Privacy

Stubvault is local-first. Cloud sync is off by default and stays off until you enable it in Settings. This page states exactly what the app stores, encrypts, and sends — every claim here corresponds to code in the build.

Data on your device

All data lives on the device, encrypted at rest:

• Receipt database — encrypted with AES-256 via SQLCipher. The key is a 256-bit per-device secret held in the platform secure store (WHEN_UNLOCKED_THIS_DEVICE_ONLY). It never leaves the device's secure enclave / keystore.
• Receipt images — encrypted with AES-256-GCM, keyed via HKDF-SHA256 from the same per-device master secret.
• A receipt image is decrypted only into a single temporary cache file while you are viewing it, and that file is deleted when you leave the screen.

Network calls

Stubvault makes outbound requests only to the destinations below. Everything else is unreachable: iOS App Transport Security enforces TLS 1.3 minimum with no arbitrary loads, and Android's network security config blocks cleartext and uses system trust anchors only.

Auth (only if you sign in)

• Supabase Auth — magic-link email, Apple Sign-In, Google Sign-In, session refresh. Signing in is needed only to use sync; the app runs fully with no account.

Opt-in cloud sync

• Supabase Postgres — receipt rows, isolated per user with row-level security.
• Supabase Storage — receipt images in a private per-user bucket.
• Account deletion — a delete-account function destroys your auth record, all database rows, and all storage objects on request.

Diagnostics (opt-in)

• Sentry crash reports — PII-scrubbed before sending: request data, cookies, and headers are deleted, and receipt fields (merchant, totals, OCR text, notes, image paths, email, user id, and more) are replaced with [scrubbed].
• PostHog events — a whitelisted event set only (app opened, capture started/completed, capture latency, export, sync enabled/pushed/pulled, account deleted). No event carries merchant names, totals, OCR text, notes, or any other receipt content.

What's not in the app

Stubvault ships with no third-party analytics or advertising SDKs. Confirmed transitively in the resolved bundle: no Segment, no Firebase Analytics / Crashlytics / Performance, no Mixpanel, no Amplitude, no AppsFlyer, no Adjust, no Branch, no AdMob / AppLovin / IronSource / Tapjoy or any ad-mediation SDK, no Facebook SDK, no OneSignal. The bundle audit is documented in the repository.

Retention

• Local-only data remains on your device until you delete a receipt, sign out, or uninstall the app.
• Synced data is destroyed by account deletion — auth record, all rows, and storage objects.
• Infrastructure backups follow Supabase's standard retention (point-in-time recovery up to 7 days; daily backups up to 30 days). Account deletion does not purge those historical backups; they expire on that schedule.

Contact

Questions: hello@getstubvault.com

← getstubvault.com Terms of Service →