Privacy Policy

Account details. Your email address, name (if provided), a hashed password, and your subscription plan.

The items you save. Receipts, invoices, warranty details, and subscription records that you upload or that are imported from a mailbox you connect. These stay inside your own account and are only accessible to household members you explicitly invite.

Connected mailbox metadata. If you connect an Outlook or IMAP mailbox, we store the tokens or encrypted credentials needed to read purchase-related emails. We only read emails matching purchase-receipt signals (subject contains words like "receipt", "order", "invoice", "confirmation", "subscription", "renewal", "billing") — never your personal correspondence.

Payment details. If you upgrade, Stripe processes your payment. We store a customer reference and subscription status. We never see your full card number.

Product usage and analytics. Basic logs (page loads, API requests, error traces) keep the service running. We also use a limited set of third-party analytics and advertising tools — Google Analytics 4, Google Ads and Google Tag Manager, Meta Pixel, PostHog, and Microsoft Clarity — to measure website performance, improve the product, and support our marketing. Microsoft Clarity additionally provides heatmaps and aggregated, masked session recordings of our public website pages to help us understand and improve the experience; it runs only on public pages, never inside your signed-in vault. These tools are used for measurement and advertising; they are not used to access the contents of your vault.

To operate Vaultiq: show your items, generate reminders for return windows / warranty expiry / subscription renewals, send the email notifications you enabled, and process billing.

To improve Vaultiq: detect bugs and usage patterns in aggregate. We do not build advertising profiles or sell data.

We share data only with the limited set of processors needed to run the product:

• OpenAI — to parse the text of receipts you upload or import, so we can auto-fill fields. We send the receipt content and receive structured fields back.
• Microsoft (Outlook / Graph API) — only if you connect an Outlook mailbox.
• Stripe — for payment processing if you subscribe.
• Resend — to deliver the email notifications you opt into.
• MongoDB Atlas / our hosting provider — where your data is stored.

We do not sell, rent, or exchange your data with anyone else.

Data is stored encrypted at rest and transmitted over HTTPS. Mailbox passwords (for IMAP) are encrypted with a key derived from our server secret; OAuth tokens are stored server-side and never exposed to your browser.

Access & export. You can export all of your items at any time as JSON or CSV from Settings → Privacy & Data.

Disconnect a mailbox. Settings → Connected Inboxes → Disconnect. Your tokens/credentials are deleted immediately.

Delete your account. Settings → Delete Account. Your items, documents, and credentials are permanently removed. Billing records are retained only as long as legally required.

Turn off emails. Settings → Notifications.

Analytics and marketing technologies are only loaded after you give permission; with no choice made they stay off. You can change your choice at any time via the Cookie Policy page or the “Cookie settings” link at the bottom of every public page and in Settings. The Cookie Policy lists, per category and provider, which cookies and similar technologies we use.

Active accounts: your data is kept while your account is active. Deleted items go to Trash for 30 days before permanent deletion. When you delete your account, we permanently remove your data within 30 days.

Vaultiq is not intended for children under 16. We do not knowingly collect data from children.

If we make material changes we will email active users and update the "Last updated" date at the top of this page before the changes take effect.

Questions about privacy or your data? Email support@appvaultiq.com.