Last updated: April 2026
VaultFolio ("we", "us", "our") is an Australian-based collectibles portfolio platform. This Privacy Policy explains how we collect, use, store, and protect your personal information when you use the VaultFolio mobile application and associated services (the "Service").
We are committed to complying with the Australian Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs), the General Data Protection Regulation (GDPR) for users in the European Union, and the California Consumer Privacy Act (CCPA) for California residents.
When you sign in via Google OAuth or Sign in with Apple, we collect:
Content you create within the Service:
When you use the camera or photo library features:
If you choose to use our Reverse Mint feature, we collect:
sha256(email:cert_number) — rather than personally identifiable information on-chain. No PII is ever written to the blockchain.
| Purpose | Data Used |
|---|---|
| Provide and operate the Service | Account data, collectibles data |
| Calculate portfolio valuations | Collectibles data, market data |
| Verify grading certifications | Certification numbers (sent to PSA/Beckett/CGC/GIA) |
| Mint blockchain provenance tokens | Wallet address, cert data (opt-in only) |
| Compute the VF-500 index | Aggregated, anonymised market data |
| Improve the Service | Anonymous analytics, crash reports |
| Communicate with you | Email address (service updates and material policy changes only) |
We do not sell, rent, or trade your personal information to third parties. We do not use your data for advertising purposes.
| Data Type | Storage Provider | Location |
|---|---|---|
| Account and collectibles data | Supabase (PostgreSQL) | AWS Sydney (ap-southeast-2) |
| User-uploaded files | Supabase Storage | AWS Sydney (ap-southeast-2) |
| Static assets and CDN | Cloudflare | Global edge network |
| Blockchain provenance tokens | Polygon / Ethereum / Base | Public blockchain (decentralised, immutable) |
| Mint metadata | Pinata (IPFS) | Decentralised (immutable) |
All data at rest is encrypted. Data in transit uses TLS 1.2 or higher. Database access is secured via Supabase Row Level Security (RLS), ensuring users can only access their own data.
We share limited data with the following third-party services as necessary to provide the Service:
| Service | Purpose | Data Shared |
|---|---|---|
| Supabase | Database, authentication, file storage | Account data, collectibles data, uploaded files |
| OAuth sign-in | Authentication flow only | |
| Apple | Sign in with Apple | Authentication flow only |
| Cloudflare | CDN, DNS, DDoS protection | Standard HTTP request data |
| Railway | API hosting | API requests (authenticated) |
| eBay | Market data API | No user data shared — public market queries only |
| PSA / Beckett / CGC / GIA | Grading certification verification | Certification numbers only |
| Polygon / Ethereum / Base | Blockchain provenance minting | Wallet address, privacy-preserving hash (opt-in) |
| Pinata | IPFS metadata storage | Mint metadata only — no PII |
| Expo / EAS | App build and update service | No user data |
Depending on your jurisdiction, you have the following rights regarding your personal information:
| Right | How to Exercise |
|---|---|
| Access — obtain a copy of your data | Use the in-app data export feature or contact us |
| Correction — correct inaccurate data | Edit directly in the app, or contact us |
| Deletion — request deletion of your data | Delete your account in-app (30-day grace period, then permanent deletion) |
| Portability — receive your data in a portable format | JSON export available in-app |
| Opt-out of analytics — stop anonymous usage tracking | Toggle in app settings |
If you are located in the European Union, you additionally have the right to: restrict processing of your data, object to processing, lodge a complaint with your local data protection authority, and withdraw consent at any time. Our lawful basis for processing is contract performance (providing the Service) and legitimate interest (improving the Service).
California residents have the right to: know what personal information we collect, request deletion of personal information, and opt out of the sale of personal information. We do not sell personal information. To exercise your rights, contact us at luke@vaultfolio.ai.
VaultFolio is not intended for use by children under the age of 13. We do not knowingly collect personal information from children under 13. If we become aware that we have collected data from a child under 13, we will take prompt steps to delete that information. If you believe a child under 13 has provided us with personal data, please contact us at luke@vaultfolio.ai.
VaultFolio uses minimal cookies:
Your primary data is stored in AWS Sydney (ap-southeast-2), Australia. However, some data may be processed internationally:
For EU users, where data is transferred outside the European Economic Area, we rely on Standard Contractual Clauses or adequacy decisions as appropriate. For CCPA purposes, we do not sell personal information to third parties.
We may update this Privacy Policy from time to time. For material changes, we will notify you via the email address associated with your account before the changes take effect. Non-material changes (such as formatting or clarification) may be made without notice. The "Last updated" date at the top of this policy indicates when it was last revised.
If you have questions about this Privacy Policy, wish to exercise your data rights, or have a complaint about how we handle your data, please contact us:
VaultFolio — Privacy Enquiries
Email: luke@vaultfolio.ai
Website: vaultfolio.ai
VaultFolio is an Australian-based entity. For Australian Privacy Act complaints that remain unresolved, you may contact the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au.