Changelog

Every published change to the legal text, newest first. Each entry lists the documents it changes and says whether the change is material. A material change makes the products show the terms pop-up again, so users must re-accept.

Dates are the "Last updated" dates in the documents and in versions.json.

2026-09-30 — VibeKit: the date you last used the admin (progress records)

• Documents: vibekit/privacy. The 28 September 2026 version is archived.
• What changed: Privacy §2.1, Progress records, adds "the date you last used the administrative application". The admin API records it at most once a day (app_metadata.last_active_at, aextra-vibekit P/lib/account.ts noteActive), and the customer sync copies it to our customer list as "Last active" (P/lib/customer-sync.ts), where the win-back email reads it instead of the last sign-in. Live since 30 September 2026 (aextra-vibekit #104). Before this, someone who stayed signed in and used VibeKit daily would have been told "we haven't seen you".
• Obligations: no new promise; V-22 (what the customer list holds: account details and progress records) now includes this date.
• Material: no (the owner, 30 September 2026): one more date of the same kind as "when you last signed in", used for the same emails. acceptance.vibekit stays 2026-09-28.

2026-09-30 — ReMail: AI drafting uses Google Gemini, not Anthropic

• Documents: remail/privacy, subprocessors (ReMail table only). The 29 September 2026 versions are archived.
• What changed: a correction, so the policy describes what the product does (checked in the code on 28 September 2026: REMAIL_AI_MODEL_* in aextra-vibekit cloudflare/proxy/wrangler.toml are google/gemini-3-flash and google/gemini-3.1-flash-lite, reached through the Workers AI binding and Cloudflare AI Gateway aextra).
  • Privacy §2.5: AI drafting requests go to Google's Gemini models through Cloudflare AI Gateway, not Anthropic's. It also lists what the prompt builders send that the text left out: the options of choice fields, and the names of the project's Screens. The sentence about the model provider's training use is removed; ours stays.
  • Privacy §6 and the sub-processors page: the Anthropic row is removed; Google's row adds Gemini AI models for AI drafting.
• Obligations: changes R-28.
• Material: yes (a different provider receives the data). The ReMail pop-up must ask everyone to accept version remail:2026-09-30.

2026-09-29 — ReMail: marketing and transactional emails, Screens, AI drafting, Project API

• Documents: remail/terms, remail/privacy, subprocessors (ReMail table only). The previous versions are archived.
• Published early: the owner approved publishing on 28 September 2026, before every feature described here is on ReMail's master. Where the text describes a feature that is not live yet (such as the transactional template type), it discloses more than the product does; the obligation rows stay gap until the code is verified.
• What changed:
  • Terms §2 and §3: new definitions for Screen, Visitor, and Marketing and Transactional templates; the Service now includes Screens, AI drafting, and the Project API; Customer Configuration includes template types, Screen settings, and campaign steps.
  • Terms §9.3: every template is Marketing (the default) or Transactional. The unsubscribe link, one-click headers, and postal address are added to marketing emails only; suppression applies to every email; a postal address is required before a project sends marketing email live; transactional templates must not be used for marketing.
  • Terms §9.7 (new): sign-in code emails for Screens are transactional, are sent through the Customer's Resend account, and the codes are never stored.
  • Terms §10.2 and §10.3 (new): misconfiguration now covers mislabelled templates and Screens; Project API keys are shown once, stored only as a hash, and the Customer must keep them secret.
  • Terms §12.1: corrected. ReMail also changes records through Screen forms, Screen actions, and campaign "Update record" steps, only in the fields named there; it still never deletes the Customer's records except simulation batch logs.
  • Terms §12.2: Resend also delivers Screen sign-in codes.
  • Terms §13.3 (new): Screens, the three ways a record's page can be opened, and that Public record-id links can be guessed.
  • Privacy §1 and §9: transactional emails may have no unsubscribe link; Visitors to Screens are a new kind of data subject.
  • Privacy §2.1: template history, Screens, Project API key hashes, and AI drafting requests; the postal address is added to marketing emails.
  • Privacy §2.2: Visitors (submissions pass through to Airtable; hashed IP counters; sign-in codes) and Screen activity events. Still no open-tracking pixels or click tracking.
  • Privacy §2.5 (new): AI drafting, what is sent to Anthropic through Cloudflare AI Gateway, and that record values are not sent. Children moves to §2.6.
  • Privacy §3, §6 and §7: new uses, Anthropic and AI Gateway added to the provider list, and hashed IPs and API keys.
  • Privacy §8: retention periods for template history, Screens and link keys, Screen activity, sign-in attempt counters, and API key hashes; project and account deletion cover them.
  • Sub-processors: the ReMail table matches privacy §6.
• Obligations: changes R-01, R-02, R-04, R-07 and R-17. Adds R-24 to R-30.
• Material: yes. The ReMail pop-up must ask everyone to accept version remail:2026-09-29.

2026-09-28 — VibeKit: customer list in Airtable, sent with ReMail; optional surveys

• Documents: vibekit/privacy, shared/subprocessors. The previous versions (26 and 25 September 2026) are archived.
• What changed:
  • Privacy §2.1: new category, progress records and feedback (setup milestone dates, project and query counts, last sign-in, survey answers).
  • Privacy §3: we ask for feedback through optional surveys, and use the feedback to improve the Service.
  • Privacy §4: the product-update list is now our customer list, kept in Airtable and sent from with ReMail (delivered through Resend), not a Resend list. It adds product updates and occasional optional surveys. Opting out also stops surveys, and a "never email me" or "this project" unsubscribe switches the My account setting off.
  • Privacy §8 and the shared sub-processors page: Airtable also holds our own customer list; Resend delivers our product-update, onboarding and survey emails.
  • Privacy §10: retention of the customer list entry (while the account is active, deleted with it); account deletion erases it, including survey answers.
• Obligations: adds V-22. Changes the code references of V-08 and V-10.
• Material: yes (a new provider purpose, new data and a new use). VibeKit's pop-up must ask everyone to accept version 2026-09-28.

