Privacy notice

Effective October 16, 2026

Who we are

FedXchange is a free service run by Varry LLC (“we”). This notice covers this website, fedxchange.com, and the FedXchange app and its services at app.fedxchange.com, api.fedxchange.com, and mcp.fedx.io.

This website

This site runs no analytics or advertising trackers. Our hosting provider, Cloudflare, handles each request, including your network (IP) address, to deliver pages and protect the site from attacks.

Concord, our privacy provider, shows the cookie and privacy choices on every page of this site. It asks before anything that isn't needed to run the site can load, and it blocks such tools until you agree. It stores your choice in your browser so it doesn't ask on every page, and records the choice and the date with Concord so we can show what you agreed to. You can change your choice at any time with the “Your privacy choices” link at the bottom of every page of this site, and send a privacy request there too.

Some governance tracker pages are FedRAMP videos on YouTube. Those pages show the video's picture from our own site and load nothing from YouTube until you press play. When you press play, the page loads YouTube's player in its privacy-enhanced mode, and YouTube's privacy policy applies to what it collects. Newsletter emails show the same picture from our site, the same file for everyone.

The contact and security report forms

When you send a form, we collect:

• your name, work email, agency or company, and role, if you give one;
• your message, if you write one;
• a scrambled, one-way code made from your network address, used only to limit repeated sends. We don't store the address itself.

We use these details only to reply to you. Your message is emailed to us, and our replies come from a person at Varry LLC. We delete form messages automatically 12 months after they arrive.

The governance tracker's tip form

When you send a tip, we collect what you write, your name and email if you give them, and the same scrambled code from your network address to limit repeated sends. Tips go to the tracker's editors by email and wait for them in the FedXchange app. We never show a tip, or who sent it, on this site. We delete tips automatically 12 months after they arrive.

Newsletter and alerts

If you sign up for the weekly newsletter or instant alerts, we store:

• your email address;
• your choices: the weekly newsletter, instant alerts, and any issuers or topics you picked for alerts;
• the page you signed up on;
• a scrambled, one-way code made from your network address (a keyed hash), used only to limit repeated sign-ups. We don't store the address itself;
• the dates you signed up, confirmed, changed your choices, or unsubscribed;
• which issues and alerts we sent you, so that none is sent twice.

We use these only to send what you asked for and to stop misuse of the sign-up form. Emailit sends the email for Varry LLC. We don't track whether you open an email or click its links. Our emails show the FedXchange logo from this site. Everyone gets the same picture, so loading it doesn't tell us who opened an email.

Nothing is sent until you follow the link in the confirmation email. Every email has a link to unsubscribe in one click and a link to change your choices. If you don't confirm a sign-up, we delete it after 7 days. When you unsubscribe, we delete your address after 30 days.

If an email to you bounces, or you mark one as spam, we stop sending you the newsletter, alerts, and change notices at once. So that we never send to that address again, we keep a scrambled, one-way code made from it (a keyed hash), not the address itself. We keep the code after you unsubscribe or delete your account. To get our email again, write to us from the contact form.

The FedXchange app

If you become a member of an agency in FedXchange, we hold:

• your name and work email, and the sign-in methods you set up, such as passkeys and an authenticator app;
• your role in each agency you belong to;
• your agency's setup: the services it chose, its titles for offices and roles, its decisions on governance changes, and an audit log of who changed what and when;
• the access tokens you create, stored only as hashes, and the AI assistants you connect.

The app uses a cookie to keep you signed in. We send sign-in links, invitations, and change notices by email.

Owners and admins get an email when the governance watch finds a change for their agency. Every one has a link that stops them in one step, with no sign-in, and mail apps that offer their own unsubscribe button can use it too. We stop them right away. You can turn them back on under Settings in the app. Sign-in links and invitations come only when you or a colleague ask for them, so they have no unsubscribe link.

Deleting your account

You can delete your own account at any time. In the app, open Settings and use “Delete your account” at the bottom of the page. You must have signed in within the last 15 minutes, so someone using a session left open on another computer can't delete it. You type your email address to confirm.

When you delete your account, we delete right away:

• your name, email address, and sign-in methods, including passkeys, the authenticator app, and Google, GitHub, or Microsoft sign-in;
• every session, so you are signed out on every device;
• your membership in each agency, and invitations you sent or that were sent to you;
• your access tokens and connected AI assistants, which stop working at once;
• your bookmarks, the agencies you chose for the deliverables tracker, and your email choices;
• your newsletter subscription, if you have one at the same address;
• any agency where you are the only member, with its setup and documents. The app lists these agencies before you confirm.

If you are the only owner of an agency that has other members, the app asks you first to make another member an owner, or to delete the agency.

Agencies you leave keep what they made, such as their setup, decisions, documents, and audit log, because those belong to the agency. We take your name, email, and user ID off those records and show “Former member” instead. Blog posts keep the byline they show. Messages you sent through the contact or tip forms are separate from your account. We delete those 12 months after they arrive.

We send one email to confirm that the account is deleted. It has no unsubscribe link, because it is the last email about that account.

AI assistants

FedXchange runs no AI model of its own. If you connect an AI assistant, what it reads from FedXchange, and what you type to it, goes to that assistant's provider under your agency's terms with them. We keep a record of each connection: the assistant's name, the agency, and the date.

Who else handles your information

We don't sell personal information or use it for advertising. These service providers handle it for us:

We may also disclose information when the law requires it.

Links to RMF Coach

Links from this site to RMF Coach, another Varry LLC service, carry a tag that tells RMF Coach the visit came from FedXchange. FedXchange and RMF Coach have separate accounts and don't share them.

Your choices

You can delete your own account yourself, from Settings in the app. You can also ask to see, correct, or delete the personal information we hold about you, or to have your agency's data deleted. Use the contact form. We'll reply by email.

Security

See Security for how FedXchange protects what it holds, and what not to put in it.

Children

FedXchange is a work tool for adults and isn't directed to children.

Changes to this notice

When we change this notice, we update the effective date above. If a change matters to how we use members' information, we'll email members before it takes effect.