Privacy Policy

Last updated: April 17, 2026

1. Introduction

ResourceVault ("we," "us," or "our") operates the ResourceVault website and application at this domain. This Privacy Policy explains what personal data we collect, why we collect it, how we use it, and your rights regarding that data.

By creating an account and using ResourceVault, you enter into an agreement with us and we process your data as necessary to provide that service (Article 6(1)(b) GDPR — contract performance). Where we rely on a different legal basis, we say so below.

2. Who This Policy Applies To

This policy applies to all users of ResourceVault. You must be at least 13 years old to use this service. If you are under 16 and located in the European Economic Area, you may need parental or guardian consent.

3. Data We Collect

Account Data (required to use the service)

• Name — used to personalise your experience
• Email address — used to identify your account
• Password — stored as a one-way bcrypt hash; we never store your plaintext password

Content Data

• Resources you save — links, names, descriptions, categories, and tags you create

Technical / Usage Data

• IP address — logged for security monitoring and abuse prevention
• Browser type and version — logged for debugging and compatibility purposes
• Pages visited and actions taken — logged for security auditing (create, update, delete events only; we do not track page views)
• Session cookies — we use a single encrypted session cookie to keep you logged in. We do not use tracking, advertising, or analytics cookies.

4. How We Use Your Data

• To provide the service — authenticating your login, storing and displaying your saved resources
• To secure the service — detecting unauthorised access attempts, preventing abuse (legitimate interest, Article 6(1)(f) GDPR)
• To operate and maintain the service — debugging errors, monitoring availability (legitimate interest)

We do not use your data for profiling, automated decision-making, or advertising.

5. Cookies and Session Storage

We use one encrypted, HTTP-only session cookie to maintain your login session. This cookie:

• Contains no personally identifiable information in readable form
• Is deleted when you log out or your browser session ends (unless you select "Remember me")
• Is not used for tracking or advertising

We do not use third-party cookies, analytics trackers, or pixel tags.

6. Data Retention

• Account and content data — retained for as long as your account is active
• Activity logs — retained for up to 90 days for security purposes, then deleted
• After account deletion — your account data and all saved resources are permanently deleted within 30 days

7. Third-Party Service Providers

We may share limited data with the following categories of service providers solely to operate the service:

• Hosting provider — stores application files, database, and logs on servers. They process data under a data processing agreement and cannot use your data for their own purposes.

We will update this section if we add additional sub-processors.

8. Security

We implement reasonable technical and organisational measures to protect your data, including:

• Bcrypt password hashing
• CSRF token protection on all forms
• Encrypted HTTPS transmission
• Input sanitisation to prevent injection attacks
• Session invalidation on logout

No method of transmission over the internet is 100% secure. We cannot guarantee absolute security.

9. Your Rights

Depending on your location, you may have the following rights:

• Access — request a copy of the personal data we hold about you
• Correction — request correction of inaccurate data
• Deletion — request deletion of your account and all associated data
• Portability — request your data in a machine-readable format
• Objection — object to processing based on legitimate interests
• Restriction — request that we restrict processing of your data

To exercise any of these rights, contact us at privacy@vault.arunsai.dev. We will respond within 30 days.

10. Right to Lodge a Complaint

If you are located in the European Economic Area, you have the right to lodge a complaint with your national data protection supervisory authority if you believe we have not handled your data in accordance with applicable law. A list of supervisory authorities is available at edpb.europa.eu.

11. International Data Transfers

Your data may be stored and processed in a country different from where you reside. Where this occurs, we ensure appropriate safeguards are in place (such as standard contractual clauses) to protect your data in accordance with this policy.

12. Changes to This Policy

We may update this Privacy Policy from time to time. We will update the "Last updated" date at the top of this page. Continued use of the service after changes constitutes acceptance of the updated policy. For significant changes, we will provide more prominent notice.

13. Contact Us

For privacy-related questions or to exercise your rights:

• Email: privacy@vault.arunsai.dev