Sub VaultPrivacy Policy
Effective date: 13-09-2026 · Provided by:
Sub Vault helps you track subscriptions, store account credentials, and keep important documents such as passports, ID cards, licences and contracts, with reminders before they expire. This policy explains what we collect, why, and what control you have.
What we collect
- Account details — your name and email address. Your password is stored only as a bcrypt hash; we cannot read it.
- Subscriptions you track — service name, link, price, currency, billing cycle, renewal dates and reminder preferences.
- Saved credentials — platform name, link, the email for that account, and the password, which is encrypted with AES-256 before storage.
- People and documents — the names, roles and optional notes of people you add (for example family members or employees); and for each document its type, title, holder name, issuing authority, issue and expiry dates, notes, the document number (encrypted), and the file you upload. Previous versions are kept when you record a renewal, until you delete them.
- Notification token — a device token used only to deliver your reminders.
- Payment records — plan, amount, currency, status and the payment reference from our payment gateway. We never receive or store your card details.
- Verification codes — one-time codes sent by email when you reveal a saved password. They expire after five minutes and are then deleted.
- Basic technical logs — needed to operate and secure the service.
We do not use advertising or third-party analytics trackers, and we do not sell or rent your data to anyone.
Reading your documents
When you upload a document, Sub Vault can read its details automatically to fill in the form for you. This happens entirely on our own servers. Your document images are never sent to any external AI, OCR or cloud service. Suggested details are always shown to you for confirmation before anything is saved.
If you enable fingerprint or face unlock, that check happens on your device. We never receive your biometric data.
Why we use your data
- To provide the service: storing your entries and showing them back to you.
- To send reminders before a subscription renews or a document expires.
- To verify your identity before revealing a saved password.
- To take payment for paid plans and keep the records that accounting rules require.
- To keep accounts secure and to tell you about important changes, including changes to this policy.
How your data is protected
- All traffic between the app and our servers is encrypted with HTTPS/TLS.
- Saved passwords, document numbers and uploaded files are encrypted with AES-256 before they are written to storage.
- Revealing a saved password requires a one-time code sent to the email address on that account.
- Links used to view a stored file expire after five minutes.
- The Documents area can be locked behind your device's fingerprint or face unlock.
No system is perfectly secure, but we take these measures to keep your information safe, and we will notify you of any breach affecting your data as required by law.
Who else is involved
We share the minimum necessary with service providers who act on our behalf:
- A secure third-party payment gateway — to process payments for paid plans. Your card details are entered with the gateway and go directly to them; we never receive or store them.
- Resend — to send verification codes and service emails. Receives your email address.
- Expo and Google Firebase Cloud Messaging — to deliver notifications to your device. They receive a device token and the notification text.
We may also disclose information where the law requires it.
How long we keep it
- Your entries are kept until you delete them or close your account.
- Deleting your account permanently removes your profile, subscriptions, saved credentials, people, documents and every uploaded file, including previous versions.
- Payment records are kept for as long as applicable accounting and tax law requires.
Your rights
You may access, correct, export or delete your data at any time, withdraw consent, or object to how we use it. Most of this is available directly in the app: edit or delete any entry, or use Profile → Delete Account. For anything else, contact us at tech@subvault.space. You also have the right to complain to your data protection authority.
Children
Sub Vault is not intended for children under 16, and we do not knowingly collect their data. If you believe a child has given us information, contact us and we will remove it.
Changes to this policy
If we make a significant change, we will notify you in the app and by email, and the version number and date shown with this policy will change.
Contact
Email: tech@subvault.space