Privacy Policy

Introduction

Welcome to Vaultist. We value your privacy and are committed to protecting your personal data. This Privacy Policy explains how we collect, use, and disclose information about you when you use our service.

Information We Collect

We collect information you provide directly to us when you communicate with us. This information may include your name, email address, and other contact information.

We also collect information automatically when you use our service. This may include your IP address, browser type, operating system, referral URLs, and other technical information.

How We Use Your Information

We use the information we collect to:

• Provide, maintain, and improve our services
• Send transactional emails required to operate your account, specifically password reset emails. These are sent only to users who registered with an email address (not Apple ID users) and only when explicitly requested.
• Communicate with you, including sending you security alerts and support messages
• Monitor and analyze trends, usage, and activities in connection with our services
• Personalize and improve the services, including providing content and features that match your interests
• Ensure the security of our services and prevent fraudulent activities

No-Logs Policy

Vaultist operates a strict no-logs policy. We do not log, track, or store your browsing activity, connection timestamps, IP addresses, or any data transmitted through our VPN service.

App Performance Metrics (MetricKit)

The Vaultist iOS app uses Apple's MetricKit framework to receive aggregated performance and diagnostic reports delivered by the operating system. These payloads may include app hang rates, launch times, memory usage, and crash diagnostics as provided by iOS.

Before any MetricKit payload leaves your device, it is passed through a redaction filter that removes fields whose names contain identifiers such as IP address, email, user account, DNS, hostname, URL, device ID, and IDFA. Anonymized call-stack symbol addresses are retained to assist with crash diagnosis. Redacted payloads are transmitted to our backend over an authenticated, encrypted connection.

MetricKit data collection cannot be disabled independently because it is managed by iOS and delivered on a per-device basis. The redaction step ensures that no personally identifiable information is included before transmission.

Optional Analytics

During onboarding, you are given the option to enable or disable analytics. This preference is respected throughout your use of the app. When analytics are enabled, we may collect aggregate usage signals to understand how features are used and to improve the service. We do not collect analytics that identify you individually or reveal the content of your network activity.

Connection Diagnostics

The Vaultist VPN tunnel records limited connection diagnostics to help diagnose failures and improve reliability. This data is stored locally on your device and includes:

• Server identifier and transport protocol used (e.g., WireGuard)
• Network interface type at time of connection (WiFi or cellular)
• Whether the connection attempt succeeded or failed, and a failure category if applicable (e.g., timeout, UDP blocked, authentication failure)
• Handshake duration in milliseconds
• Aggregated bytes transferred (total in and out, no per-destination breakdown)

Connection diagnostics explicitly do not include destination IP addresses, DNS queries, hostnames, or any record of the sites or services you access. Only the two most recent successes and two most recent failures are retained at any time.

Device Trial Verification (Apple DeviceCheck)

When you create a new account, Vaultist uses Apple's DeviceCheck framework to determine whether your device has previously received a free trial. This verification is performed server-side: your device generates an opaque, short-lived token, which our server presents to Apple's DeviceCheck API. Apple's servers return only whether a flag is set for that device. We never receive or store any device identifier.

The flag is stored by Apple, not by Vaultist. Vaultist records only whether your account's trial was granted, denied, or pending — not any device identifier. This processing is carried out to maintain service integrity and prevent misuse of the free trial (legitimate interest, GDPR Article 6(1)(f)).

Apple's handling of the DeviceCheck token is governed by Apple's Privacy Policy. DeviceCheck is only active on physical Apple devices running iOS 11 or later; it is not used on simulators.

Data Security

We take reasonable measures to protect your personal information from loss, theft, misuse, and unauthorized access, disclosure, alteration, and destruction. However, please be aware that no security measures are perfect or impenetrable.

EU and UK GDPR Rights

If you are located in the European Economic Area (EEA) or the United Kingdom, the General Data Protection Regulation (GDPR) and UK GDPR apply to our processing of your personal data. This section supplements the rest of this policy.

Controller

Protaski LLC is the data controller for personal data processed through the Vaultist service. For privacy enquiries, contact [email protected].

