What this website and the Vault app store in your browser, and who they talk to.
Version 1.2 · Effective 20 October 2026 · Last updated 20 October 2026
This website sets no cookies of its own. It uses one analytics
service, Cloudflare Web Analytics, which counts page views
without cookies. There is no tag manager, no advertising pixel, no session
recording, no A/B testing tool and no chat widget on any page of
pfmvault.com.
The one third party that may set a cookie is Cloudflare’s sign-in check, which the app shows when you create an account or sign in, and never while you read this site. It is described below.
There is no consent banner: nothing on this site sets a tracking cookie, and the analytics is described below.
Everything on these pages — the styling, the scripts, the typeface, the app screenshots — is served from our own domain. The one exception is the analytics script below.
That was not true until 13 September 2026. Until then the Libre Franklin typeface was loaded from Google’s font service, which meant Google received your IP address on every page load. The font files now sit on our own domain, and that request no longer happens.
One page is different, and only when you act on it: the research survey sends your answers to our database when you press Send. Nothing is sent while you read it, and nothing is sent if you close the page. That database is Supabase, hosted in Sydney — the same service the app uses for cloud sync, described in the Privacy Policy.
One more is not a page you visit: pfmvault.com/captcha, which the Vault
app shows in a small frame when you create an account, sign in or reset a password.
It loads Cloudflare Turnstile, which checks that a person, not a script, is asking.
Cloudflare receives your IP address and signals from your browser while it checks,
and may set a cookie for that check. It never receives your email or password, and
nothing loads it while you only read this site.
Otherwise, one thing sits between you and us, and it is our host:
| What | Who | What it means for you |
|---|---|---|
| Hosting | Cloudflare Pages | Our host may set a cookie of its own (typically named __cf_bm or
similar) to distinguish real visitors from automated traffic, and it keeps
standard server request logs including IP addresses. This is infrastructure
security, not analytics, and we do not read it as a report on you. |
The installers are hosted on GitHub, but the download buttons do not send you there. Your browser asks pfmvault.com for the file, our server fetches it and passes it back, so GitHub never sees your browser, your address or that you downloaded anything. The only exception is if we cannot reach the file at all, in which case the button falls back to sending you to GitHub directly, and from that point their terms and privacy practices apply.
Your browser can block third-party requests and clear cookies for this site and the pages will still work. Blocking web fonts specifically gives you a system typeface instead of ours, which changes how the page looks and nothing else. We would rather tell you that than pretend the choice does not exist.
The desktop app is not a browser page and sets no cookies of its own; the one exception is the sign-in check described above, which runs in a small web frame. It stores your preferences — your theme, which chart you last looked at, your date format — on your own computer. Those never leave it and are not readable by us.
There is no analytics SDK, no crash-reporting service, no advertising identifier and no telemetry in the application. We have no idea how many people open Vault on a given day. That is a deliberate trade: we lose product data, and you keep yours.
Each page loads a small script from static.cloudflareinsights.com, part of
Cloudflare Web Analytics, provided by our host. It reports the page you opened, the
page that linked you here, your browser and screen size, and how long the page took
to load. It shows us totals: how many visits, to which pages, from which countries.
Cloudflare says it sets no cookies, stores nothing in your browser and does not
follow you across other sites. It does not see anything you do in the Vault app.
This page said there was no analytics until 20 October 2026. The service had been switched on in our host’s settings rather than in the site itself, and this page was not updated when it was. We should have said so sooner.
To opt out, block static.cloudflareinsights.com in a content blocker.
The site works the same without it.
Australia does not require a cookie consent banner in the way the European Union does. What Australian privacy law requires is that we are open about what we collect, which is what this page and the Privacy Policy are for.
Even where a banner is required, it exists so you can refuse non-essential tracking. The only analytics here sets no cookies and is described above, so we tell you on this page rather than interrupting you with a banner.
If we add any other analytics or tracking, we will update this page before it goes live, say plainly what it is and why, and give you a way to opt out.