Privacy

1. Who We Are

Vault Engine ("we", "us") runs vaultengine.one and the Engine dashboard. We are the data controller for the personal data described here. For anything on this page — a question, a copy of your data, or a deletion request — write to effatacore@protonmail.com.

2. What We Collect

We collect the minimum the product needs to work. There is no advertising network, no data broker, and no profile built about you beyond your own account.

• Account data. Your email address and a hashed password (scrypt — we never store or see the password itself). Created when you register.
• Session data. A session token issued at login, stored in your browser and checked on later requests.
• Product data. What you enter into the journal — trades, notes, tags, review text — plus your scan counts, plan, and daily limits.
• Billing data. Your subscription status, plan, and renewal state. Payments run through Stripe: card numbers never reach our servers and we never see them.
• Referral data. An affiliate or beta code, if you arrived with one, so the partner who referred you is credited and an invite is not reused.
• Technical data. Server logs kept by our host (IP address, user agent, requested path, timestamp), and privacy-friendly page analytics described in section 5.

We do not ask for and do not want your brokerage credentials, your bank details, or any government ID. Do not put them in the journal.

3. Why We Use It, and On What Basis

• To run your account and the product — logging you in, saving your journal, enforcing plan limits. Basis: performance of our contract with you.
• To take payment and manage subscriptions. Basis: performance of our contract, and legal obligation for tax records.
• To send service email — password resets, and a welcome message when you register. Basis: contract. These are not marketing and cannot be turned off while your account exists.
• To keep the service up and abuse down — rate limits, failed-login counters, error logs. Basis: our legitimate interest in a working, un-abused service.
• To understand roughly how the site is used. Basis: your consent, given through the cookie banner. Withdraw it any time — see section 5.

4. Who Processes It

We do not sell your data and we do not share it for anyone else's marketing. It reaches these processors only because the product runs on them:

• Vercel — hosting, request logs, and the analytics described below.
• Upstash — the Redis database holding accounts, sessions, subscriptions and journal entries.
• Stripe — payment processing and subscription billing. Stripe is the controller of your payment details, under its own privacy policy.
• Resend — delivery of password reset and welcome email.
• Google (Gemini) — the model that writes the daily scan. It is sent market data only: prices, positioning reports, and public headlines. Your email, your journal, and anything else identifying you are never sent to it.

These providers are based in, or store data in, the United States, so your data is transferred outside the EEA and the UK. Each of them offers Standard Contractual Clauses or an equivalent transfer mechanism, which is the basis we rely on. We may also disclose data where the law requires it, or to protect the service against fraud or abuse.

5. Cookies and Local Storage

We do not use advertising or tracking cookies. Two categories exist:

• Strictly necessary. Your browser's local storage holds your session token, your email if you ticked "remember my email", your plan, a referral code you arrived with, and your cookie choice itself. Without these you cannot stay logged in, so they are set without asking and cannot be switched off.
• Analytics, optional. Vercel Web Analytics and Speed Insights count page views and measure load speed. They set no cookies and build no cross-site profile. They only load if you accept them in the banner, and choosing "essential only" keeps them off.

You can change your mind at any time: reopen cookie settings. Clearing your browser storage also resets the choice, and clearing it while signed in signs you out.

6. How Long We Keep It

Account and journal data live for as long as your account does. Session tokens expire on their own, and password reset links expire one hour after they are issued and work exactly once. Cancelling a subscription does not delete your account — it drops you to the free plan and your journal stays readable. When you ask us to delete the account, we remove it and its journal from our database, and the referral, invite and payment records we are required to keep for accounting are retained for as long as tax law requires (typically up to six years). Backups and provider logs age out on their own schedule, usually within 30 days.

7. Your Rights

If you are in the EEA or the UK you have the right to access your data, correct it, delete it, restrict or object to how we use it, take it elsewhere in a portable form, and withdraw a consent you have given. Similar rights apply in other places, including California. Email effatacore@protonmail.com from the address on the account and we will answer within 30 days. There is no charge. If you think we have handled your data badly, you can also complain to your national data protection authority.

8. Security

Passwords are hashed with scrypt and never stored in readable form. Traffic runs over HTTPS. Sessions are token-based, repeated failed logins are rate limited, and setting a new password invalidates every existing session on the account. No system is perfect: keep your password to yourself, do not reuse it elsewhere, and tell us if you think your account has been reached by someone else.

9. Children

Vault Engine is not for anyone under 18. We do not knowingly collect data from children, and we delete any account we find that belongs to one.

10. Changes

We may update this policy as the product changes. The date at the top moves when it does, and a material change is announced in the product or by email before it takes effect. The commercial side of the relationship is covered separately in the terms.