Privacy and your data

This page explains, in plain terms, what data is involved when you use Vaulter and how AI fits in. For the formal details, see the privacy policy linked in the footer.

Your account and projects

Vaulter stores what it needs to run your account and your projects: your account details, the apps you build, their code and data, and your chat history with the agent (so a project's conversation is still there when you come back). Your projects are yours. You can export a project's files, and you can delete a project and its data at any time from its detail page.

AI and your prompts

Building with Vaulter means working with AI models. When you chat with the agent, your messages, any files you attach, and the relevant parts of your app's code are sent to an AI provider so it can do the work you asked for. Vaulter uses established AI providers for this; the formal privacy policy lists the current processors.

Two boundaries worth knowing:

• The agent can see your app's code and structure, but never the values of your secrets.
• Your app's user data is not part of the agent's working context unless you ask it to work with your data.

Your app's end users

If you publish an app with sign-in, your app collects data from its users, and you are responsible for how you handle it. Vaulter gives you strong defaults: per-user privacy enforced in the database, passwordless sign-in, and registration controls.

One property to reflect in your own privacy policy: end users sign in with a single Vaulter-wide identity. Someone who uses two Vaulter-built apps with the same email has one account across them, while each app's data stays strictly separated by membership rules. Tell your users what you collect and why; that part is yours.

Analytics

Visitor analytics on published apps are collected first-party by Vaulter and shown only to you. The preview is never tracked. Free-plan apps do not collect analytics at all.

Deleting your account

Account deletion is self-serve: in account settings, open the Authentication panel and use the Danger Zone. It permanently deletes your account, your projects and their data and files, and takes your published apps down; active subscriptions are canceled first so nothing keeps billing. It cannot be undone, and your email is immediately free to sign up fresh. If the deletion errors partway, running it again is safe; it picks up where it stopped.

If you own a Teams workspace with other members, settle it first: transfer ownership or delete the workspace deliberately, so your team is not surprised by the outcome.

When your app's users exercise their rights

If your app serves people in the EU, UK, or similar jurisdictions, a user may ask you for a copy of their data or its deletion. You are the controller of your app's data; here is how each request maps onto Vaulter:

• "Send me my data." Their rows live in ordinary tables. In Vault → Database → Tables, filter each relevant table to that user and use the CSV download; the filtered export contains exactly their records. For an app with many tables, ask the agent which tables hold per-user data.
• "Delete my data." Delete the account in Vault → Auth → App Users, then remove their rows from your tables (the agent can do it in one request: "delete every row belonging to this user's account across all tables"). Verify with the same filters afterward.
• What Vaulter holds about them: the sign-in identity (their email) and, on paid plans, first-party visitor analytics shown only to you. Deleting their account in App Users removes your app's membership; identity questions beyond that can come to support.

A privacy-policy starter for your app covers the disclosure side.

Your controls

• Export or delete a project from its detail page. Deleting removes the project and its data, and takes the published app down.
• Keep secrets in the Vault, not in code or prompts.
• Choose who can access your app with the access settings, and who can register with the registration rules.

If you have a specific privacy question, reach out through support.