Privacy Policy

Last updated: October 21, 2026 · Effective date: October 21, 2026 · Version 2.9

In short: WolfVault stores the workspace information you enter so you can organize ventures and track money. It does not connect to your bank. You can correct your entries, export your data, or delete your account in Settings. Authentication and billing use third-party providers.

Draft notice: Bracketed items require the operator’s confirmation before this policy is finalized.

1. Who is responsible

WolfVault is operated by Wolf Vault LLC (“we,” “us”). Contact hello@wolfvault.tech about this policy or your information.

2. Information we collect

  • Account information: account and authentication-provider identifiers, email, display name, avatar URL, account dates, plan, and onboarding progress. Our sign-in service handles credentials and sessions; the app does not store your password.
  • Money and customers: income and expense amounts, dates, descriptions, categories, frequency, optional client names and venture links; recurring bills and their schedules; financial targets; and subscription/customer identifiers, billing status, and renewal dates.
  • Venture information: names, problems/descriptions, target customers, solutions and notes; stage and parked status; validation plans, targets and decisions; assumptions, risk and status; evidence dates, types, summaries, sources/links and supporting or contradicting relationships; and weekly visitor, signup, activation, active-user and paying-customer counts.
  • Other workspace information: Roadmap milestones and their progress, dates and display preferences; reflections/journal entries; saved scenario inputs; forecast settings; and document-link names, URLs and dates. Historical records from retired tools, including goals, streaks, ideas or scores, may remain in existing accounts and exports.
  • Technical, security and agreement records: request information, timestamps, account/resource identifiers, IP addresses and browser/user-agent information where recorded for consent, security or audit purposes. Agreement records include policy type, version and a server-recorded timestamp. IP-based country checks are used to enforce the current United States availability restriction.
  • Support information: whatever you choose to send when contacting us.

You are responsible for having the right to enter information about your own customers, interviewees or other people, including client names and evidence. Provide any notices and obtain any permissions required by law. Avoid entering sensitive personal information or payment-card details in free-text fields.

3. Why we use it

We use information to create and secure accounts; save, display and edit your workspace; calculate financial summaries, forecasts, scenarios, validation results and metrics; manage billing; record agreements; provide exports and deletion; answer support requests; prevent abuse; and meet legal obligations. Financial analytics and Wrapped summaries are calculations from workspace data, not visitor-tracking analytics.

The app does not connect to bank accounts or import bank transactions. The inspected application code does not send workspace content to an AI model for processing. Forecasts are estimates based on entered information and assumptions, not financial, tax, legal or investment advice.

4. Where information is stored and protected

Workspace and account records are stored in our application database. Our sign-in service stores authentication and session information. Generated account-export files are stored in file storage. The current Files tool saves external document links and names; it does not provide new document uploads. A linked document stays with its external host, which controls its storage and access permissions. Existing legacy file metadata or stored objects may remain until removed.

The app uses authenticated account-scoped access, server-side authorization, selected endpoint rate limits, origin checks and security headers. Logs are configured to redact authorization and cookie headers. These controls reduce risk but cannot guarantee security. We do not claim a particular encryption standard, certification, backup location or security audit that has not been verified.

[PROCESSOR LOCATIONS AND INTERNATIONAL TRANSFER SAFEGUARDS] must be confirmed, including any legally required safeguards for transfers outside your country.

5. Third-party providers and disclosure

  • Hosting and storage services: application infrastructure and file storage used for exports.
  • Sign-in service: authentication, account identity and sessions, including authentication-related communications handled by its service.
  • Font service: the page shell loads its typeface from an external font service. Its servers receive your font request and associated network/browser information, such as IP address and request headers.
  • Payment service: hosted checkout, subscription management and billing. Card data goes to the payment processor, not to a WolfVault card-storage system. WolfVault stores billing identifiers/status, not raw card numbers or security codes.
  • External document hosts and sharing destinations: when you open a saved link, its host receives your request. If you download or voluntarily share a Wrapped summary or export, recipients’ practices apply. WolfVault does not automatically publish your workspace.
  • Other disclosures: where required by law, to protect rights or safety, to advisers subject to appropriate duties, or in a business transfer subject to applicable law.

No separate app email-delivery, advertising, visitor-analytics or third-party error-monitoring integration was found in the inspected code. Authentication/payment providers may process service and security information under their own terms. Their off-site practices and retention must be checked with those providers.

