Privacy Policy

This summary is here for orientation. It is not a substitute for the sections below, which are what actually govern.

• We never sell, rent or trade your information, and we do not use it for advertising. There are no advertising or analytics SDKs in either mobile app.
• We never see a password. You sign in with a one-time link sent to your email, a passkey, or Google — and we never ask for, receive or store your bank login credentials.
• Most of what we hold is what you typed in: your accounts, transactions, budgets and holdings. We also keep a small amount of technical data needed to run sign-in securely.
• Everyone in a household can see that household’s financial records. That is the point of a household, and it is worth understanding before you invite someone.
• You can delete your account from inside the app. Everything is signed out immediately and the data is permanently removed within 30 days.

Vector Finance (“Vector”, “we”, “us”) provides a personal and household finance application for iPhone and Android, together with the servers that support it and this website. This policy covers all of them.

The operator of the service and the data controller for the purposes of applicable data-protection law is [legal entity name, registered address and jurisdiction to be completed].

It does not cover other companies’ services that you reach from ours. Where we hand data to a third party in order to run the app, that party is named in section 7.

Information you give us

• Your email address. Required — it is your account identifier and where sign-in links are sent.
• Your name, if you enter one or if it comes from Google when you use Google sign-in.
• Your country, timezone and preferred currency. These decide which account types you are offered, when your budget month rolls over, and how figures are displayed. Your device’s region and timezone are sent with sign-in requests and used only to fill these in when they are still unset — they never overwrite a choice you have made.
• Your financial records. The accounts you create (name, type, currency, institution name, and the last four digits of an account number if you choose to enter them), your transactions, categories, budgets, recurring rules, investment holdings and trades, and any notes or descriptions you write.
• Household membership. The households you belong to, your role in each, and the email addresses you use to invite others.

Information collected automatically

• Sign-in and session records. For each signed-in device we store a device name, the platform (iOS, Android or web), the app version, the IP address the session was created from, and when it was last seen. This is what lets you review your devices and sign one out remotely.
• Sign-in security records. One-time sign-in tokens are stored hashed, alongside the email they were issued for, the IP address that requested them, and whether they have been used. Passkeys are stored as public keys — the private key never leaves your device.
• A change history. Consequential changes to your records are written to an internal audit log with the acting user, what changed, and the IP address. It exists so that a support question about a wrong balance can be answered.
• Server logs and error reports. Ordinary operational logging, plus crash and error reports when something goes wrong.

Information from third parties

• Google, if you sign in with a Google account: your email address, name and Google account identifier. Nothing else, and we do not gain access to any other Google service.
• Plaid, if you connect a bank. Bank connections are currently available to households in the United States only and are switched off everywhere else. Where enabled and where you choose to connect an account, Plaid returns account and transaction data from your bank.

Being explicit about the absences is as useful as listing the presences. Vector does not collect, request or store:

• Your bank usernames or passwords. Where a bank connection exists, that exchange happens between you and your bank inside Plaid’s own flow, and the credentials are never sent to us.
• Full card numbers, national identification numbers, tax identification numbers, or scans of identity documents.
• A password for Vector itself. There is no password to store, leak or reuse.
• Your device location, contacts, photos, calendar or microphone.
• Advertising identifiers, cross-site tracking data, or any behavioural profile. Neither mobile app contains an advertising or product-analytics SDK.

We use your information for these purposes and no others:

• To run the service you asked for — recording transactions as balanced double-entry journal entries, deriving balances and net worth, calculating budgets and their pace, valuing holdings, and producing the charts and breakdowns you see.
• To sign you in and keep the account secure — issuing and verifying one-time links and passkeys, maintaining sessions, rate-limiting abuse, and showing you your own device list.
• To keep the software working — diagnosing errors, investigating support requests, and fixing defects.
• To communicate with you about the service itself. During the beta this means sign-in emails and occasional messages about the beta. We do not send marketing email.
• To meet legal obligations where they apply to us.

