Vault Privacy Policy

Information Vault accesses

When you sign in with your Google Account, Vault requests the following permissions:

• Your name, email address, and profile picture (via Google's userinfo.email and userinfo.profile scopes). This is used solely to identify you within the app and display your account info in the interface.
• Access to a single Google Sheet, which Vault creates inside your own Google Drive the first time you sign in (via Google's drive.file scope). This scope is deliberately narrow: it grants Vault access only to files it creates itself, and nothing else in your Drive - Vault cannot see, list, or modify any other file you own.

How this information is used

Your profile info is used only to personalize the app's display (your name and profile photo in the app) and is never stored anywhere outside your current browser session.

The account details you enter into the app (service names, categories, website addresses, usernames, passwords, two-factor methods and notes) are written to and read from the Google Sheet described above. This is the only place they are stored.

When you copy a username or password, the app places it on your device's clipboard. Anything you paste it into, and any clipboard history your device keeps, is outside the app's control.

Your language choice (English or Hebrew) is saved in your browser's local storage on the device you are using, so the app opens in that language. It is not sent anywhere.

How this information is stored and protected

Vault has no backend server and no database of its own. The app runs entirely as static files in your browser, and every request for your data goes directly from your browser to Google's own servers, authenticated with your own Google sign-in. The developer of Vault never receives, stores, or has access to your account details at any point.

Vault does not add an encryption layer of its own. Everything you enter, including passwords, is saved in the Google Sheet as plain text, readable by anyone who can open that sheet. It is protected by your Google Account's own security, so keep that account secure and do not share the sheet.

Sharing of information

Vault does not share, sell, or transmit your data to any third party, advertiser, or analytics service of any kind.

The one request Vault makes beyond signing in and reading and writing your sheet is for service logos. To show a logo next to an account, the app loads that website's icon from Google's favicon service (www.google.com/s2/favicons). This request contains only the website's domain name (for example, netflix.com): no usernames, passwords, or notes are included. As with any request on the web, the service can see your IP address, and so it can see which domains you keep accounts for.

Data retention and deletion

Because your data lives only in your own Google Drive, you are in full control of it. To delete it, delete the "Vault Data" spreadsheet from your Google Drive. To revoke Vault's access to your account entirely, visit myaccount.google.com/permissions, find Vault in the list, and remove its access.

Changes to this policy

If this policy changes, the "Last updated" date above will be revised accordingly.

Contact

Questions about this policy can be directed to idoscomms@gmail.com.