How we handle your data

VaultFlow requires every user to sign in before reading or writing any vault data. Sign-in is handled by our managed auth provider with email/password and Google sign-in.

Each user can only access their own items, modules, courses, collections, and uploads. Row-level access rules in the database enforce this on every read and write.

We store the content you choose to upload or paste into your vault (files, extracted text, AI-generated summaries, tags, prompts, courses), the metadata needed to organize it, and a basic account profile (display name, email used for sign-in).

Original uploads are kept in private storage so failed processing can be retried. Image previews use access-controlled signed links. Files are not publicly listable.

VaultFlow is built on the Lovable platform and runs on Lovable Cloud. Privileged operations execute server-side; secrets such as API keys are not shipped to the browser.

We rely on the underlying platform for transport encryption (HTTPS) and at-rest encryption of the managed database and storage. This statement describes platform capabilities we use; it is not a compliance certification.

When you upload a file, generate a prompt, or build a course, the relevant content is sent to AI models through the Lovable AI Gateway (currently routing to Google Gemini models) to produce extractions, summaries, and lesson content.

We do not sell your data and do not use it to train models on your behalf. Review the gateway and model providers' own terms for their handling of inference requests.

We use only the cookies and local storage required to keep you signed in and to remember UI preferences (e.g. theme). We do not run third-party advertising trackers.

We record limited first-party product events for activation and reliability, such as whether an upload, AI generation, course build, search, or copy succeeded. These records contain event names, timestamps, coarse error categories, and optional durations—not vault content, prompts, or filenames.

Items, modules, courses, usage history, and successful original uploads remain until you delete them. Failed originals remain only while their retryable upload entry exists. You can download a portable JSON archive or permanently delete your account and stored data from Settings.

For privacy questions, data access, correction, or deletion requests, reach out to the project owner through the contact channel listed on the landing page or your account profile. We aim to respond within a reasonable timeframe.

If you believe you have found a security issue in VaultFlow, please report it privately to the project owner instead of disclosing it publicly. Include steps to reproduce and any relevant context so we can investigate and remediate quickly.

Security is a shared responsibility. The Lovable platform provides the underlying hosting, database, auth, and storage capabilities. The VaultFlow team configures and operates the app (access rules, integrations, AI usage). You are responsible for safeguarding your sign-in credentials and for the content you choose to upload to your vault.