V

Vaultly

Privacy Policy

How Vaultly collects, uses, stores and protects your information.

Effective: 3 August 2026  ·  Last updated: 3 August 2026

1. Who we are

Vaultly is a mobile application that stores your receipts, warranties and subscriptions and reminds you before something expires or renews. This policy describes the app as it actually works.

Vaultly is operated by Adi Mousa Alfaifi, an individual developer, of Building No. 3769, Mohammed Bin Dinar Street, Additional No. 7030, Tabuk 47914, Saudi Arabia (“Vaultly”, “we”, “us”). For the purposes of applicable data protection law, we are the controller of the personal data described below.

2. Information we collect

2.1 Account information

When you create an account we collect and store:

• Email address — used to identify your account, sign you in, and send account emails such as confirmation and email-change verification.
• Password — if you register with email and password. Passwords are hashed by our authentication provider; we never see or store your password in readable form.
• Google account identifier and email — if you choose “Continue with Google”. We receive your email address and a unique identifier. We do not receive your Google password.
• Display name — optional, only if you set one.
• Language, currency and reminder preferences.

2.2 Content you add to your vault

This is the information the app exists to hold. It is created by you, and belongs to you:

• Receipts and invoices — merchant name, total amount, currency, purchase date, category, item name, notes, and the number of line items.
• Warranties — expiry date, duration, and which reminders you want.
• Subscriptions — service name, amount, billing period, next renewal date, and whether it renews automatically.
• Receipt images — the photographs you take or select.

2.3 Purchase information

If you subscribe to Vaultly Premium, the purchase is processed by Google Play. We never receive or store your card or payment details. We receive from our subscription provider only your subscription status and its expiry date, so the app knows whether Premium is active.

2.4 Technical information

• Authentication tokens — stored on your device so you stay signed in.
• Push notification token — stored only if notifications are enabled, so reminders can reach your device.

Reminders about expiring warranties and upcoming renewals are scheduled locally on your device. Their content is not sent to our servers.

3. What we do not collect

Camera and photo-library permissions are used only at the moment you scan or attach a receipt. Vaultly does not access your camera or photos in the background.

4. How we use your information

We do not use your information for advertising, profiling or automated decisions with legal effects.

5. Receipt scanning and AI processing

When you scan a receipt, the image is sent over an encrypted connection to our server, which forwards it to OpenAI for text extraction. The extracted text is then analysed to identify the merchant, total, date, warranty term and similar fields, and those suggested values are shown to you for review before anything is saved.

• The AI provider is used only to read the image you submitted.
• The image is transmitted for processing; we do not store a copy of it on our AI processing servers. Your receipt image is stored only in your private storage area (see section 7).
• Handling and retention by OpenAI are governed by OpenAI’s API terms and privacy policy. Under those terms, data submitted through the API is not used to train OpenAI’s models. See openai.com/policies/privacy-policy.
• The scan is a suggestion, not a decision. Every extracted field is editable, and nothing is saved without your confirmation.

If you prefer not to use AI extraction, you can add every record manually and never scan a receipt.

6. Service providers we share data with

We do not sell your personal data and we do not share it with advertisers or data brokers. We use the following providers strictly to run the service:

We may also disclose information where we are legally required to do so, or where necessary to establish, exercise or defend legal claims.

7. How your data is stored and secured

• Encrypted in transit. All communication between the app and our servers uses HTTPS/TLS.
• Encrypted at rest. Our database and file storage encrypt stored data at rest.
• Row-level isolation. Every record carries the identifier of the account that created it, and database security policies allow a signed-in user to read and write only their own rows. This is enforced by the database itself, not merely by the app.
• Private image storage. Receipt images are kept in a private bucket, in a folder named after your account identifier. The bucket is not publicly readable. Access policies restrict every read, write and delete to your own folder.
• Short-lived access links. When the app displays one of your receipt images, it requests a signed link that expires after a short period. There are no permanent public URLs to your images.
• Secure sign-in. Authentication uses the PKCE flow, and session tokens are held in your device’s protected storage.
• Secrets stay server-side. Keys for AI processing are held only on our server and are never included in the app.

8. Your ownership of your data

9. How long we keep data

• While your account exists — your vault content is kept so it is there when you open the app.
• When you delete an item — the record is removed from our database.
• When you delete your account — your data is deleted as described in section 11.
• Backups — residual copies may persist in encrypted backups for a limited period before being overwritten.

10. Your rights

Depending on where you live, you may have the right to:

• Access the personal data we hold about you
• Correct inaccurate data — most fields are editable directly in the app
• Delete your data — available in the app at any time
• Object to or restrict certain processing
• Data portability — receive a copy of your data
• Withdraw consent, where processing is based on consent
• Complain to your local data protection authority

You can exercise most of these directly in the app. For anything else — including a copy of your data — email us at appsupport49@gmail.com from the address registered to your account. We respond within 30 days.

11. Deleting your account and data

You can delete your account and all associated data at any time:

In the app: Profile → Support → Delete account.

Step-by-step instructions are on the Delete Your Account page.

Deleting your account permanently removes:

• All receipt images stored for your account
• All vault items, and the warranties and subscriptions attached to them
• Your profile, preferences and any earned bonus slots
• Your login credentials and authentication record

This action cannot be undone. Deletion is immediate and permanent, aside from residual copies in encrypted backups which are overwritten in the ordinary course.

If you cannot access the app, email appsupport49@gmail.com from your registered address and we will delete the account for you.

Note: cancelling a paid subscription is handled through Google Play, not through us. Deleting your Vaultly account does not automatically cancel a Play subscription.

12. Children

Vaultly is not directed to children and is not intended for use by anyone under the age of 13. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, contact us and we will delete it.

13. International data transfers

Our infrastructure and service providers may process and store data in countries other than your own, including in the United States and the European Union. Where personal data is transferred internationally, we rely on appropriate safeguards, such as the European Commission’s Standard Contractual Clauses or an equivalent mechanism recognised under applicable law.

14. Changes to this policy

We may update this policy as the app changes. The “Last updated” date at the top will always reflect the current version. For material changes that reduce your rights or expand our use of your data, we will give notice in the app before the change takes effect.

15. Contact us