is never stored, and nobody, including us, can recover it. Fingerprint or face unlock uses your device's own system (WebAuthn). Vdex never sees your fingerprint or your face; it only receives the device's confirmation that it was you.

4. When information leaves your device

Each of the following is optional. You switch it on, or trigger it, yourself.

Cloud storage you link

You can link Google Drive, Apple iCloud, Dropbox, Microsoft OneDrive, a WebDAV server of your choosing, or a folder on your computer. Vdex then saves its database and backup files into your own account, so your other devices can read them and a copy survives a lost phone. That content is held by the provider under its own privacy policy. We have no access to it. With iCloud, the copy is kept in Vdex's container in your private iCloud database through Apple's CloudKit service: it counts toward your iCloud storage, only you can read it, and Apple says it does not access it except as the law requires. In Vdex, “Delete Vdex’s copy from iCloud” removes it; you can also manage iCloud storage in your Apple account settings. Sign-in tokens stay on your device and are encrypted while Vdex is locked. You can unlink the storage in Vdex at any time and withdraw Vdex's access in your provider's account settings. Linking a cloud storage needs a Vdex licence; without one, a storage linked before is paused and Vdex sends it nothing.

Calendar sync and calendar feeds

If you switch on calendar sync, Vdex creates and updates events for your bookings in your own Google Calendar or Microsoft Outlook calendar: the title, dates, location and description. The "Add to calendar" buttons open your calendar app with the same details. If you create a calendar feed, Vdex saves a calendar file to your linked storage and asks that provider for a share link (iCloud gives no such link, so there is no feed with iCloud). Anyone who has that link can read the feed, so share it only with the people you want.

Weather

For a booking with a location, Vdex asks Open-Meteo (open-meteo.com) for the forecast. It sends the map coordinates of the shoot location and nothing else: no names, no account and no identifier.

Addresses and maps

When you look up a venue or press "Find on map", Vdex sends the address text to OpenStreetMap's Nominatim service to turn it into coordinates, and loads map images for the area shown from OpenStreetMap's tile servers. Directions buttons open Google Maps or Apple Maps on your device with the address.

Scanning a printed script

Text recognition runs on your device. The first time you use it, the app downloads the recognition library and its English language data from public content delivery networks (cdnjs by Cloudflare, jsDelivr and the Tesseract.js project). The photo of the page never leaves your device.

Signing in to Google, Apple, Dropbox or Microsoft

When you connect Google Drive, Google Calendar, iCloud, Dropbox, OneDrive or Outlook, you sign in on that service's own page, so Vdex never sees your password. For Google, Google's sign-in library loads from Google. For iCloud, Apple's page sends you back to Vdex with a session that Vdex keeps on your device, encrypted while Vdex is locked; it lasts about two weeks if you tick “Keep me signed in”. In the desktop app the sign-in page opens in your web browser and the answer comes back to Vdex through the app's own address on your computer. Vdex receives only a token that lets it reach the files and calendars you allowed.

Sharing

When you email a call sheet, a quote or an invoice, Vdex opens your mail app with the text ready to send. Printing and the share sheet hand the document to the app you choose. Vdex sends nothing itself.

Invoice, quote and crew links, and payment buttons

When you make a link for a client, or a "Share with crew" link for your cast and crew, the whole document is packed inside the link itself. A crew link always carries the shoot's title, type and dates, the call, lunch, break and wrap times, the schedule, the location and venue details (access, parking, power, nearest hospital), dress code, weather notes, the emergency contact, and your name, phone number and email address from your profile. You choose whether it also carries the client's name; the crew (names, roles, call times, phone numbers and email addresses); the client's contacts and who is on set (off unless you tick it); the scenes from the stripboard, by day (scene numbers, sets, times of day, a one-line description, the cast names and page counts; never a strip's notes); the shot list; the equipment list (without values); the deliverables; the venue rules; and the call sheet instructions. It never carries prices, rates, budgets, quotes, invoices, kit values or your booking notes. Opening it loads only Vdex's own page files; the contents of the document never reach us or any server, and nothing is stored online. Anyone who has a link can read it, so share an invoice or quote link only with the client, and a crew link only with your cast and crew. The Pay buttons on an invoice open the payment service you chose, such as PayPal, Venmo, Cash App or a payment page of your own, with the amount and the invoice number filled in; what happens from there is between the client and that service, under its privacy policy. Vdex is never told whether a payment was made; you record payments yourself.

Linking two devices

When you link two devices with 🔗 Link device in timecode notes, each device asks a Google server (stun.l.google.com) for its own internet address so the two can find each other. Google receives your device's IP address and nothing else. Your notes then travel directly between the two devices.