2026-09-26 — ReMail: unsubscribe, suppression, postal address, self-service deletion, clickwrap

• Documents: remail/terms, remail/privacy. The 25 September 2026 versions are archived.
• What changed:
  • Terms §1: acceptance is now a tick box plus click, and it is recorded.
  • Terms §9.3: rewritten. ReMail adds a per-recipient unsubscribe link with three choices, plus one-click unsubscribe headers. It keeps a suppression list, and live sends require a postal address in the footer. Customers must not remove the link or the address, and they remain responsible for other opt-outs, copied recipients, consent records and address accuracy.
  • Terms §12.1: says our servers enforce the Airtable limits.
  • Terms §13.2: templates no longer contain placeholder unsubscribe links.
  • Privacy §1 and §9: Recipients can unsubscribe using the link.
  • Privacy §2.1: now lists the sender postal address and terms acceptance records.
  • Privacy §2.2: the suppression list, stored as a keyed hash only.
  • Privacy §2.4: the application's own fonts are self-hosted; the customer's brand fonts are disclosed.
  • Privacy §3: now says we honour unsubscribes.
  • Privacy §4: an opt-out at sign-up and a My account switch.
  • Privacy §7: the suppression list is stored in coded form only.
  • Privacy §8: suppression list and terms acceptance retention; self-service deletion of keys, logos, brands, projects and the account.
• Obligations: makes R-01, R-02, R-03, R-04, R-08, R-10, R-11 and R-12 published promises. Adds R-23. R-07, R-09 and R-17 are met by the same release.
• Material: yes. The ReMail pop-up (R-10) must ask everyone to accept version remail:2026-09-26.

2026-09-26 — Privacy: what Google sign-in shares, and admin sign-in link expiry

• Documents: vibekit/privacy, remail/privacy. The 25 September 2026 versions are archived.
• What changed: corrections, so the policies describe what the products actually do (obligations V-03 and V-06).
  • Privacy §2.1 (both): if you sign in with Google, we also have your name and the address of your Google profile picture.
  • Privacy §2.3 (both): customers' admin Google sign-in goes through Supabase, which requests the email and profile scopes, so Google shares the email address, whether it is verified, the name and the profile-picture address. Supabase stores them; we use the name only in product-update and onboarding emails and don't use the picture. End users' sign-in to a Customer Application still requests only openid and email (VibeKit).
  • Privacy §4 (both): the product-update list gets your name too, when we have it.
  • VibeKit privacy §10: end users' sign-in links and codes last 15 minutes; customers' admin sign-in links and codes last 1 hour.
• Material: yes. It changes what data we say we collect, who we share it with (the name, with Resend) and how long sign-in links last. acceptance.vibekit and acceptance.remail are now 2026-09-26, so both products must bump their terms versions.

2026-09-25 — Moved into aextra-legal

• Documents: vibekit/terms, vibekit/privacy, remail/terms, remail/privacy (dated 25 September 2026). New pages: subprocessors, data-processing.
• What changed: nothing in the wording. The four documents were moved here byte for byte from the product repos: VibeKit from Airconnex/aextra-vibekit apps/admin/src/content/ at 8f8914f, and ReMail from Airconnex/aextra-remail apps/admin/src/content/ at b264ac9. Before the move, each file was checked to be identical to the text served at vibekit.aextra.ai and remail.aextra.ai. The only edits are internal links, rewritten for the new paths (/terms → /vibekit/terms or /remail/terms, and the same for /privacy); that is three links per product. subprocessors and data-processing quote the provider tables and processor terms from those documents word for word, with a sentence of introduction.
• Material: no. Versions stay at 2026-09-25, so no one is asked to re-accept.

2026-09-25 — VibeKit and ReMail rewrite (before this repo existed)

• Documents: vibekit/terms, vibekit/privacy (rewritten for VibeKit; published at vibekit.aextra.ai), remail/terms, remail/privacy (ReMail's own documents; published at remail.aextra.ai).
• Material: yes. VibeKit introduced its terms pop-up at TERMS_VERSION = '2026-09-25'. ReMail has no pop-up yet (obligation R-10).
• Superseded: the Aeropage-branded Terms of 12 June 2026 and Privacy Policy of 29 July 2026, which both products served until then (ReMail from 20 September 2026). They are archived under each product.

2026-07-29 — Aeropage Privacy Policy (before this repo existed)

• Documents: vibekit/privacy (archived as archive/vibekit/privacy/2026-07-29.md; ReMail also served it from 20 September 2026: archive/remail/privacy/2026-07-29.md).
• Material: not recorded. There was no terms pop-up at the time.

2026-06-12 — Aeropage Terms of Service (before this repo existed)

• Documents: vibekit/terms (archived as archive/vibekit/terms/2026-06-12.md; ReMail also served it from 20 September 2026: archive/remail/terms/2026-06-12.md).
• Material: not recorded. There was no terms pop-up at the time.