Privacy Policy

Last updated: 22 September 2026 · Applies to vaultwishlist.com and the Vault app

In short: Vault stores your account email and the wishlist data you create, so the app can work and sync across your devices. We don't run ads, we don't sell your data, and we don't use advertising or cross-site tracking. Your account is private by default: nothing you save is public unless you choose to turn on a public profile or share a list. Payments are handled entirely by Stripe, we never see your card details.

1. Data Controller

The data controller for Vault is:

The Vault team
Website: vaultwishlist.com
Contact: vaultwishlist@gmail.com

For any privacy-related request, email us at the address above with the subject "Privacy".

2. What data we collect and why

Data	Purpose	Legal basis (GDPR)
Email address and password (hashed)	Creating and securing your account, sign-in, account recovery	Art. 6(1)(b), contract performance
Your vault content (saved items, titles, links, images URLs, prices, notes, lists, reminders)	Providing the core service: storing and syncing your wishlists across devices	Art. 6(1)(b), contract performance
Subscription status (Free, Keeper, Collector or Vaulter)	Activating paid features you purchased	Art. 6(1)(b), contract performance
Names entered by guests when reserving a gift on a shared gift list	Showing other guests that a gift is taken, to avoid duplicates	Art. 6(1)(f), legitimate interest of the list participants
Public profile (nickname, optional display name, avatar, bio) — only if you turn on a public profile	Letting other users find and view the profile you chose to make public	Art. 6(1)(a), your consent (you opt in and can turn it off anytime)
Social connections (who you follow, who follows you) and items you mark as public/featured — only if you use social features	Operating the follow system and showing your chosen public items on your profile	Art. 6(1)(a), your consent
Technical logs (IP address, timestamps) processed by our infrastructure providers	Security, abuse prevention, service operation	Art. 6(1)(f), legitimate interest

We do not collect: payment card numbers (handled by Stripe), precise location, contacts, advertising identifiers, or advertising / cross-site behavioural profiles.

3. Passwords

Passwords are never stored or transmitted in plain text. Authentication is operated by Supabase, which stores passwords using the industry-standard bcrypt hashing algorithm. Neither we nor Supabase can read your password.

4. Where your data lives (processors)

We use a small number of service providers ("processors") to run Vault:

Provider	Role	Location / transfers
Supabase (Supabase Inc.)	Database, authentication, backend functions, stores your account and vault data	Project hosted in the EU. Supabase privacy policy
Stripe (Stripe, Inc.)	Payment processing for Vault subscriptions, card data is entered on Stripe's own pages and never touches our servers	EU/US, Stripe participates in the EU-US Data Privacy Framework. Stripe privacy policy
GitHub Pages (GitHub, Inc.)	Hosting of the app's static files	Global CDN, GitHub participates in the EU-US Data Privacy Framework. GitHub privacy statement

When you use "fetch data" on a product link, the request to read that page is made by our backend on your behalf; the target site sees our server's request, not your identity.

5. Cookies and local storage

Vault uses only technical storage that is strictly necessary for the app to function:

localStorage, keeps your app data and preferences (theme, language, plan) on your device so the app works and loads fast;
Supabase auth token, keeps you signed in between visits.

We use no analytics, advertising, or profiling cookies. Because this storage is strictly necessary, it does not require consent under the ePrivacy rules, we show a notice for transparency. If you clear your browser storage, local data is removed (cloud-synced data remains in your account).

Stripe's checkout pages, which open on stripe.com when you subscribe, set their own cookies as an independent controller, see Stripe's policy linked above.

6. How long we keep data

Account and vault data, for as long as your account exists. If you delete your account, data is deleted from the production database within 30 days (backup copies expire within a further 30 days).
Gift list reservations, until the list owner deletes the gift list, or the reservation is cancelled.
Payment records, kept by Stripe according to legal retention duties (tax law requires up to 10 years for invoicing data).

7. Your rights (GDPR Articles 15–22)

You have the right to:

Access, get a copy of the personal data we hold about you;
Rectification, correct inaccurate data;
Erasure, delete your account and data ("right to be forgotten");
Portability, receive your data in a machine-readable format (the app's Export CSV feature covers your vault content instantly);
Restriction and objection, limit or object to processing based on legitimate interest;
Complaint, lodge a complaint with your supervisory authority. In Italy this is the Garante per la Protezione dei Dati Personali.

To exercise any right, email vaultwishlist@gmail.com. We respond within 30 days.

8. Security

All traffic is encrypted in transit (HTTPS/TLS).
Database access is protected by row-level security: each account can only read and write its own data.
Passwords are bcrypt-hashed (see section 3).
Payment data is handled exclusively by Stripe, a PCI-DSS Level 1 certified provider.

9. Social profiles and public content

Your account is private by default. Nothing you save is visible to anyone else unless you actively choose to make it so:

Public profile. You may turn on a public profile with a nickname, an optional display name, an avatar and a short bio. When enabled, that profile and the items you specifically mark as public (or "featured") can be viewed by other Vault users and, where a profile link is shared, by anyone with the link. Items you keep private are never shown. You can hide individual items, make your profile private again, or clear these fields at any time from the app.
Following. If you follow other users, or they follow you, that connection is stored to operate the follow system. On a private profile, follow requests must be approved by you.
Shared and gift lists. When you deliberately share a list, the people you invite (or anyone with the link, for gift lists) can see the items on that list. Gift reservations show the reserver's chosen name to other guests.
Reporting. Users can report a profile or item they consider abusive; reports reach us by email so we can review and, where needed, remove content or suspend an account.

Because public profile fields are shown to others, please don't put anything there you wouldn't want to be public. We recommend using a nickname rather than your full legal name.

10. AI insights (Collector & Vaulter)

The paid Collector and Vaulter plans include optional "AI" features (taste profile, spending statistics, insights). These are computed on your own device from your own vault data — for example your average price, most-used category, or how many items you've bought. They produce a summary shown only to you.

This is not advertising or cross-site behavioural profiling: your vault content is never sold, never shared with advertisers, and is not used to track you across other websites or to build a marketing profile. We do not make automated decisions that produce legal or similarly significant effects about you (GDPR Art. 22).

11. Children

Vault is not directed at children under 16. We do not knowingly collect data from children. If you believe a child has created an account, contact us and we will delete it.

12. Changes to this policy

If we make material changes, we will show a notice in the app before the changes take effect. The "last updated" date at the top always reflects the current version.