If you are in the UK, EU or another region with equivalent law, our lawful bases are: performance of our contract with you, for everything needed to deliver the service; our legitimate interests in keeping the service secure and working; your consent, where you choose to connect a bank account; and compliance with legal obligations. You can withdraw consent for a bank connection at any time by disconnecting it.

A household is the unit that owns financial records in Vector; a person is not. This is deliberate, because the people who share money need to see the same numbers. It does mean that inviting someone into your household grants them visibility of its full financial history.

Members hold roles, and administrators can invite and remove members. If you are removed from a household, your access ends immediately, but records you created remain part of that household’s ledger — they are its accounting history, not personal correspondence. Your own profile stays yours, and you can belong to more than one household.

Invite people accordingly, and remove them when circumstances change.

We use a small number of service providers to operate Vector. They act on our instructions, are bound to protect the data, and may not use it for their own purposes. This is the complete list:

Market data and exchange-rate providers are listed separately in section 8 because they receive no personal data at all.

Beyond these, we disclose information only where the law requires it — a valid court order or lawful request from a public authority — or where it is necessary to establish or defend legal claims. If a business transfer ever occurred, your data would move with it and you would be told before anything changed about how it is handled.

Plaid’s handling of your information is governed by the Plaid End User Privacy Policy.

To value your holdings, Vector fetches security prices, mutual fund values and currency exchange rates from external data sources, including EODHD, the National Stock Exchange of India, AMFI, and Frankfurter.

Concretely, and without the phrase “bank-grade”:

• No passwords anywhere. Sign-in is by one-time email link, passkey or Google. One-time tokens are stored only as hashes, expire fifteen minutes after they are issued, and cannot be used twice.
• Encryption in transit. All traffic between the apps and our servers uses TLS.
• Isolation enforced by the database. Household data is separated by PostgreSQL row-level security, which denies access by default. The check happens in the database on every query rather than relying on application code to remember it.
• Bank tokens encrypted in the database. Where a bank connection exists, the provider access tokens are encrypted at the application layer before they are stored, so they are not readable from the database alone.
• On your device. Session credentials are held in the iOS Keychain and Android’s encrypted storage. You can require Face ID, Touch ID or your device biometrics to open the app, and turn on a privacy screen that covers balances as soon as the app leaves the foreground.
• Session control. Every signed-in device is listed in the app, and signing one out ends its session immediately.

Where records belong to a household you shared with others, deleting your account removes your profile and your access. Household financial records are not deleted from under the remaining members; if you are the only member, the household and its records are deleted with you.

Depending on where you live you may have rights to access, correct, delete, restrict or object to our use of your information, to portability, and to complain to a regulator. We extend the substance of these to everyone, wherever you are.

• Access and correction. Almost everything we hold about you is visible and editable in the app: your profile, accounts, transactions, budgets, holdings, devices and passkeys.
• Portability. Ask us and we will send you a machine- readable export of your financial records.
• Deletion. Delete your account from inside the app: profile → Security → Delete Account. You can also write to privacy@v3ctor.app from your account email. Full details are on the delete your account page.
• Withdrawing consent. Disconnect a bank connection at any time from within the app.
• Complaints. If you are in the UK or EU you may complain to your local supervisory authority. We would rather you told us first so we can fix it.

Vector is usable from several countries, and our providers operate internationally. Your information may therefore be processed in a country other than your own, including the United States. Where data protected by UK or EU law is transferred outside those regions, we rely on the appropriate safeguards available to us, such as the UK and EU standard contractual clauses.

The specific hosting regions and the safeguards in place are [to be completed once production hosting is finalised].

Vector is not intended for children. You must be at least 18 to use it, as set out in the Terms of Service, and we do not knowingly collect information from anyone under that age. If you believe a child has given us information, write to privacy@v3ctor.app and we will delete it.

We will update this policy when what we do changes. The date at the top always reflects the current version. If a change materially affects your rights or meaningfully widens how we use your information, we will tell you by email before it takes effect rather than relying on you to notice a new date on a page.

Privacy questions, requests and complaints: privacy@v3ctor.app

Anything else: support@v3ctor.app

Postal address and any data-protection representative: [to be completed with the operating entity]