Vaulted ("we", "us") is committed to protecting your privacy. This policy explains what data Vaulted accesses and how it is handled.
Vaulted is operated by Muse Nexus LLC, a limited liability company registered in Hawaiʻi, United States. For the purposes of the EU/UK General Data Protection Regulation (GDPR), Muse Nexus LLC is the data controller for the limited data described in this policy. Contact: [email protected].
Where the GDPR or UK GDPR applies, we rely on the following legal bases:
If you purchase Vaulted Automatic, Apple processes the transaction. We use RevenueCat to retrieve the localized product and verify entitlement status. RevenueCat may receive:
Vaulted does not intentionally send RevenueCat your location, Screen Time selections, or session history. See RevenueCat's Privacy Policy for its processing details.
Product analytics is off by default. If a production build is configured for PostHog or Sentry, those services still remain off until you explicitly turn on "Share usage & diagnostics" in Privacy & Data. When allowed:
See PostHog's Privacy Policy and Sentry's Privacy Policy.
Vaulted requests When In Use location only after an in-app explanation for manual place checks and Earned Time. Allow Always is requested separately before a manual Beast Vault can open selected apps, so iOS can relock them after a background exit; optional Automatic Place also requires it for entry and exit automation. You may deny or revoke either permission in iPhone Settings. Without Always, foreground manual checks and Earned Time remain available, but manual Beast app access stays closed. Without location, you can still view and edit local data but cannot satisfy a place-based Vault; scheduled Vaults depend on Apple Screen Time rather than location.
| RevenueCat | One-time purchase validation and restoration |
| PostHog | Consented pseudonymous product-usage analytics when configured |
| Apple App Store | Payment processing |
| Sentry | Consented error diagnostics when configured |
| Apple Maps (MapKit JS) | Map display & place search when choosing a gym zone |
| Google Analytics | Consented public-page and bounded CTA events (Section 14) |
| Cloudflare & Resend | Website hosting and the retired early-access list described in Section 13 |
If you use the map-based zone picker, map tiles and place search are provided by Apple Maps (MapKit JS) and subject to Apple's Privacy Policy. Standard network metadata such as IP address is visible to any service your device contacts.
Your Vaults, precise location configuration, Screen Time tokens, sessions, and reward state are stored locally in app storage and Vaulted’s native App Group. Vaulted operates no backend that receives those fields. Purchases, optional diagnostics, the website, and the retired early-access list use the processors described above.
Retention: local data remains until you use Delete My Data or remove the app. Processor records follow the processor’s retention settings and applicable legal requirements. Prior early-access email addresses remain only until the App Store launch purpose ends, you unsubscribe, or you request deletion.
Because Vaulted stores your session data only on your device, you have full control:
If you are in the EU/EEA or UK, you additionally have the rights of access, rectification, erasure, restriction of processing, data portability, and objection, and the right to withdraw consent at any time without affecting prior processing. You also have the right to lodge a complaint with your local supervisory authority. If you are a California resident, you have equivalent rights to know, delete, and correct, and we do not sell or share personal information.
To exercise applicable rights — including a request concerning a pseudonymous analytics or RevenueCat identifier you can provide — email [email protected]. We will respond within the period required by applicable law.
Muse Nexus LLC is based in the United States, and the processors named above may process data in the United States or other countries. Where required, transfers rely on processor-provided safeguards such as Standard Contractual Clauses or an applicable data-transfer framework. Pseudonymous data can still be personal data; we do not describe it as risk-free.
Vaulted stopped accepting new waitlist signups on August 12, 2026. If you joined before that date, Cloudflare may retain the email address you submitted, the source label, a truncated user-agent string, delivery status, and standard request/security logs such as IP address. Resend may have received the address and message content during an attempted confirmation delivery. We do not sell the address or use it for unrelated marketing. Request deletion at any time through [email protected].
On public getvaulted.fit pages, Google Analytics 4 stays unloaded unless you select Allow analytics. If allowed, we send sanitized page views and bounded CTA-click events. Event data may include the public path and title, a referrer reduced to an origin or public path, standard browser/device metadata, and syntactically restricted utm_source, utm_medium, utm_campaign, or utm_content labels.
Raw query strings, fragments, form values, email addresses, click IDs, search terms, GPS, gym data, and in-app activity are not sent. Google advertising storage, advertising user data, ad personalization, and Google Signals remain disabled. Use Analytics settings at any time to change the choice. See Google's Privacy Policy.
Vaulted is not directed at children under 13. We do not knowingly collect data from children.
We may update this policy from time to time. Changes will be posted on this page with a new effective date. Continued use of the app after changes constitutes acceptance.
Questions? Email [email protected]
Muse Nexus LLC · Hawaiʻi, USA