The website, updates and the app stores

Vdex's files are served from vdex.crowmade.app by Cloudflare. When you open the app, or it checks for a new version, your browser requests files from Cloudflare, which keeps ordinary web server logs such as your IP address, browser type and the time, under its own privacy statement. The desktop app downloads itself, and checks for new versions, from download.crowmade.app, which Cloudflare also runs, in the same way. If you installed Vdex from Google Play, Google gives us overall install and crash statistics. Those are not linked to anything inside Vdex.

Licences: buying, activating and signing in

Vdex has a 30-day free trial on the website, in the desktop app and in the Android app, and then needs a licence. The trial is counted on your device; nothing is sent for it. If you buy one, you pay on Stripe's checkout page: Link, LLC is the seller, and Stripe handles your payment details under its own privacy policy. We never see your card. Stripe gives us your name, email address and the order, which stay in our Stripe account. We put your name and email address inside your licence code, so Vdex can show whom it is licensed to, and send the code to your email address through Resend. If we give you a free licence, we keep your name, email address and the code in our own records.

When a code is activated on a computer, the desktop app sends our licence server at vdex.crowmade.app (run on Cloudflare) the code, a random number made for that installation of Vdex, and whether the computer is a Mac, Windows or Linux. For each code, the server keeps the list of those numbers, with the type of computer and the dates each was added and last checked, so a code can be used on up to 3 computers. It also notes codes that have been cancelled, for example after a refund. The app checks again about once a week; more often while it cannot get through (about once an hour) or while a code is waiting to be activated, has been moved to another computer or has been cancelled (about once a day), and not at all once a code has ended. Nothing else is sent: no hardware details, network names, location or anything from your work. Ask us and we will delete a code's list of computers.

The Android app takes a place on the licence in the same way: after you sign in, it sends the server your sign-in, a random number made for that installation, and "Android".

To sign in on the website or in the Android app, you type your email address. If a licence belongs to it, our licence server emails you a 6-digit code through Resend; if none does, no email is sent. An address not yet linked to a licence is looked up among the orders in our Stripe account, in case it was used to buy one. The server keeps which email addresses belong to which licences (from purchases, from codes we give, and from codes activated in the desktop app), a scrambled form of each sign-in code with its tries, and when codes were sent, for up to a day, so no address gets more than 5 an hour or 4 a day; and a count of the sign-in emails sent each day. Once you are signed in, your browser keeps a signed sign-in note with your email address and your licence's number, and sends it to the server about once a day to check the licence is still good. Signing out deletes it from that browser. The link between your email address and your licence is kept, including after the licence ends or is cancelled, until you ask us to delete it, because signing in depends on it. It is made again whenever that email address or licence code is used, since the code holds the email address and the order holds it in Stripe; ask us and we will delete it with the licence's other records.

The services Vdex may contact

5. Device permissions and why Vdex asks for them

• Camera: the white balance reader, the range finder, QR code scanning and script scanning. Images are processed on the device as you look at them.
• Microphone: the sound level meter and timecode sync listen live. Nothing is recorded or stored.
• Location: sunrise and sunset times, the weather, and the "use my location" button for a venue. A position is kept only where you save it, such as in a venue.
• Notifications: break notifications from the shoot-day clock, shown by your device. There is no push server.
• Motion and orientation: aiming the phone at the sun or Polaris, and the range finder.
• Files: importing and exporting backups, saving PDFs, and scripts you share into Vdex.
• Fingerprint or face: unlocking, as described above.

Each permission is asked for the first time a feature needs it, and can be withdrawn at any time in your device's settings.

6. Children

Vdex is a tool for working film and video professionals. It is not directed at children under 13, or under the age of digital consent where you live, and we do not knowingly hold any information about them.

7. Your choices

• Back up everything (with a licence), or erase everything, under Settings → Backups & data.
• Unlink a cloud storage or calendar in Vdex, and withdraw Vdex's access in that provider's account settings.
• Deny or withdraw any device permission in your device's settings.
• Uninstalling Vdex does not always remove what it stored: the desktop app leaves its data on the computer, and the Google Play app's data is kept by the browser it runs in, usually Chrome. To remove it, use Settings → Backups & data → Erase all data on this device before you uninstall. Copies in your own cloud storage, including monthly backups, stay there until you delete them.

8. Security

Vdex is delivered over HTTPS, runs only code from the addresses listed above, and stores none of your work on any server of ours (the licence server keeps only what is described above). With a PIN set, your information is encrypted on the device whenever Vdex is locked, hidden or closed.

9. Changes to this policy

When this policy changes, the date at the top changes with it. A change that matters is also shown in the app.

10. Contact

Email the support address at crowmade.app.

Terms of service