The short version. Vaulteon is a vault that keeps your files encrypted on your own phone. Your files never reach us: not the files, not their names, not thumbnails of them. What we do hold is your email address, a backup key that was encrypted on your phone with your PIN before it reached us together with a check value for that PIN, your licence, your device registrations (including a value that recognises a reinstalled phone), a short record of failed unlock attempts, and the recovery and remote-command settings you choose to switch on, including any second address you give us. Section 2 lists all of it, and it is the list, not this paragraph.
Version 1.0 · Last updated: DATE OF PUBLICATION
This policy explains what Vaulteon Lock collects, why, and what we do not collect. We have tried to write it in plain language rather than legal language.
(The app appears as Vaulteon on your phone. The full product name is Vaulteon Lock. This policy says "Vaulteon" from here on and means the same thing.)
Vaulteon is operated by Tarmeeza Digital Solutions (ترميزة للحلول الرقمية), LEGAL FORM, e.g. "a sole establishment registered in the Sultanate of Oman", registered address FULL ADDRESS.
For anything in this policy, contact [email protected].
Our representative in the European Union, appointed under Article 27 of the GDPR, is EU REPRESENTATIVE NAME AND ADDRESS. EU and EEA residents may contact them directly.
We are the data controller for the information described below.
2.1 Your account
To use Vaulteon you create an account. You sign in with your email address and a six-digit code we send you, or with Google. Signing in with Microsoft is planned but not available yet; the parts of this section about it describe what will apply once it is.
One account, several ways in. If you sign in with Google or Microsoft using the same email address as your account, and they confirm the address is yours, that way in is added to the same account rather than making a new one, and we email your address to say so. A code to your address always works too. You can see and remove the ways in from your account, and changing your account's email address removes Google and Microsoft from it.
We store:
- Your email address. If you sign in with Google or Microsoft (Microsoft once available), they send us a small sign-in token. We keep your email address from it. The token also carries an identifier Google or Microsoft uses for you, which is how a second sign-in is recognised as the same person, and we keep that too. We do not ask for and do not receive your contacts, your files, your calendar or your profile, and we cannot see anything in your Google or Microsoft account.
- An account identifier we generate.
- The date you created the account and the date you last signed in.
We never create or store a password. There is no password to steal, reuse, or leak.
2.2 Your encrypted backup key
Vaulteon creates a key that opens your backups. A copy of that key is stored on our servers.
That copy is encrypted on your phone with your PIN before it is sent to us. We never receive your PIN. What we store is a block of encrypted data.
Wherever this policy says PIN, it means whichever you use to unlock Vaulteon: a PIN, a pattern or a password. When you change it, your phone replaces the copy we hold, so the copy opens with the one your phone last used.
We also store a check value, so we can tell whether a PIN is right without receiving it. Your phone works it out from your PIN and sends it with the encrypted key; we keep only a scrambled form of it. When you ask for your key back, your phone sends the same kind of value from the PIN you typed, we compare the two, and we release the encrypted key only if they match. Unlocking it also needs a separate secret that we keep outside the database, and your phone needs your PIN as well.
This copy is not optional, and we would rather say so than let you find out later. Every Vaulteon account holds one. The reason is the failure we see most: a backup key is a long string of characters, people write it down once and lose it, and a backup nobody can open is the same as no backup at all. Holding an encrypted copy is what lets you get back in with something you actually remember, which is your PIN. If you do not want us to hold it, the way to achieve that is to delete your account (section 7), which removes it.
A second copy, in your own cloud, is optional. You may also keep one in your own Google Drive, OneDrive or Dropbox. That copy is encrypted on your phone with the same PIN before it is uploaded, and you can switch it off at any time. It is not the same as ours: it has no check value and needs no secret of ours, so it is locked with your PIN alone. Neither we nor they receive your PIN. Switching it off does not affect the copy on our servers.
2.3 Your licence
If you buy Pro, we store which licence you own, when it was issued, and which devices are using it.
- Bought through Google Play: your phone sends us the purchase receipt, and we ask Google whether it is genuine. Google's answer tells us that the purchase is real and nothing about who made it. We do not receive the Google account, and we do not ask for it.
- Bought directly from our website: our payment provider (see section 4) tells us that an order completed, and we ask it for the buyer's email address. We use the address to send you your purchase email and to add Pro to the account that uses the same address, and we do not store it. Until an account claims the purchase we keep a scrambled value made from the address (it cannot be turned back into the address without a key held only on our server), and we delete it the moment the purchase is claimed. We keep the order's amounts, currency and date for tax purposes; they do not identify you.