Legal Basis for Processing

• Account data (email address): Processing is necessary to perform the contract of service with you (GDPR Article 6(1)(b)). This includes sending transactional emails (e.g., password reset) via AWS Simple Email Service (SES) to users who registered with an email address. Apple ID users are not affected.
• MetricKit performance and crash data: Legitimate interest in maintaining a stable and secure service (GDPR Article 6(1)(f)). The redaction filter ensures no personal identifiers are transmitted.
• Optional analytics: Your freely given, specific, and unambiguous consent (GDPR Article 6(1)(a)). Analytics are disabled by default; you must actively opt in during onboarding. You may withdraw consent at any time in app settings without any detriment.
• Connection diagnostics: Legitimate interest in diagnosing and improving service reliability (GDPR Article 6(1)(f)). Diagnostics are stored locally on your device only; destination IPs, DNS queries, and hostnames are never recorded.
• Device trial verification (DeviceCheck): Legitimate interest in maintaining service integrity and preventing misuse of the free trial (GDPR Article 6(1)(f)). No personal data is received; Apple stores the flag on our behalf.

Retention Periods

• Account data: Retained for the duration of your account and deleted within 30 days of account deletion.
• MetricKit payloads: Retained for up to 90 days to support crash analysis, then deleted.
• Analytics signals: Aggregate and not linked to individuals; retained for up to 12 months.
• Connection diagnostics: Stored locally on your device only; automatically capped at two most recent successes and two most recent failures.

Sub-processors and International Transfers

Your data may be processed on infrastructure hosted in the United States. Transfers from the EEA to the US are made under Standard Contractual Clauses (SCCs) adopted by the European Commission. Transfers from the UK to the US are made under the UK International Data Transfer Agreement (IDTA) issued by the ICO.

Current sub-processors:

• Amazon Web Services (AWS) — United States. Provides cloud infrastructure (compute, database, storage) on which the Vaultist service runs.
• AWS Simple Email Service (SES) — United States. Used to deliver transactional emails (password reset) to users who registered with an email address. Only the recipient email address and email content are transmitted. Apple ID users are not affected.
• Apple Inc. (DeviceCheck API) — United States. Used to verify, per physical device, whether a free trial has already been granted. No personally identifiable information is transmitted; only an opaque device token generated by iOS is sent to Apple's servers. Governed by Apple's Privacy Policy.

A full list of sub-processors is available on request at [email protected].

Your Rights Under GDPR

You have the right to: access, rectification, erasure, portability, restriction of processing, objection, and withdrawal of consent. To exercise any of these rights, email [email protected]. We will respond within 30 days (extendable to 90 days for complex requests, with notice).

Supervisory Authorities

• EU (general): Contact the data protection authority in your EU member state of residence.
• Spain: Agencia Española de Protección de Datos (AEPD): aepd.es
• Germany: Der Bundesbeauftragte für den Datenschutz und die Informationsfreiheit (BfDI): bfdi.bund.de
• Netherlands: Autoriteit Persoonsgegevens (AP): autoriteitpersoonsgegevens.nl
• United Kingdom: Information Commissioner's Office (ICO): ico.org.uk

Breach Notification

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the relevant supervisory authority within 72 hours of becoming aware of it, and will notify affected individuals without undue delay where the breach is likely to result in a high risk.

Changes to This Policy

We may update this Privacy Policy from time to time. If we make changes, we will notify you by revising the date at the top of the policy.

Canada: PIPEDA and Quebec Law 25

If you are located in Canada, the Personal Information Protection and Electronic Documents Act (PIPEDA) and, for Quebec residents, Quebec's Act respecting the protection of personal information in the private sector (Law 25) govern how we handle your personal information.

• Accountability: Ronald Gonzalez, Protaski LLC is responsible for personal information under our control. Contact: [email protected].
• Purpose: Your email address is collected to create and authenticate your account. Analytics data is collected only with your explicit consent.
• Consent: You may withdraw consent at any time by contacting us at [email protected].
• Limiting collection: We collect only the information necessary for the identified purposes.
• Retention: Account data is deleted within 30 days of account deletion.
• Cross-border transfers: Your personal information may be processed on servers in the United States (AWS infrastructure and AWS SES).
• Access and correction: Email [email protected]. We will respond within 30 days.
• Supervisory authorities: OPC: priv.gc.ca · Quebec CAI: cai.gouv.qc.ca

Japan: APPI Disclosures

If you are located in Japan, the Act on the Protection of Personal Information (APPI), as revised in 2022, applies to our handling of your personal information.

