What Vault stores, what leaves your device, and what we can and cannot see.
Version 1.0 · Effective 8 September 2026 · Last updated 8 September 2026
The short version. Your financial records live in a file on your own computer. Nothing is uploaded unless you turn on cloud sync, and if you do, everything is encrypted on your device first — we hold ciphertext we cannot read. Receipt photos and your saved credentials never leave your machine at all. There is no analytics, no tracking, no telemetry and no advertising in this app.
The rest of this page is the long version, including the parts that are less flattering: the handful of things we can see, and the limits of what encryption protects you from.
Vault is published by PLACEHOLDER Pty Ltd (ACN [ACN], ABN [ABN]), of [registered address], Australia. In this policy, “Vault”, “we”, “us” and “our” mean that company; “you” means the person using the app.
Privacy questions, requests and complaints all go to one address: [email protected]. There is no phone queue and no ticket system — a person reads it.
We handle personal information in accordance with the Australian Privacy Principles in the Privacy Act 1988 (Cth). We do this as a commitment rather than because our current turnover obliges us to, and we would rather say so plainly than rely on an exemption.
Vault is built for Australian residents and is offered in Australia only. Its tax
features assume Australian residency, ATO rules and Australian financial years.
This policy covers the Vault desktop application, our optional cloud sync service,
and this website at pfmvault.com.
Vault is unusual for a finance app, so it helps to be concrete. Your information sits in one of three places, and which one it is determines who can read it.
This is where the substance of your financial life lives, and it is the default for everything. It is stored in an application-private folder on your computer:
Vault does not ask for and does not store your tax file number, Medicare number, date of birth, BSB or full account numbers. There is no field for any of them.
If you create an account and turn on cloud sync, the contents of your records are encrypted on your device before upload, using AES-256-GCM under a key derived from your password with PBKDF2-SHA256 at 310,000 iterations.
The key never reaches us. What we store is a wrapped copy of it that can only be unwrapped with your password, which we do not have — we never receive your password, only a value derived from it that is useless for decryption. This is what “end-to-end encrypted” means here, and it has a hard consequence you should understand before relying on it: if you forget your password, your synced data cannot be recovered. Not by you, and not by us. There is no reset that preserves it.
Sync cannot work on ciphertext alone; something has to be readable for one device to know which record is newer. This is that something, and it is the complete list — see the next section.
Most privacy policies are vaguest exactly here. Ours is a table.
| We hold, readable | Why |
|---|---|
| Your email address and sign-in metadata | You need an account to sync at all |
| Each record’s id, its type (transaction, account, holding, savings, loan, pledge), and when it was created, changed or deleted | The merge runs on these; without them two devices cannot agree on which copy wins |
| How many records of each type you hold, and how that grows over time | An unavoidable consequence of the row above |
| That you have a bank feed connected, which provider it is, and when it last delivered | To route a feed to the right account and show you sync status |
| Your subscription state — plan, status, renewal date, and the payment provider’s customer and subscription identifiers | To know what you have paid for |
| A count of API calls you make, per endpoint | Rate limiting, so one account cannot exhaust a shared quota |
Read plainly: we can see that you use Vault, that you have a bank feed, roughly how much you track and when you last touched it. We cannot see a single amount, merchant, description, balance, category or account name. There is no server-side view of your finances and no way for us to produce one — not for ourselves, not for a marketer, and not on request.
Every one of these is off until you turn it on. Each says exactly what leaves.
Encrypted record contents, plus the readable fields in the table above. Covered in full in section 3.
When bank feeds are available and you connect one, your email address and your Vault account identifier are shared with our open banking provider so it can create your enrolment. You then authorise the connection on your bank’s own page — Vault never sees your banking username or password, and there is no key for you to handle. Your bank returns account details and transactions, which are passed through to your device and stored there.
We do not store your bank transactions on our servers. They are relayed and kept locally. The only thing recorded server-side is that an enrolment exists and when the feed last fired. See section 14 for your rights under the Consumer Data Right.
If you supply your own Up Bank personal access token, the app talks to Up directly from your computer. Only the token is sent. The transactions and balances that come back go straight into your local vault. Nothing about this route passes through us.
Vault’s everyday categoriser is entirely local — a keyword classifier covering roughly 250 Australian merchant patterns plus the merchant cache on your device. It makes no network request of any kind, and it is what runs automatically.