2.4 Your devices
Each phone generates its own key and registers it with us the first time it stores the encrypted copy of your backup key with us, which happens during setup, after you choose how you unlock the app.
We store the public half of that key and a device name you can change.
We also store a value that tells us when a phone is the same phone reinstalled. Uninstalling Vaulteon deletes that phone's key, so without it a reinstalled phone would look like a new one and the old registration would stay on your account. Your phone works this value out from an identifier Android gives Vaulteon on that phone, combined with your account, so the same phone gives a different value in every account and the identifier itself is never sent. We scramble it again before storing it. It changes if the phone is factory reset. When a phone registers with the same value, we retire the registration it replaces, and we delete that old registration's copies of your backup key only once the new one has saved the same key.
This is what allows a phone to prove it is genuinely yours: a change to that phone's copy of your backup key is accepted only when the phone signs it, and a lock or wipe command cannot be forged by anyone else.
2.5 Failed unlock attempts
If someone repeatedly enters the wrong PIN on your phone, Vaulteon records it. A short summary is sent to us so you can see it on the website even if the phone is taken from you:
- the name of the app or screen that was being unlocked
- when it happened
- how many wrong attempts there were
- whether a photo was taken
We never receive the photograph. We cannot request it, and there is no path by which it reaches us. It is stored in your vault like anything else you hide, which means it travels only if you back your vault up, and then only inside the encrypted container, to the place you chose.
If the attempt was on an app you had locked, that app's name is part of the summary. We do not receive your list of locked apps, and we never ask your phone for it. But an entry saying an app was attacked has to name the app, or it tells you nothing you can act on, so this is the one place the name of something you locked reaches us. It reaches us only for apps someone actually failed to unlock.
2.6 Remote lock and remote wipe
If you set up remote lock or remote wipe, we hold what is needed to carry them out:
- Whether each of your devices is currently flagged to lock. This is a yes or no per device, and your phone checks in periodically to read it.
- A scrambled form of your six-digit wipe key. Remote wipe is protected by a second code that only you know. We store a one-way scramble of it rather than the code itself, so the code is not in our database. Six digits is a short secret, and a short secret is not made long by scrambling it: what protects a wipe is that it also needs your account, a signed command, and a device that accepts it. Please do not treat the wipe key as the only thing standing between someone and your files.
A wipe command is signed by us so your phone can tell a real one from a forged one. Our service requires the account to be signed in before it will accept either command, and both are recorded (see 2.8).
2.7 Two-step sign-in, if you turn it on
You may add an authenticator app to your account. If you do, we store the shared secret that makes the six-digit codes work. It protects your account only. It is not related to your PIN and cannot open your vault or your backups.
2.8 Emergency recovery
If you use our emergency reset process, we record that it was requested, when, and whether it completed. If you have given us an emergency email address or a trusted contact's address, we use those to notify that a reset was requested.
About the trusted contact, who is not you. If you give us someone else's email address, we hold that address so we can warn them if a reset is requested on your account. We will email them only for that reason, and never for anything else. They did not ask us to hold their address and cannot have agreed to it, so when we write to them the message says who we are, why they are receiving it, and how to have their address removed. They can ask us to remove it at any time, by writing to [email protected], and so can you, from the app or the website.
2.9 Technical records and diagnostics
Server logs. Our servers keep short-lived logs containing IP addresses, times, and which page or interface was requested. This covers both the website and the times your phone contacts us. We use them to keep the service working and to detect abuse.
A delivery address for messages to your phone. So that remote lock and remote wipe can reach a device, each installation registers a delivery token with Google's messaging service, or with Huawei's on Huawei phones. We store that token against the device. It identifies the installation, not you, and it changes if you reinstall.
A name for each device, which you can change. It is whatever you typed, so if you put your own name in it, we have that.
Crash reports. When Vaulteon fails, it can send us a report saying where in the code it happened, on what model of phone and what version of Android. It never contains anything from your vault, and we strip anything that looks like a filename, a path or a secret before it leaves your phone. You can turn crash reporting off in Settings.
2.10 What you write to us
Support messages. When you ask us something through the support page or from your account, we keep what you typed, the topic you picked, and the replies that follow. It is free text, so what is in it is whatever you decided to tell us, and we hold it as you wrote it.
If you ask to be emailed when support replies, we send a short email to your account address saying there is a new reply. It does not contain the reply, which you read in your account. This is off unless you tick it.