[CONFIRM NO SALE OR TARGETED-ADVERTISING SHARING]. The current app code has no personal-data sale or targeted-advertising integration. The operator must also confirm its off-app practices before making a broader no-sale/no-sharing promise.

6. Cookies and browser storage

Authentication uses cookies and similar technologies. The app’s sidebar-preference cookie lasts seven days. Browser local storage holds theme preferences, forecast controls and local scenario drafts; legacy onboarding information may also exist there. Session storage holds a temporary policy-version agreement intent during signup, so an authenticated acceptance can be recorded afterward.

No app-added non-essential advertising or visitor-tracking cookies were identified, so no optional-cookie banner is currently provided. Hosted authentication and checkout may use their own fraud-prevention, session and telemetry technologies. Confirm [PROVIDER COOKIE AND TELEMETRY CONFIGURATION] and obtain consent for any non-essential use where required. If we introduce non-essential tracking, we will update these disclosures and request any consent the law requires. Browser settings can remove local data, but blocking necessary storage may prevent sign-in or other tools from working.

7. Retention, exports and deletion

Active workspace information is retained while your account exists unless you delete particular records. Canceling Pro or returning to Free does not itself delete saved data. Export jobs expire seven days after creation and expired files are cleaned up by the export service; individual signed download links are time-limited.

Use Settings → Export my data to request an export and download JSON or CSV when available. Use Settings → Delete my account to request permanent deletion. Export first if you want a copy. Account deletion attempts to cancel active billing, remove your sign-in identity, delete active workspace/consent/export records, and remove stored export or legacy file objects. If a required step fails, the app reports an error; retry or contact us rather than assuming deletion completed.

Limited security/legal audit records can remain, including account identifiers, deletion events, IP address and browser information. Payment providers may retain their own billing records for legal/accounting reasons. Backup and log retention and deletion timing: [BACKUP AND LOG RETENTION PERIODS]. We may also retain information where law requires it or to establish or defend legal claims, limited to that purpose.

Deleting an account cannot erase copies you downloaded, information you shared with others, or documents stored by an external host. Local browser preferences and drafts may remain until you clear that browser’s site data.

8. Access, correction, export and other rights

You can view and edit supported workspace entries in the app and use Settings for export/deletion. Contact hello@wolfvault.tech for requests you cannot complete there. We may verify identity and authority before disclosing or deleting information. We respond within the periods required by applicable law; some requests have lawful exceptions. A privacy-policy acknowledgment is not blanket consent to unrelated processing.

California

If the CCPA/CPRA applies to us and your request, you may have rights to know/access categories and specific personal information, correct inaccuracies, request deletion, obtain portable information, and receive equal treatment for exercising rights. Where applicable, you can opt out of sale/sharing and limit certain uses of sensitive personal information. You may use an authorized agent subject to required verification. The collection, purposes and recipient categories are described above. We do not claim the law applies solely because this section appears here; the operator must assess its legal applicability and confirm sale/sharing practices.

EU and United Kingdom

The Service’s terms limit use to adults in the United States, and the app performs IP-country checks. If the GDPR or UK GDPR nevertheless applies, you may have rights to access, correct, erase, restrict processing, receive portable data, object to certain processing, withdraw consent where it is the legal basis, and complain to your supervisory authority. Withdrawal does not affect earlier lawful processing. Depending on the activity, legal bases may include performing our contract, legal obligations, legitimate interests in operating/security (subject to your rights), or consent where required. Applicable bases, representative details if required, and transfer safeguards must be verified: [EU/UK APPLICABILITY, LEGAL BASES AND REPRESENTATIVE IF REQUIRED].

9. Adults only

You must be at least 18 to use WolfVault. We do not knowingly seek information from children. Contact us if you believe a child has provided information so we can investigate and take appropriate action.

10. Data breaches

If we discover a personal-data breach, we will investigate, take appropriate containment/remediation steps, and notify affected people and authorities when required by applicable law. We do not promise every incident can be prevented or an unverified notification deadline.

11. Changes and contact

We will update the effective/last-updated date and policy version when this policy changes, and provide notices or request fresh acknowledgment where appropriate or required. Material policy changes use the app’s versioned agreement flow. Questions and privacy requests: hello@wolfvault.tech.

Agreement Required