You may additionally configure a language model, either a hosted one with your own API key or one running on your own machine. Where the model is off-device, the only thing sent is merchant description text — never amounts, dates, balances, account numbers, account names, or any identity or contact field.
Descriptions that came from a bank feed are withheld entirely. Only descriptions from transactions you typed in or imported from a CSV are eligible to be sent off-device. This is enforced in the code and covered by automated tests that inspect what is actually transmitted, not merely whether a setting is on. The app tells you afterwards how many were kept back. A model running on your own machine is not treated as a disclosure, because nothing leaves it.
QuickView answers questions about an account or profile for a financial year. When you use it, these summary figures are sent to the AI provider you configured: the account or profile name, the financial year, total money in, total money out, the net figure, the current balance, the number of transactions, your top six spending categories with their dollar totals, and the question you typed.
Be aware of the difference. Individual transactions are not sent, but unlike the categoriser above, these totals are calculated over every transaction in scope — including ones that came from a bank feed. The app asks you to confirm this the first time, and you can decline and simply not use the feature. Everything else in Vault works without it.
To show current values, the app requests a price for each holding from a public market-data service. That request contains the ticker symbol and, necessarily, your IP address. It contains no quantity, no cost base and no personal identifier — but a party observing it could infer which securities you hold. If that matters to you, leave the price refresh alone; the app works from the figures you enter.
When you set or change a password, Vault can check it against a public database of known breached passwords. It does this without disclosing the password: the password is hashed on your device and only the first five characters of that hash are sent, which matches many thousands of possibilities. The service cannot determine your password from it.
Subscriptions are handled by Stripe. You enter card details on Stripe’s own page — card numbers never touch Vault’s systems, and we could not store them if we wanted to. Stripe receives your email address and your Vault account identifier so the payment can be matched to your account.
The app checks for new versions against our release host. This is a standard version check and carries no account or financial information.
Vault uses AI in two places. Neither is on by default, and neither makes a decision about you that you cannot see and change.
Every category it suggests is a suggestion. You can change any of them, at any time, and the app records whether a category came from you, from the keyword list or from a model. Nothing is hidden and nothing is final.
The model is instructed to describe, not advise. It is told to use only the figures given to it and to decline questions about what is deductible, how to reduce tax, or what to do with your money — those go to a registered tax agent or a licensed adviser. AI output can still be wrong; check it against the figures shown beside it, which are the real ones. It is never used to decide anything about your access to Vault, your subscription, or what you pay.
We include this section because from 10 December 2026 the Privacy Act requires entities covered by it to disclose where a computer program makes, or substantially supports, decisions that significantly affect a person. We do not believe Vault's suggestions reach that threshold — you overrule every one of them — but we would rather describe what the software does than argue about whether we had to.
Vault contains no analytics SDK, no crash-reporting service, no advertising identifier and no telemetry. We do not know how many of our users open the app, which screens they visit, or what they do there.
This is the complete list of parties in the production path.
| Party | Role | What it receives | Optional? |
|---|---|---|---|
| Supabase | Accounts, database and server functions | Your email address; encrypted record contents; the readable fields in section 4 | Only if you use cloud sync |
| Fiskil | Open banking data provider | Your email address and Vault account identifier; your bank data in transit | Only if you connect a bank feed |
| Stripe | Payments | Your email address, Vault account identifier, and the card details you give it directly | Only if you subscribe |
| Up Bank | Direct bank API | The access token you supply | Only if you connect Up |
| NVIDIA | Hosted AI model | Merchant description text, or QuickView summary figures | Only if you configure a key |
| Yahoo Finance | Market prices | Ticker symbols you hold | Only if you refresh prices |
| Have I Been Pwned | Breached-password check | Five characters of a password hash | At sign-up and password change |
| GitHub | Downloads and updates | No account or financial data | No — this is how you get the app |
| Cloudflare | Hosts this website | Standard web request data for pfmvault.com | No — but the website holds no user data |
We do not sell, rent, broker or trade your personal information. We do not disclose it for advertising, and we do not use it to train AI models. We have no advertising business, which is the most reliable reason to believe that.
All of our own server-side data is hosted in Australia, in
Supabase’s Sydney region (ap-southeast-2). Your bank data is not
stored on our servers at all.