A picture you attach (from 24 September 2026, one per message, from the app). We keep it with the message you attached it to, and support can see it.
Two things happen to it before it is stored, and both are worth knowing because they are not what most apps do. Your phone rebuilds the picture as a smaller image before it leaves the device, which removes everything hidden in the file: where the photograph was taken, when, and which camera or phone took it. Our server removes those details again when it arrives, so this holds even if the picture came from something other than our app. We keep the picture itself, not those details.
We never ask you for a picture, and you never have to send one. If you do, send only what you want us to see: a picture of a screen in Vaulteon shows us what was on that screen. It is deleted with the conversation, and with your account, like everything else in 2.10.
If you write to us without signing in, from the support page, we also keep the email address you give us. We email it a link first, and your message reaches support only if that link is opened; a message nobody confirms is deleted after 24 hours. After that, each reply from us is emailed to that address with a link to the conversation. The email does not contain the reply, and anyone holding the link can read the conversation, so do not forward it. A link stops working after 30 days, and each reply sends a new one. If an account uses the same address, we can see that, but the conversation is not added to that account. Deleting your account also deletes the conversations written from its address without signing in.
What travels with it. If you are signed in, the message carries your licence status, how many devices are on your account, which device you were using, its Android version and your app version. That is there so we do not have to ask you three questions before anyone can help.
You cannot attach anything, and that is deliberate. A screenshot of a vault screen is vault content, and a screenshot of an error usually carries filenames. Neither belongs on our server, so there is nowhere to put them.
We mark a conversation that contains strong language, so whoever opens it knows what they are reading. Your message is not changed, hidden or delayed by that mark, and it is never a reason we will not help you.
Invisible characters are removed from what you write (the ones that make text display differently from what it says). Everything a person can read is kept exactly as you wrote it.
The box checks for secrets before it sends. If what you type looks like your PIN, your recovery code or your backup key, the form stops and tells you rather than sending it. It matches on shape, so it will not catch everything a secret can look like. Please do not send us any of the three: support never needs them and will never ask. If one reaches us anyway, we delete it and tell you that we did.
If you email us instead, at support@, billing@, privacy@ or policy@, your email becomes a support conversation like one started on the support page. We keep the address you sent it from, the subject and the text. We do not keep attachments. If the text looks like a PIN, a recovery code or a backup key, we keep none of it, and we ask you to write again without it. Our email provider receives the message first, and holds its own copy for a limited time under its own terms. We do not reply automatically: when we answer, the email carries a link to the conversation, as it does for a message from the support page.
2.11 What we never collect
This list is about what Vaulteon sends. It is not a claim about what you might choose to type or post to us yourself: if you write your PIN in a support message or email us a screenshot, we have it, because you sent it. The last two entries say where that line falls.
-
Your files. No photos, no videos, no documents.
-
Their names. Not filenames, not folder names.
-
Thumbnails or previews. Not of anything.
-
How much you have stored, what type it is, or when you added it.
-
Photographs of anyone who tried to unlock your phone.
-
Your location.
-
Your contacts.
-
Your list of locked apps. We never receive it and never ask for it. The single exception is described in 2.5: where someone repeatedly failed to unlock a particular app, that app's name is part of the break-in summary.
-
Anything attached to a support message written in the app or on the website.NO LONGER TRUE, changed 24 September 2026: you can now attach one picture to a support message from the app. What we do with it is in 2.10, including the fact that we remove the hidden details, such as where a photograph was taken, before it is stored. Email is different, and it is the gap in this list: an email you send us arrives however your mail provider delivered it, attachments included, and we hold it as it came. See 2.10. -
Your PIN, recovery code or backup key, as far as the app is concerned. Nothing in Vaulteon transmits any of the three. The support box checks what you type and refuses the obvious shapes, but that is a check rather than a guarantee, and email is not checked at all.
Vaulteon requests no advertising identifier and contains no advertising or analytics code.
2.12 What your phone does that we never see
Some of what Vaulteon does looks alarming on a permissions screen and is worth explaining, because none of it reaches us.
It watches which app is in front. That is how app locking works: Vaulteon checks, several times a second, which app you have just opened, so it can put the lock screen over the ones you chose to lock. This is what Android's usage access permission is for. The list of apps you locked, and the record of what you opened, stay on your phone. The one exception is in 2.5.
