Privacy

Written 2026-09-18 for v0.1.0, updated same day for v0.1.1. Every claim here is grounded in the code; if the code and this page ever disagree, the code is the bug and this page is the report.

Under owner review (2026-09-18). v0.1.1 added an optional verjuice.app account (last two table rows). The same day's recorded project rulings had declined a commercial tier because it needs a re-license and a telemetry decision. Whether the account features stay is the owner's call; until then this section is described as it exists in the code, not endorsed.

The promise

Verjuice sends nothing anywhere on its own. No telemetry, no analytics, no crash reporting, no usage statistics, no background checks, no timers. There is no server that knows you ran Verjuice, and no "last phoned home" record — because there is no phoning home. This is a structural property of the code, not a policy: the only network-capable functions are the ones listed below, each behind a command you typed or a view you opened.

There is no account requirement: every launch, every registration, and every check works fully without one, and launches never require the network. An optional account exists (last two table rows); signing in is explicit, and verjuice logout removes the key from the machine.

The complete list of network requests Verjuice's own code can make

This is exhaustive. If a request is not on this list, Verjuice's own code cannot make it.

What	When	Where	What it carries
Update check	only when you run `verjuice update check`	`verjuice.app/feeds/latest.json`	nothing but the request itself — the User-Agent names your installed version. One request, 5 s timeout, no retries, nothing remembered, nothing written
umu game-id lookup	when a launch goes through the umu route	`umu.openwinecomponents.org`	the game's title (and store, when known). Fills in umu's own game-id; offline it falls back to a default id and the launch continues
Artwork	when the UI shows a game whose cover is not already cached	Steam's public CDN	the game's public Steam appid, in the URL. Rate-limited, cached locally after the first fetch
Component install	only on your explicit yes to `verjuice install`	GitHub releases, WineHQ, and the other upstreams each component names	nothing but the download request
Database dedupe report	only when you run `verjuice compatdb dedupe` (a maintainer command)	Steam's public search APIs	the game titles you are checking
Account login / `verjuice account`	only when you run `verjuice login` or `verjuice account`	`verjuice.app/api/license`	your account key, in the Authorization header. The answer (your plan) is shown to you; nothing about it is sent onward
Remote app registration	only when you run `verjuice register` while signed in	`verjuice.app/api/apps`	the app's name and its executable path, tied to your account key. Not signed in, this request does not exist; offline, registration falls back to local; over the free tier's 3-app limit, the local registration is refused with an upgrade link (the flagged paywall)

Two of these rows deserve the plain words they usually don't get:

The umu lookup is the one request that happens as part of launching. It sends the title of the game you are launching to the community umu-database. It is not telemetry — the answer changes how your launch is configured, the same way a DNS lookup does — but it is a network request you did not type, and this page would be lying if it called the launch path fully offline. It is not: one title, one lookup, and the launch proceeds fine without it.

The update check is the only request that reaches a Verjuice-owned domain, and it runs only because you typed the command. No timer, no auto-check on launch, no "last checked" record.

What never happens

No usage data, crash dumps, or diagnostics are ever uploaded by Verjuice. There is no endpoint for them and no code that could call one.
Nothing is collected about you beyond what you explicitly send: no name, no email, no hardware fingerprint sent anywhere. Host detection reads your machine to make decisions locally; it reports to your screen, not to a server. The one identity the optional account carries is the key you pasted at login, and it travels only on the two account requests named above.
No background processes, no scheduled tasks, no launch-time phone-home beyond the one umu lookup named above. Launches never require the network or an account.
The compatibility database is a local file. Nothing in it is about you, and nothing in it is synced.

What stays on your machine

Everything except the two account requests named above. Verjuice keeps its records under your own home directory — ~/.local/state/verjuice (registrations, settings, and — only if you signed in — the account key, stored 0600) and ~/.local/share/verjuice (logs, launch history, artwork cache, prefixes). Specifically:

Launch history — the last 50 launches / 30 days, kept so the healing engine and the history view can answer "what happened last time". Local only.
Logs — written locally, retained locally, pruned locally.
The diagnostic bundle (verjuice doctor --export) — built only when you ask, saved only to a file you choose, sent by Verjuice to no one. Its contents are deliberately narrow: the doctor's rows, the paste-ready summary, the retained launch history, and size-capped (64 KiB) tails of recent logs. It never opens your prefix contents, registrations, or settings, and its manifest says so. Before you share it, it redacts: your home path collapses to ~, and credential-shaped values become REDACTED. You are the courier; Verjuice is not.

The tools Verjuice launches act on their own

Verjuice wraps existing tools — Wine, Proton, umu-run, legendary, Whisky, Steam. Once launched, they make their own network connections: umu-run checks its own releases, legendary talks to Epic when you use Epic, Steam logs in and updates, games phone their own homes. Verjuice does not proxy, filter, or exfiltrate that traffic; its local logs may contain the URLs those tools fetched, and those logs stay on your machine. Their privacy practices are theirs to answer for, and this page does not speak for them.

Changes to this statement

This page is dated at the top. If a future change adds a network touchpoint, the change that adds it updates this page — the offline test suites are the enforcement, not good intentions.