Two of the optional services above are operated from overseas, principally the United States: the hosted AI model, if you enable one, and the market-price lookup. Both are off unless you switch them on, and both are described precisely in section 5. Stripe processes payments internationally. GitHub and Cloudflare operate global networks. The typeface on this site is served from our own domain, so loading a page here contacts nobody but our host.
| What | Kept for |
|---|---|
| Your ledger, accounts, investments and receipts on your device | Indefinitely, at your discretion. Tax substantiation generally requires five years from the date you lodge, so the app does not quietly age your records out — you delete what you want gone. |
| Encrypted record contents on our server | Until you delete the record or your account |
| Your account and email address | Until you ask us to delete the account |
| Subscription and billing records | As required by Australian tax and corporations law, generally seven years, after account deletion |
| Bank data on our servers | Not stored. Transactions are relayed to your device, not retained |
| Error logs | On your device only, capped and rotated. Never transmitted |
| Server operational logs | Our hosting provider’s default retention period |
You can read, edit and delete everything in the app directly — that is the normal way to correct your information, and it needs no request to us. You can also export your whole vault to a JSON file, and your transactions to CSV, at any time and on any plan.
Email [email protected] from the address on the account. We will confirm it is you, then delete your account and every server-side row attached to it — encrypted records, settings, encryption metadata, bank enrolment, feed events, subscription record and usage counters. We will do this within 30 days and tell you when it is done. Your local copy stays on your device; deleting that is uninstalling the app, or deleting the vault from within it.
Stated plainly: there is no self-service delete button in the app today. Deletion is a request we action by hand. We are building the self-service version, and until it exists the email above is a real and committed process, not a brush-off.
When you delete a single record while sync is on, its contents are destroyed locally and on our server, but a marker remains: the record’s id, its type, and the time it was deleted. That marker is what tells your other devices to delete it too — without it, the record would reappear on the next sync. It contains no amount, date, merchant, description, category or account. Those markers are removed when you delete your account.
You already hold your data, so an access request is usually unnecessary. If you want the readable fields we hold about you — section 4’s table, for your account — ask and we will send them within 30 days, free.
A limitation we would rather state than have you discover. The vault file on your own computer is not encrypted by Vault itself. It is protected by your operating system’s file permissions and by full-disk encryption if you have it on. Anyone with access to your unlocked computer, or to an unencrypted disk taken from it, can read it. Turning on full-disk encryption — BitLocker on Windows, FileVault on macOS — is the single most useful thing you can do about that.
No system is perfectly secure, and we will not claim otherwise. What we have done is limit how much a breach of our systems could expose, which is why the encryption boundary sits on your device rather than ours.
If a data breach occurs that is likely to result in serious harm, we will notify you and the Office of the Australian Information Commissioner as required by the Notifiable Data Breaches scheme in Part IIIC of the Privacy Act 1988, and — where bank feed data is involved — as required by the Consumer Data Right rules. We will tell you what happened, what information was involved and what to do about it. We would rather tell you early and be imprecise than tell you late and be tidy.
Not yet in effect. Bank feeds through Australia’s Consumer Data Right are built into Vault but are not switched on, because the arrangement with an accredited provider is not in place. No Consumer Data Right data is being collected today.
When it is switched on, our provider Fiskil — which holds unrestricted accreditation as a data recipient — will act as the CDR principal and Vault will operate as its CDR representative under a written arrangement required by the CDR Rules. Under those rules, Fiskil’s CDR policy governs CDR data, not this one, and your rights sit with the accredited entity.
Vault is not itself accredited under the Consumer Data Right, and we do not represent otherwise. The details, including how consent works and how to complain, are on our Consumer Data Right page.
Vault is not intended for people under 18 and we do not knowingly collect information from them. If you believe a child has created an account, tell us and we will delete it.
Tell us first: [email protected]. We will acknowledge within 7 days and give you a substantive answer within 30 days. Say what happened and what you would like done about it.
If you are not satisfied, you can take a privacy complaint to the Office of the Australian Information Commissioner — oaic.gov.au, or 1300 363 992. Once bank feeds are live, complaints about Consumer Data Right data can also go to the Australian Financial Complaints Authority; the Consumer Data Right page sets out that path.
If we change this policy in a way that materially affects you, we will tell you in the app or by email before it takes effect, and the version and date at the top will change. Older versions are available on request. We will not quietly widen what we collect and rely on you not re-reading the page.