It can photograph whoever fails to unlock. If you turn on intruder capture, your phone takes a front-camera photograph and encrypts it straight into your vault. We never receive it and cannot ask for it, and we hold nothing about the person in it. You choose whether the feature runs; the photograph is taken by your phone and stays in your vault, so it travels only in a backup you make.
Whether you may photograph people without telling them depends on where you live, and the Terms say so.
It leaves the information already inside your photos alone, unless you ask it not to. A photo taken by a phone usually carries where and when it was taken, written there by the camera. Vaulteon does not read that, does not send it anywhere, and by default does not change it: your photo goes into the vault exactly as it was, and comes back out the same way. Pro can remove that information as a photo is added, and it is a setting you turn on rather than one that is already on. If you have not turned it on, assume the information is still in the file, including in a copy you take back out and share.
It keeps an index of your vault, so the app can show you a grid without decrypting everything. That index is encrypted with your vault key and stays on the device, as do your notes.
Vaulteon has no advertising, no analytics, and no third-party code that reports on you.
Under the GDPR every use of your data needs a lawful basis. Ours are:
| What | Why we hold it | Lawful basis |
|---|---|---|
| Email address, account id | To let you sign in and recover your account | Performance of a contract |
| Encrypted backup key and its check value | Recoverable backup is part of what Vaulteon is for, and a key only you hold is a key most people eventually lose | Performance of a contract |
| Licence and device records | To provide the features you paid for | Performance of a contract |
| Failed unlock summaries | To warn you that someone tried to open your vault | Performance of a contract |
| Delivery token, device name | So a remote lock or wipe can reach the right phone | Performance of a contract |
| Emergency reset records | To prevent misuse of a process that resets a credential | Legitimate interest (fraud prevention) |
| Your emergency email | To warn you if a reset is requested | Your consent, given when you add it |
| Your trusted contact's address | To warn them that a reset was requested on your account, so it cannot happen quietly | Legitimate interest (protecting you from an unauthorised reset). See 2.8 |
| Support messages and the replies to them | To answer your question, and to know what was already said if you write again | Performance of a contract where you have bought Pro, otherwise our legitimate interest in helping you |
| Server logs | To keep the service running and safe | Legitimate interest (security and abuse prevention) |
| Crash reports | To find and fix faults | Your consent, given by turning them on |
| Payment records | Tax and accounting | Legal obligation |
| Product emails, if you opt in | To tell you about updates | Your consent |
You can withdraw consent at any time, in the app or on the website, without losing access to anything you have paid for.
Where we rely on a legitimate interest, you can object. Write to [email protected] and tell us which one and why. We will stop unless we have a compelling reason not to, and we will tell you which it was.
Do you have to give us this? For the account, yes: Vaulteon cannot be used without an email address and the encrypted backup key described in 2.2, because they are how an account works and how you get back in. Everything else in section 2 follows from a feature you chose to switch on, and not switching it on means we do not hold it.
We do not make automated decisions about you that produce a legal or similarly significant effect. Nothing here profiles you, scores you, or decides anything about you without a person.
There are two kinds, and the difference decides who answers to you for what.
4.1 Companies that handle data for us
These run parts of the service on our behalf. They act on our instructions, under a contract, and may not use your data for their own purposes. If you have a complaint about any of them, it is ours to answer.
| Company | What they do | Where |
|---|---|---|
| Hetzner Online GmbH | Runs our servers | Germany |
| Cloudflare, Inc. | Protects and speeds up the website; stores app downloads | Global |
| Postmark (ActiveCampaign, LLC) | Sends our emails, and receives the emails you send to our support addresses | United States |
| Amazon Web Services (SES) | Sends sign-in codes if the above is unavailable | REGION |
| Sentry (Functional Software, Inc.) | Reports software errors to us | United States |
| Google LLC | Delivers messages to Android phones | Global |
| Google LLC (Google Drive) | Stores the encrypted copies of our backups | Global |
| Oracle Corporation (Oracle Cloud) | Runs the machine that copies our encrypted backups off our servers | Singapore |
| Huawei | Delivers messages to Huawei phones | REGION |
Our backups are encrypted before they leave our servers, and neither Google nor Oracle holds a key that opens them. What they store is a file they cannot read.
