Privacy Policy

This Privacy Policy explains how Unvaulted ("we", "us", "our") collects, uses, and protects information when you use the Unvaulted iOS application and related services (collectively, the "Service"). By using Unvaulted, you agree to the practices described here.

1. Who we are

Unvaulted is operated by Presterstone, LLC ("Unvaulted"). For privacy-related questions, contact us at chris@presterstone.com.

2. Information we collect

We collect only what we need to operate Unvaulted. Categories:

a. Account information

• A randomly generated anonymous account identifier, created before checkout so the Service can store your subscription and app data without requiring sign-up.
• Email address (optional, if you secure the account with email, Apple, or Google and the provider shares it).
• Password (hashed; we never store the plaintext).
• First name and last name (optional, collected during onboarding).
• Preferred US state (optional, used to filter region-locked offers).

b. Authentication identifiers from Apple / Google sign-in

• The provider's stable user identifier.
• Email address (only if you grant the provider permission to share it).
• Display name (only if shared by the provider).

We do not receive your Apple/Google password.

c. Activity within the app

• Bonus offers you save, track, or compare.
• Custom offers you create.
• Notes you add to a tracked bonus.
• Saved-search filter criteria.
• Notification preferences.
• Spend amounts you log against credit-card sign-up bonuses.

d. Subscription and purchase data

• Apple-issued subscription transaction IDs and product identifiers.
• Subscription status and renewal dates.
• A RevenueCat customer identifier associated with your anonymous or linked Unvaulted account.
• We never see or store credit card numbers; all purchases are processed by Apple.

e. Device and technical data

• Apple Push Notification (APNs) token, only if you enable push notifications.
• iOS version, device model, and app version (via Sentry crash reports if you encounter a crash).
• A randomly-generated installation identifier used solely for product analytics. This identifier is reset if you delete and reinstall the app.
• Apple install-attribution data. If you installed Unvaulted from an Apple ad, Apple's AdServices framework gives us a campaign, ad group, keyword, and ad identifier for that install, plus your country or region. We request this once per install to understand which campaigns work. It contains no advertising identifier (IDFA), we do not use it to track you across other companies' apps or websites, and it is not linked to your name or email.

f. Diagnostic data (only when crashes occur)

• Stack trace.
• Breadcrumbs leading up to the crash (recent screen views, network calls).
• These reports are routed to Sentry and contain no personal data unless inadvertently logged. We periodically audit reports to remove inadvertent leakage.

We do not collect:

• Your location.
• Your contacts.
• Your photos, microphone audio, or camera footage.
• Your bank account credentials, account numbers, or balances.
• Tracking identifiers across other apps or websites.

3. How we use information

• Provide the Service. Render bonus listings, save your selections, track your progress.
• Authenticate you. Maintain an anonymous session, link an optional Apple or Google identity, verify it's you when you sign in, and send password-reset emails.
• Notify you. Deliver deadline reminders and new-offer alerts only for the categories you opted into.
• Process subscriptions. Use Apple and RevenueCat to verify in-app purchases, restore purchases, and grant or revoke entitlements.
• Improve the product. Aggregate usage analytics (no individual identification) inform what to build.
• Investigate crashes. Diagnose reproducibility issues from anonymized stack traces.

4. Legal bases (where applicable)

For users in jurisdictions requiring a legal basis (e.g. GDPR for EU residents; we do not market in the EU but list this for completeness):

• Performance of a contract: providing the Service you signed up for.
• Legitimate interests: product improvement, fraud prevention, security.
• Consent: push notifications, optional analytics, marketing emails (where enabled).

You can withdraw consent for notifications and marketing at any time in Settings.

5. How we share information

We share data only with these categories of recipients, and only as necessary:

• Apple Inc. for App Store and StoreKit purchase processing.
• RevenueCat, Inc. receives app account identifiers, App Store transaction and product identifiers, subscription status, purchase dates, and renewal/expiration information to process entitlements and restorations.
• Supabase Inc., our backend infrastructure provider, stores account, activity, and subscription data on encrypted infrastructure.
• Sentry (Functional Software, Inc.) receives crash reports as described above.
• PostHog receives anonymized product analytics events.
• Google LLC only if you choose Google sign-in; we receive only the identifier and email you authorize.
• Law enforcement / legal compliance only when compelled by valid legal process or to protect against imminent harm.

