Welcome to VAULT — a personal finance and expense tracking application developed by VAULT App ("we", "our", or "us"). This Privacy Policy explains what data we collect, how we use it, and your rights regarding your personal information. By downloading, installing, or using the VAULT app, you agree to the terms described in this Privacy Policy.

1 Information We Collect

A. Information You Provide Directly:

• Full name and email address (during account registration)
• Password — stored in encrypted form only; we never see your plain-text password
• Financial data you enter: income, expenses, categories, notes, amounts, and dates
• Budget limits, savings goals, bill details, and debt information
• Currency preferences and in-app settings
• Profile photo (optional)

B. Information Collected Automatically:

• Device type, operating system version, and app version
• Anonymous crash reports and error logs (used only for bug fixing)
• IP address (used only to suggest a default currency based on your region)
• App usage patterns (to improve features — no personal financial data included)

C. Information from Third Parties:

• If you sign in with Google: your name, email address, and profile photo from Google OAuth
• Live currency exchange rates from ExchangeRate API — no personal data is ever sent to this service

2 How We Use Your Information

Purpose	Data Used
Create and manage your account	Name, email, password
Store and sync your financial data	Transactions, budgets, bills, goals
Display dashboard, charts, and analytics	All transaction data
Send bill due date reminders	Bill names and due dates
Currency conversion	Currency codes only — no personal data sent externally
Generate reports and CSV exports	Transaction history
Fix bugs and improve app performance	Anonymous crash logs only
Respond to customer support requests	Email address, issue description
Comply with legal obligations	As required by applicable law

3 How We Store and Protect Your Data

All data is stored securely using Supabase, a trusted enterprise cloud database platform. Your data is protected by:

• Encryption in transit using TLS 1.2 / TLS 1.3 (HTTPS on all connections)
• Encryption at rest using AES-256 encryption
• Row Level Security (RLS) — only your authenticated account can read or write your data
• Secure session tokens with automatic expiry
• Regular automated backups stored in GDPR-compliant data centers
• No employee access to individual user financial records

4 Data Sharing and Third Parties

We do not sell, trade, or rent your personal data to anyone. We share data only with these essential service providers:

Provider	Purpose	Data Shared
Supabase	Database and authentication infrastructure	Account data and transactions
Google OAuth	Optional Google sign-in	Name and email (only if you use Google login)
ExchangeRate API	Live currency conversion rates	Currency codes only — no personal data
Stripe	PRO subscription payment processing	Payment info only (we never store card details)
Legal authorities	Required by law or valid court order only	Minimum legally required data

5 Data Retention

• Your data is retained as long as your account remains active
• If you delete your account, all personal data is permanently deleted within 30 days
• CSV and PDF files you exported remain on your own device and are your responsibility
• Anonymized, aggregated analytics data (with no personal identifiers) may be retained for app improvement
• You can request immediate deletion at any time by emailing us

6 Your Privacy Rights

Depending on your country or region, you have the following rights:

• Right to Access — Request a full copy of all personal data we hold about you
• Right to Correction — Update or correct any inaccurate information
• Right to Deletion — Request permanent deletion of your account and all associated data
• Right to Export — Download your full transaction history as CSV anytime from within the app
• Right to Withdraw Consent — Stop using the app and request all data be removed
• Right to Object — Object to how we process your personal data
• Right to Portability — Receive your data in a machine-readable format

To exercise any of these rights, email us at privacy@vaultapp.com. We will respond within 30 days.

7 Children's Privacy

VAULT is intended for users aged 13 and above (16 and above in GDPR regions such as the European Union). We do not knowingly collect personal data from children under these ages without verified parental consent.

If you are a parent or guardian and believe your child has created a VAULT account without your consent, please contact us immediately at privacy@vaultapp.com and we will delete the account and all associated data promptly.

8 App Permissions We Request

Permission	Why We Need It	Required?
Internet Access	To sync data, fetch currency rates, and load the app	Yes
Camera	To scan and attach receipts to transactions	Optional
Storage / Files	To save exported CSV or PDF reports to your device	Optional
Notifications	To send bill due date reminders	Optional
Biometric / Fingerprint	To lock the app with fingerprint for your security	Optional

All optional permissions can be denied without affecting the core functionality of the app.

9 Cookies and Tracking

The VAULT mobile app does not use advertising cookies, tracking pixels, or third-party analytics trackers. The app uses secure session tokens stored locally on your device solely to keep you logged in. These tokens are never shared with any third party and expire automatically after a period of inactivity.

10 In-App Purchases and Payments

VAULT offers a PRO subscription tier. Payments are processed securely by Stripe, a PCI-DSS Level 1 certified payment processor. VAULT never stores your credit card number, CVV, or full payment details on our servers. All payment data is handled exclusively by Stripe in accordance with their privacy policy.

Subscription management and cancellation is available directly within the app under Settings.

11 Third-Party Links and Services

The app may display links to external websites or services such as financial news or currency information pages. VAULT is not responsible for the privacy practices of those third-party services. We recommend reading their privacy policies before providing any personal information.

12 Changes to This Privacy Policy

• We may update this Privacy Policy periodically to reflect changes in our practices or for legal compliance
• The "Last Updated" date at the top of this page will always reflect the most recent version
• For significant changes, we will notify you via in-app notification or email before the changes take effect
• Continued use of the app after changes are posted constitutes your acceptance of the updated Privacy Policy

13 Legal Compliance

This Privacy Policy is designed to comply with the following regulations:

• Google Play Developer Program Policies and Developer Distribution Agreement
• General Data Protection Regulation (GDPR) — European Union
• California Consumer Privacy Act (CCPA) — United States
• Personal Data Protection Act (PDPA) — applicable regions in Asia
• Prevention of Electronic Crimes Act (PECA) — Pakistan