4.2 Companies you deal with directly
These are not working to our instructions. They decide for themselves what they do with your data, and their own privacy policies apply, not this one. We have listed them because you meet them through Vaulteon, not because we control them.
| Company | Why you meet them | Their policy |
|---|---|---|
| Paddle (Paddle.com Market Limited, or Paddle.com Inc. in the USA and Paddle.com (Canada) Ltd. in Canada) | The seller of record when you buy Pro from our website | paddle.com/legal/privacy |
| Google LLC | The seller when you buy Pro through Google Play; also optional sign-in, and the check that a Play purchase is genuine | policies.google.com/privacy |
| Microsoft Corporation | Optional sign-in (not available yet) | privacy.microsoft.com |
When you buy Pro directly, Paddle collects your payment details and handles the transaction, including the tax. We never see your card number. All we receive is that an order completed and the buyer's email address.
When you sign in with Google, or with Microsoft once available, we receive your email address and the identifier they use for you, as section 2.1 describes, and nothing else. What that company records about the sign-in is between you and them.
We do not sell your data. We do not share it for advertising.
4.3 If a government or a court asks us for your data
What we do. We require the request in writing and through a proper legal channel. We check that it is valid and that it applies to us. We narrow it to the minimum it actually compels. And we tell you it happened, unless we are forbidden from telling you, in which case we tell you as soon as we are allowed to.
What we could hand over even if we had no choice, which is the part worth knowing: everything in section 2, and nothing else. Your email address, your licence, which devices are yours, the encrypted backup key and its check value, break-in summaries, and logs. We could not hand over your files, their names, or your PIN, because we do not have them. The backup key would go across as what we hold it as: a block of encrypted data and a check value, both made on your phone from a PIN we never received.
We publish a note each year saying how many such requests we received and how many we complied with, at vaulteonlock.com/transparency.
Our servers are in Germany, inside the European Union. Encrypted copies of our backups are kept in Singapore and in Google Drive (section 4.1), normally for at most 30 days (section 7 explains the one exception), and neither place holds a key that opens them.
Our company is established in Oman, which the European Commission has not recognised as providing an adequate level of data protection. Where personal data is accessed from Oman, including the encrypted copies of our database backups we keep there so that we can prove they can be restored, we rely on STANDARD CONTRACTUAL CLAUSES / OTHER SAFEGUARD as the transfer safeguard.
Some of the companies in 4.1 are based in the United States and operate under the EU-US Data Privacy Framework or standard contractual clauses.
You can ask us for a copy of the safeguard we rely on. Write to [email protected] and we will send it, with any commercially sensitive parts removed.
5.1 Which law applies to us
We are established in Oman, so Omani data protection law applies to us, and where we offer Vaulteon to people in the European Union or the European Economic Area, the GDPR applies to that as well. This policy is written to satisfy both. Where they differ, we follow whichever gives you more.
Our regulator in Oman is OMANI REGULATOR NAME, and you may complain to them as well as to your own authority under section 7.
| What | Kept for |
|---|---|
| Account and email address | Until you delete your account, or until it goes unused (see below) |
| Encrypted backup key and its check value | The same. There is no separate switch for it (see 2.2) |
| Licence records | For the life of the licence, then 7 years for tax purposes |
| Failed unlock summaries | 12 months, or until you clear them |
| Emergency reset records | 24 months |
| Delivery token and device name | Until that device is removed from your account |
| Support messages | 12 months after the conversation is closed |
| A picture attached to a support message | With that message: 12 months after the conversation is closed |
| A message sent without signing in and never confirmed | 24 hours |
| The link to a conversation started without signing in | 30 days from the email that carried it |
| Crash reports | 90 days |
| Server logs | 30 days |
| Encrypted backups of our database and servers | 7 days on our server, 30 days in our separate backup copies (see section 7 for the one exception) |
| Payment records | 7 years, as tax law requires |
We do not keep accounts forever. If an account has not been used for 24 months and holds no active Pro licence, we email the address on it, remind you 7 days before the date, and 30 days after the first email delete it along with everything in the table above, except the records tax law requires us to keep, which are the licence and payment records and which stay for the period the table gives them. Signing in, or using the app while you are signed in, resets the clock. We would rather not hold an encrypted backup key for somebody who stopped using Vaulteon three years ago, and neither would they.
One thing we keep on purpose. Records of emergency resets are kept in a form that cannot be quietly altered, so that if someone else ever used that process against you, you can see it happened. When you delete your account, your personal details are removed from those records and only an anonymous entry remains.
Wherever you live, you may ask us to:
- See what we hold about you (access)
- Correct anything that is wrong (rectification)
- Delete your account and everything attached to it (erasure)
- Give you a copy of your data in a portable format (portability)
- Pause a use while we sort out a disagreement about it, rather than deleting it (restriction)
- Object to anything we do on the basis of a legitimate interest, which section 3 lists and explains how to do
- Withdraw consent you previously gave, at any time
We answer within one month. If a request is complicated we may take up to two months more, and if we do, we will tell you why inside the first month.