We do not sell your personal information. We do not share for cross-context behavioral advertising.

6. Affiliate links

When you tap "Apply Now" on a bonus, you are sent to the issuing institution's website. The URL may include attribution parameters that allow us to receive a referral commission if you open an account. The institution's privacy policy applies once you leave Unvaulted.

7. Data retention

• Anonymous account data is retained while the anonymous account remains active. Anonymous accounts that are never secured cannot be recovered after sign-out or loss of the stored session.
• Linked account data is retained for the life of your account. You may delete your account at any time in Settings → Account → Delete account; deletion is processed immediately and is permanent, subject to purchase records we must retain for legal, fraud-prevention, or platform-compliance purposes.
• Saved offers, tracked bonuses, custom offers are deleted when your account is deleted.
• Apply logs (records that you tapped a referral link) are retained anonymously for up to 24 months for fraud prevention and reconciliation, then aggregated.
• Crash reports are retained by Sentry for 30 days.
• Analytics events are retained by PostHog for 12 months.
• Subscription transaction records are retained as long as required by Apple's developer agreement and applicable tax law.

8. Your rights

Subject to applicable law, you may have the right to:

• Access the personal data we hold about you (email chris@presterstone.com).
• Correct inaccurate data (much can be edited directly in Settings).
• Delete your account and associated data.
• Export a copy of your data.
• Opt out of analytics, marketing, or notifications.
• Lodge a complaint with a supervisory authority where you reside.

We respond to verifiable requests within 30 days.

9. Children's privacy

Unvaulted is not directed to children under 13 (or under 16 in jurisdictions where that is the threshold). We do not knowingly collect data from children. If you believe a child has provided us data, contact chris@presterstone.com and we will delete it.

10. Security

We protect data with:

• Encryption in transit (TLS 1.2+).
• Encryption at rest in our backend.
• Row-level security in our database, so users only see their own rows.
• Service-role credentials kept server-side; never embedded in the iOS app.
• Two-factor authentication for our team's access to administrative tools.

No system is perfectly secure. If you suspect a breach, contact chris@presterstone.com.

11. International transfers

Our backend is hosted in the United States. If you use Unvaulted from outside the United States, your data is transferred to the US for processing.

12. Notification preferences

You can control which notifications Unvaulted sends:

• Open Settings → Notifications inside the app, or
• Open the iOS Settings app → Notifications → Unvaulted.

We send three categories: deadline reminders, new offer alerts, and a weekly digest. Each can be disabled independently.

13. Subscriptions

• Subscriptions are sold and processed by Apple via In-App Purchase.
• RevenueCat processes subscription entitlement and restoration status on our behalf.
• Pricing, renewal terms, and payment methods are managed in your Apple ID account.
• To cancel, manage, or refund a subscription, use Settings → [Your Apple ID] → Subscriptions in iOS.

14. Changes to this policy

We will post material changes to this policy in the app and on the marketing site. The "Effective" date at the top reflects the most recent revision. If a change materially reduces your privacy rights, we will provide additional notice (in-app prompt or email) before it takes effect.

15. Contact

• General privacy questions: chris@presterstone.com
• Security disclosures: chris@presterstone.com

16. California residents (CCPA/CPRA)

California residents have additional rights under the California Consumer Privacy Act / California Privacy Rights Act. We do not sell personal information. To exercise CCPA rights (access, deletion, correction, limit use of sensitive info), email chris@presterstone.com with the subject line "California Privacy Request" and proof you are the account owner.

We do not knowingly collect or sell data of consumers under 16.

17. EU/UK residents

If GDPR or UK GDPR applies to you, our lawful bases for processing are stated in section 4. You may contact us to exercise your rights or contact your local supervisory authority. We do not have a designated EU representative as we do not target the EU market.