vaultly Privacy Policy
Last updated: August 1, 2026
vaultly (the "App") is a password and subscription management app designed on the principle that "your data stays only on your device."
1. Information We Collect
The App does not require an account and does not collect personal information such as your name or email address. Passwords and subscription information you register are encrypted with AES-256 and stored only on your device; they are never sent to the developer's server. There is no way for the developer or any third party to access or read this information.
2. Communications
The App communicates with the Internet only in the following cases:
| Feature | Data sent | Data not sent |
|---|---|---|
| Password breach check (optional) | Only the first 5 characters of the password hash (Have I Been Pwned API) | Password itself, information identifying you |
| Exchange rate retrieval (subscription summary) | Only exchange rate request (once per day) | Any of your data |
| Ad delivery (automatic) | Only ad request (Google AdMob, non-personalized) | Passwords, registered data, personal information of any kind |
| iCloud sync (optional, enabled only when activated) | Data encrypted with AES-256 (stored only in your iCloud) | Encryption keys, plaintext data (neither Apple nor the developer can decrypt) |
| Usage analytics (optional, enabled only when you consent) | Anonymous usage statistics such as screen views, whether features are used, and the approximate number of stored items in 15-item steps (Firebase Analytics) | Registered passwords and other content, personal information |
Usage analytics is enabled only when you consent at the first launch and can be disabled anytime from settings. All features are available even if you do not consent.
About Ads
The ads displayed in this App are non-personalized ads from Google AdMob. The ads are non-personalized, and we do not perform tracking using advertising identifiers (IDFA / AAID). AdMob may process IP addresses and device information for ad delivery and fraud prevention. For details, see:
- Google Privacy Policy: https://policies.google.com/privacy
- How Google uses ads data: https://policies.google.com/technologies/ads
3. Children's Privacy
The App is not directed at any specific age group and does not knowingly collect personal information from children under 13.
4. Data Storage, Retention, and Deletion
- Registered data is stored only in encrypted storage on your device
- When you delete the App, data on your device is also deleted
- Since the developer does not hold your data, no deletion procedure is needed from the developer
- Usage analytics data (only if you consent) is retained for up to 14 months and then deleted automatically
5. Third-Party Sharing
The App does not provide or sell your data to third parties (because the developer does not hold your data in the first place).
6. Where Data Is Processed and International Transfers
The App does not store your registered data on the developer's servers. Only the following services may involve processing outside your country:
- Ad delivery (Google AdMob) and usage analytics (Firebase Analytics, only with your consent): handled on servers in countries determined by Google (including the U.S.)
- Password leak check (optional): only the first 5 characters of a password hash are sent to Have I Been Pwned (U.S. and other regions)
- iCloud sync (optional): data encrypted on your device is stored in your own iCloud (Apple) account
Transfers rely on safeguards provided by each provider, such as standard contractual clauses.
- Google Privacy Policy: https://policies.google.com/privacy
- Have I Been Pwned Privacy: https://haveibeenpwned.com/Privacy
7. For Residents of the EEA and the UK
Under the GDPR (General Data Protection Regulation), we provide the following information.
Controller
Join Circle LLC
2627-10 Mihocho, Midori-ku, Yokohama, Kanagawa 226-0015, Japan
support@join-circle.net
Legal Bases for Processing
- Usage analytics: consent (only if you consent at first launch; you can withdraw it anytime in Settings)
- Ad delivery (non-personalized): legitimate interest (to offer the App free of charge)
- Password leak check and iCloud sync: consent (only when you enable them)
Your Rights
You have the rights of access, rectification, erasure, restriction of processing, data portability, objection, and withdrawal of consent regarding your personal data. Because the developer does not hold your registered data, most of these rights can be exercised directly in the App (deleting data, withdrawing analytics consent, or deleting the App). For anything else, contact us at the address above.
Complaints to a Supervisory Authority
You have the right to lodge a complaint with the data protection authority in your country or region.
8. For California Residents
Under the California Consumer Privacy Act (CCPA / CPRA), we provide the following information.
The App does not sell personal information. It also does not share personal information for cross-context behavioral advertising (ads are non-personalized only, and we do not track via advertising identifiers).
You have the right to request disclosure or deletion of your information, and the right not to be discriminated against for exercising these rights. Please contact us below.
9. Changes to This Policy
Any changes to this policy will be announced on this page.
10. Contact
For questions about this policy, please contact:
Join Circle LLC
support@join-circle.net