To delete your account: open Vaulteon, go to Settings, then Account, then Delete account. You can also do it at vaulteonlock.com/account or by writing to [email protected]. We will complete it within one month.
How it works. We send a code to your account's email address, and entering it confirms the request. Your account is deleted 7 days later. We email you the date, and until then you can keep your account by signing in and choosing Keep my account. The wait is there because the person most likely to try deleting your account without asking you is someone close to you who can read your email, and deleting it also deletes the copy of your backup key we hold. If you write to us instead, the same 7 days and the same email apply.
Copies in our backups. Our database, and our servers as a whole, are backed up in encrypted form, and those copies are kept on our servers and in the separate places section 5 names. A deleted account stays in backups made before it was deleted until they are removed, which is at most 30 days while our backups are running normally. If they ever stopped, we would keep the most recent copy of each kind rather than delete the last one we have, so that there is always something to restore from; that copy is removed once newer backups replace it. Whichever copy we restore from, the restore deletes your account again before the service starts.
What deletion removes: your email address, your account, the encrypted backup key and its check value, your device registrations, your failed-unlock summaries, and your support messages with everything written in them.
What deletion cannot remove, because the law says so: the licence and payment records behind anything you bought. Tax law requires us to keep those for the period given in section 6, and a request to be deleted does not override it. They are records of a transaction, and we do not use them for anything else.
What deletion cannot touch: the vault on your phone. It is on your device and we have no access to it. Deleting your account does not delete your files, and does not delete backups you have saved elsewhere. If you want those gone, delete them yourself first.
Note: if you delete your account we delete the encrypted backup key we were holding for you. If that was your only copy of the key, and you no longer have the phone and installation that made a backup, then nobody can open that backup, including us. Please save your key before deleting.
If you bought Pro, deleting your account is not a refund and does not cancel what you bought (see the Terms, section 10). We keep the record of the purchase for the tax period in section 6, with your email address and your account removed from it. You can attach it to a new account later: a purchase made through Google Play is recognised again when your phone sends us its receipt, and a purchase made on our website can be claimed with the order reference from your purchase confirmation, so keep that confirmation.
If you are unhappy with how we have handled your data, tell us first if you would rather. Write to [email protected]. We will acknowledge it within 30 days, look into it, keep you posted if it takes longer, and tell you what we concluded. You do not have to come to us first and nothing here delays your right to go straight to a regulator.
You may complain to your national data protection authority. In the EU, a list is at edpb.europa.eu/about-edpb/board/members_en. In the UK it is the Information Commissioner's Office, at ico.org.uk.
- Everything sent between your phone and our servers travels over an encrypted connection.
- Your backup key is encrypted on your phone with your PIN before it reaches us. We never receive your PIN, so what we hold is a block of encrypted data and a check value your phone made from it.
- Your PIN never leaves your phone.
- We check every PIN offered for your stored key ourselves, and after ten wrong attempts in a day we stop answering for that account for a day.
- Administrative access to our servers requires a hardware security key rather than a password.
No system is perfectly secure. If something ever goes wrong:
- We tell the regulator within 72 hours of finding out, where the law requires it.
- We tell you without delay where a breach is likely to put you at real risk, and we tell you what happened and what to do about it, not only that something happened.
- We publish an account of it either way, even where neither of the above is required, because a security product that goes quiet after an incident has told you something about itself.
Vaulteon is not for children under 18, and the Terms of Use say the same, so the number in both must be the same number. We do not knowingly collect anything from anyone younger. If you believe a child has created an account, write to [email protected]. We will contact the account holder, and if the account belongs to someone under 18 we will delete it. As with any deletion, the holder is told the date by email first, and can reply before then if we have made a mistake.
If we change this policy we will raise the version number and the date at the top, and we will tell you in the app before any change that affects what we collect.
Every previous version stays available at vaulteonlock.com/privacy/changes, with a short note saying what changed and why. You do not have to ask us for it and you do not have to take our word for what a past version said.
Tarmeeza Digital Solutions
ترميزة للحلول الرقمية
FULL ADDRESS
[email protected]
EU representative (Article 27): NAME AND ADDRESS
Found a security flaw? Write to [email protected]. Our policy, including what we promise researchers, is at vaulteonlock.com/security and in section 7.5 of the Terms of Use.