VACA Privacy and Data-Minimization Policy

Effective: July 26, 2026

Purpose

VACA is a free claims-development assistant. It is designed to retain only the minimum structured information necessary to maintain an account, continue claim development across devices, restore a saved workspace, enforce fair-use limits, and protect the service from abuse.

What VACA may retain

Account email, internal identifiers, account status, password and recovery hashes, session records, owner-control actions, non-content usage totals, storage totals, structured claim names/statuses/next actions, selected redacted facts, drafts, and claim-development work the user chooses to save.

What VACA does not request or intentionally retain

Social Security numbers, VA file numbers, claim numbers used as identifiers, dates of birth, home addresses, phone numbers, payment information, unredacted medical-record files, full C-files, original PDFs, DOCX files, scans, photographs of records, or API secrets.

Documents and temporary analysis

VACA does not provide server-side document storage. Text selected by a user for analysis may be transmitted temporarily through Cloudflare and the configured AI provider to generate a response. The user should redact identifying numbers and unnecessary personal information before sending text.

Shared GitHub knowledge

The public GitHub repository contains only public authority, public research, templates, playbooks, and de-identified reusable knowledge. Veteran-specific records, account information, and secrets must never be placed there.

User controls

Users may download their VACA workspace, change their password, sign out, and ask the owner to correct or remove their account. The owner may authorize, suspend, revoke sessions, permanently block, set quotas, issue a new recovery code, or delete an account.

Storage limits

VACA may set per-account limits to preserve free operation. Users are warned near their limit and may download older information before deleting online claim records they no longer need.

Security and legal scope

VACA uses reasonable safeguards and data minimization. VACA is not a healthcare provider, health plan, VA system, legal representative, or emergency service. Whether a particular privacy or breach-notification law applies depends on the facts and applicable jurisdiction; this policy does not promise that no legal duty could ever apply.