Privacy Policy

Vaulted ("we", "us") is committed to protecting your privacy. This policy explains what data Vaulted accesses and how it is handled.

1. Who We Are

Vaulted is operated by Muse Nexus LLC, a limited liability company registered in Hawaiʻi, United States. For the purposes of the EU/UK General Data Protection Regulation (GDPR), Muse Nexus LLC is the data controller for the limited data described in this policy. Contact: [email protected].

2. Data We Collect

• Location (foreground only): Used solely to verify you are within your configured gym zone so sessions can be unlocked. Location data is processed on-device and is never transmitted to our servers.
• Session & Streak Data: Vault check-in commitments, completed sessions, streak counts, and zone configurations are stored locally on your device using browser/app storage. We do not have access to this data.
• Anonymous Usage Analytics: In production builds where analytics is enabled, we collect a fixed set of named, anonymous product-usage events (see Section 7). These contain no names, email addresses, credentials, or precise location.

3. Data We Do Not Collect

• We do not collect, store, or share your location history.
• We do not sell, rent, trade, or "share" (as defined by the California Consumer Privacy Act) any personal data to or with third parties.
• We do not collect names, email addresses, or account credentials.
• We do not use advertising identifiers, cross-app tracking, autocapture, or session recording.

4. Legal Bases for Processing (EU/UK)

Where the GDPR or UK GDPR applies, we rely on the following legal bases:

• Performance of a contract — on-device processing needed to provide the app's core features (location check, sessions, streaks, purchases).
• Legitimate interests — anonymous, minimal product analytics to understand which features are used and keep the app reliable. You can object at any time by turning analytics off (Section 7).
• Consent — where required, for example the device-level location permission, which you may revoke at any time in your device settings.

5. In-App Purchases

If you purchase Vaulted Pro, the transaction is processed by your device's app store (Apple App Store or Google Play). We use RevenueCat as a purchase management service to verify your subscription status. RevenueCat receives:

• An anonymous user identifier (no personal information).
• Purchase receipts from the app store (to validate entitlements).

RevenueCat does not receive your location, session data, or any other personal information. See RevenueCat's Privacy Policy for details.

6. Subscriptions & Auto-Renewal

• Vaulted Pro subscriptions (monthly or yearly) auto-renew unless cancelled at least 24 hours before the end of the current period.
• Your app store account is charged for renewal within 24 hours before the current period ends, at the price displayed at purchase.
• You can manage or cancel subscriptions in your device's app store settings at any time.
• Lifetime purchases do not renew and grant permanent access.

7. Analytics & Your Opt-Out

Vaulted uses PostHog for product analytics. Analytics runs only in production builds, and only when an analytics key has been configured for that build — otherwise no analytics data is sent at all. When enabled:

• We capture a fixed set of named, anonymous usage events (for example, session_completed or paywall_viewed) to understand which features are used.
• We do not enable autocapture, session recording, page-view tracking, or advertising / cross-app tracking.
• Events contain no names, email addresses, credentials, or precise location.
• Acting as our data processor, PostHog may receive standard technical metadata such as a randomly generated device identifier and the network IP address used to derive an approximate region.
• You can turn analytics off at any time in the app: Settings → Privacy & Data → "Share anonymous usage data". No further events are sent once disabled.

See PostHog's Privacy Policy for details.

8. Permissions

Vaulted requests location access only after showing an in-app explanation. You may deny or revoke this permission at any time through your device settings. The app remains usable without location — you can plan sessions but cannot start zone-locked check-ins.

9. Third-Party Services

No other third-party services receive your data. If you use the map-based gym-zone picker, map tiles and place-search results are provided by Apple Maps (MapKit JS) and subject to Apple's Privacy Policy. We do not send your identity to Apple in this flow.

10. Data Storage, Security & Retention

Your session data, streaks, zones, and location are stored locally on your device and are never transmitted to our servers — we operate no servers that store your personal data. The only information that may leave your device is the anonymous analytics described in Section 7 (if enabled) and the anonymous purchase identifier shared with RevenueCat. Uninstalling the app or clearing app data removes all locally stored information.

Retention: data stored on your device remains there until you delete it (Settings → Privacy & Data → "Delete My Data") or uninstall the app. Anonymous analytics events and the anonymous purchase identifier are retained by our processors only as long as needed for the purposes above, and are deleted on request (Section 11).

11. Your Rights & Data Deletion

Because Vaulted stores your session data only on your device, you have full control:

• Delete all data: Open Settings → Privacy & Data → "Delete My Data" to erase everything instantly.
• Uninstall: Removing the app deletes all local data.
• Revoke permissions: Disable location access in your device settings at any time.
• Turn off analytics: Settings → Privacy & Data → "Share anonymous usage data".

If you are in the EU/EEA or UK, you additionally have the rights of access, rectification, erasure, restriction of processing, data portability, and objection, and the right to withdraw consent at any time without affecting prior processing. You also have the right to lodge a complaint with your local supervisory authority. If you are a California resident, you have equivalent rights to know, delete, and correct, and we do not sell or share personal information.

To exercise any of these rights — including removal of any anonymous analytics or RevenueCat identifier associated with your device — email [email protected] and we will action the request within 30 days.

12. International Data Transfers

Muse Nexus LLC is based in the United States, and our processors (PostHog, RevenueCat) process the limited data described above on servers in the United States. Where data of EU/EEA or UK users is transferred, we and our processors rely on appropriate safeguards such as EU Standard Contractual Clauses and, where applicable, the EU-U.S. Data Privacy Framework. Because the data involved is anonymous or pseudonymous by design, no profile of you is created or transferred.

13. Website Waitlist

If you join the waitlist on getvaulted.fit, we collect the email address you submit, stored with our hosting provider (Cloudflare). It is used solely to send launch and early-access announcements about Vaulted, is never sold or shared, and is deleted on request or once no longer needed. Unsubscribe via the link in any email or by writing to [email protected].

14. Children's Privacy

Vaulted is not directed at children under 13. We do not knowingly collect data from children.

15. Changes to This Policy

We may update this policy from time to time. Changes will be posted on this page with a new effective date. Continued use of the app after changes constitutes acceptance.

Questions? Email [email protected]
Muse Nexus LLC · Hawaiʻi, USA