• Purpose of use: Your email address is collected solely to create and authenticate your Vaultist account and to provide the VPN service.
• Cross-border transfers: Your personal information is processed on infrastructure in the United States (AWS). If you registered with an email address, your email is also processed by AWS SES in the United States. The US does not have a system of personal information protection found equivalent to Japan's APPI. By creating an account and enabling analytics, you consent to this cross-border transfer.
• Third-party provision: We do not provide your personal information to third parties except where required by law or to sub-processors under contractual data protection obligations.
• Retention: Personal information is deleted within 30 days of account deletion.
• Privacy Compliance Manager: Ronald Gonzalez, Protaski LLC ([email protected]).
• Supervisory authority: Personal Information Protection Commission (PPC): ppc.go.jp

Australia: Australian Privacy Principles

If you are located in Australia, the Privacy Act 1988 and Australian Privacy Principles (APPs) govern how we handle your personal information.

• APP 1 — Transparency: This policy sets out what personal information we collect, why we collect it, and how we use and disclose it.
• APP 3 — Collection: We collect only the personal information necessary to provide the Vaultist service.
• APP 6 — Use and disclosure: Personal information is used only for the primary purpose of collection or directly related secondary purposes.
• APP 8 — Cross-border disclosure: Your personal information is disclosed to overseas recipients (AWS, United States). We have taken reasonable steps, including contractual obligations with AWS, to ensure APPs are not breached.
• APP 11 — Security: We take reasonable steps to protect personal information through encrypted storage and transmission, and access controls.
• Supervisory authority: Office of the Australian Information Commissioner (OAIC): oaic.gov.au

Hong Kong: Personal Data (Privacy) Ordinance

If you are located in Hong Kong, the Personal Data (Privacy) Ordinance (PDPO), Cap. 486 as amended in 2021, applies to our handling of your personal data.

• DPP1 — Purpose and collection: We collect your personal data for the lawful purpose of providing and improving the Vaultist VPN service. We collect only what is necessary.
• DPP2 — Accuracy and retention: Account data is deleted within 30 days of account deletion.
• DPP3 — Use: Personal data is used only for the purpose for which it was collected or a directly related purpose.
• DPP4 — Security: Reasonable steps are taken to protect personal data from unauthorized access, processing, erasure, loss, or use.
• DPP6 — Access and correction: You have the right to request access to and correction of your personal data. We will respond within 40 days. Contact: [email protected].
• Cross-border transfer: Personal data is transferred to infrastructure in the United States (AWS). We take reasonable steps to ensure comparable protection to the PDPO.
• Supervisory authority: Privacy Commissioner for Personal Data (PCPD): pcpd.org.hk

California Privacy Rights (CCPA/CPRA)

If you are a California resident, the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA) give you specific rights regarding your personal information.

Categories of Personal Information Collected

• Identifiers: Email address collected during account registration.
• Device and performance data: Redacted MetricKit payloads (anonymized crash diagnostics and performance metrics; no PII included after redaction).
• Usage data: Aggregate, anonymous analytics signals when you opt in during onboarding.
• Connection diagnostics: Server identifier, transport protocol, interface type, handshake duration, aggregated byte counts, and failure categories stored locally on your device.
• Trial verification signal: Whether a free trial was granted, denied, or is pending. No device identifier is stored by Vaultist; the per-device flag is maintained by Apple via DeviceCheck.

Your Rights

• Right to Know: You may request disclosure of the categories and specific pieces of personal information we have collected about you.
• Right to Delete: You may request deletion of personal information we have collected from you, subject to certain exceptions.
• Right to Correct: You may request correction of inaccurate personal information we maintain about you.
• Right to Opt Out of Sale or Sharing: Vaultist does not sell or share your personal information with third parties for cross-context behavioral advertising.
• Right to Non-Discrimination: We will not discriminate against you for exercising any CCPA/CPRA rights.

Submitting a Request

Email [email protected] with the subject line "California Privacy Request". We will verify your identity before processing your request and respond within 45 days.

You may also use our Your Privacy Choices page to submit a request or review your options.

Shine the Light

Vaultist does not disclose personal information to third parties for direct marketing purposes.

Contact Us

If you have any questions about this Privacy Policy, please contact us at [email protected].