Vaulted
Privacy Policy
Vaulted is built by lifters, for lifters. We respect your privacy and only collect what's needed to make the app work and make it better. This policy explains what we store, how we use it, and what you control.
What We Collect
- Workout data you log: exercises, sets, reps, weights, duration, notes, and timestamps
- Account information: email address and authentication credentials, including sign-in through Apple or Google if you choose those options
- Body measurements: weight, body composition, and custom measurement data you choose to track
- Exercise searches: searches that return no results are saved with your account so we can add missing exercises to the library
- App usage: anonymous usage events (for example, workout started, workout completed, exercise searched, including the search text) collected through PostHog. These events are not linked to your name, email, or account.
- Device information: iOS version and device type (for compatibility purposes only)
What We Don't Collect
- We don't sell your data. Ever.
- We don't track you across other apps or websites
- We don't use advertising networks or advertising SDKs
- We don't access your contacts, photos, location, or Apple Health data
- We don't use cookies or behavioral tracking for advertising
- We don't build profiles for marketing purposes
Children's Privacy
Vaulted is not intended for users under 13 years old. We do not knowingly collect personal information from children under 13. If we learn that we have collected personal information from a child under 13, we will promptly delete such information and terminate the child's account.
Parents or guardians who believe their child has provided information to Vaulted should contact us immediately at [email protected].
Your Data, Your Vault
Everything you log is yours to own and control.
Data Access & Export: You can request a complete copy of your training history at any time by emailing [email protected]. We will send it in CSV format.
Data Deletion: You can delete your account at any time from the Profile screen in the app. Deleting your account permanently removes all associated data from our servers within 30 days. To delete specific data without deleting your account, email [email protected].
Data Portability: You have the right to receive your data in a portable, machine-readable format.
How We Store Your Data
- Encryption in transit: All data sent between your device and our servers uses HTTPS encryption
- Encryption at rest: Workout and personal data are encrypted on our servers
- Server location: Data is stored in the United States
- Host provider: Supabase (PostgreSQL database hosting)
Third-Party Services
We only share data with trusted partners necessary to operate the app:
Supabase (Data Hosting & Authentication)
- Stores your encrypted workout and profile data and manages sign-in
- Privacy Policy: https://supabase.com/privacy
PostHog (Product Analytics)
- Receives anonymous usage events that are not linked to your account, used to understand how the app is used and improve it
- Privacy Policy: https://posthog.com/privacy
Apple (App Distribution & Sign in with Apple)
- Distributes the app and provides Sign in with Apple if you choose it
- May share anonymized crash reports with us if you have opted in on your device
- Privacy Policy: https://www.apple.com/privacy/
Google (Sign in with Google)
- Provides Sign in with Google if you choose it
- Privacy Policy: https://policies.google.com/privacy
Broad Street Solutions LLC (Service Provider)
- Operates the Vaulted service and customer support
- Acts as data processor under our direction
No advertising networks, analytics resellers, data brokers, or other third parties access your data.
Your Rights
You have the right to:
- Access: Request a copy of all personal data we hold about you
- Correction: Request correction of inaccurate data
- Deletion: Request deletion of your data (subject to legal retention requirements)
- Portability: Receive your data in a portable, standard format
- Withdraw Consent: Revoke permission for data use at any time
To exercise any of these rights, email [email protected] with your request. We will respond within 30 days.
Data Retention
- Active accounts: Workout and profile data persists until you delete your account
- Deleted accounts: All personal data is permanently removed within 30 days
- Usage analytics: Anonymous usage events are retained only as long as needed to improve the app
- Crash reports: Anonymized crash data is retained for 90 days for troubleshooting
- Legal hold: We may retain data longer if required by law
CCPA & GDPR
California Residents (CCPA): You have specific rights under the California Consumer Privacy Act, including the right to know, delete, and opt-out of sales of personal information. We do not sell personal information. Contact us to exercise these rights.
European Residents (GDPR): If you're in the EU, your data is processed under GDPR principles. Your rights include access, rectification, erasure, restriction, and portability. Contact us to exercise these rights.
Security
We implement industry-standard security measures to protect your data:
- HTTPS encryption for all data in transit
- Encrypted storage at rest
- Regular security updates
- Limited access to user data (only for customer support when necessary)
- Secure authentication (email and password, Sign in with Apple, or Sign in with Google)
While we strive to protect your data, no system is 100% secure. If you believe your account has been compromised, contact us immediately.
Policy Updates
We may update this Privacy Policy from time to time. We will notify you of material changes by:
- Updating the "Last Updated" date at the top of this policy
- Sending an in-app notification or email if the changes significantly affect your privacy rights
Continued use of the app after changes constitutes your acceptance of the updated policy.
Contact Us
Questions, concerns, or requests about this Privacy Policy?
Email: [email protected]
Mailing Address:
Broad Street Solutions LLC
Jenkintown, Pennsylvania
United States
We aim to resolve privacy questions within 30 days.