VaultsHive Privacy Policy

Effective date: September 21, 2026
Last updated: October 1, 2026

This Privacy Policy describes how HiveApp Technologies LLC, a Texas limited liability company (“VaultsHive,” “we,” “us,” or “our”) collects, uses, discloses, and otherwise processes personal information in connection with VaultsHive’s websites, mobile applications, and related services (collectively, the “Service”). We aim to use clear, plain language suited to the people who use VaultsHive.

It applies where VaultsHive acts as a controller or business (as those terms are defined in applicable privacy laws) of personal information. Where we process personal information on behalf of another party, additional terms may apply.

This Policy should be read together with our Terms of Service.

1. Who we are and contact details

Controller / business name: HiveApp Technologies LLC
State of formation: Texas, United States
Mailing address: 11639 Creek Point Drive, Frisco, TX 75035, United States

General inquiries, support, and privacy requests: [email protected]
Abuse reporting (trust and safety): [email protected]
Copyright / DMCA (U.S.): Use the designated agent and contact details in the Terms of Service — §10.3 ([email protected]).
Transactional mail From address: [email protected] (automated notices only; that mailbox is not monitored for replies).

2. Personal information we collect

The categories below depend on how you use the Service. Not every user will provide every category.

Data minimization. We limit collection of personal information to what is reasonably necessary for the purposes described in this Policy—including providing and securing the Service, meeting legal obligations, and the legitimate uses in later sections—and we retain information only as described in §7.

2.1 Account, Hive identity, and sign-in

VaultsHive is part of the Hive network operated by HiveApp Technologies LLC. AlbumHive, VaultsHive, and LooksHive share one Hive identity (the same email and credentials). Signing in to any of those three apps authenticates that identity. SlamHive is a separate product with its own accounts and is not part of this Hive identity, Hive storage meter, or Hive-wide deletion.

Creating an AlbumHive or LooksHive account does not automatically create VaultsHive product data. The first time you sign in to VaultsHive with that Hive identity, VaultsHive provisions its own vaults, credits, and folders. Albums, vaults, and Looks libraries stay in the app where you created them in the current product (no AlbumHive hub of VaultsHive vaults).

Shared Hive storage and links. Billable files in AlbumHive, VaultsHive, and LooksHive count against one Hive storage quota, purchased and managed in AlbumHive. VaultsHive share-link counts and durations follow that same Hive / AlbumHive entitlement. VaultsHive paid packs are analysis credits and features, not a second storage plan.

We may collect:

• Identifiers: name, email address, account identifiers, and profile fields you choose to provide
• Date of birth — required to finish registration (entered as MM/DD/YYYY and stored as YYYY-MM-DD) to verify that you meet the minimum age and eligibility requirements in our Terms of Service.
• Phone number — optional. Registration (including after Sign in with Google or Sign in with Apple) does not require a phone number. If you add one, it lets people who already have you in their contacts find you and invite you to their Vaults, Collections, and Groups, and it may be used for verification (e.g., SMS via Twilio), security, and account-related communications. You can add, change, or remove it in your profile settings.
• OAuth identifiers when you use Sign in with Google or Sign in with Apple: the email and name the provider shares, the provider’s subject / user ID, and short-lived identity or access tokens used only to complete sign-in. We do not receive your Google or Apple password.
• Billing country and related eligibility fields for paid credit packs
• Authentication data: passwords or credentials managed by our authentication flows (we do not store passwords in plain text); OAuth accounts may have no VaultsHive / Hive password
• Device and session identifiers (for example, a device ID supplied by the client; VaultsHive device slots are independent of AlbumHive and LooksHive and typically start at five)
• On Android and iOS, device identifiers (for example the Android Advertising ID) may be received by our ad provider as described in §2.8 when ads are shown (non-personalized ads only)
• Profile information you choose to add (such as display name or optional profile photo). Optional registration / profile photos, where offered, may be stored on the shared Hive identity path rather than as vault artifacts

2.2 Documents, files, and related media (“User Content”)

• Documents and files you upload to vaults (for example PDF, Office, images, text/code, and other supported types; video or audio may be limited or use different features such as speech-to-text)
• Derived files created to operate the Service, such as thumbnails, preview assets, extracted text / OCR, embeddings or similar vectors, labels, and analysis status fields
• Metadata associated with artifacts (for example filenames, timestamps, vault structure, category labels, contributor attribution, page-equivalent estimates)

2.3 Local preview, Public AI Analyze, Hive Help, Hive Search, and reminders

Sensitive / personal data and public LLMs. Public AI Analyze uses a third-party / public large language model (for example OpenAI). You control what is sent for Public AI Analyze. VaultsHive does not send your vault documents to a public LLM on its own. Local preview (extract, OCR, thumbnails, search indexes) runs on VaultsHive infrastructure and is not a public LLM. Public AI Analyze runs only when you start it (or leave an in-product analyze option enabled that you can turn off). If a document contains sensitive personal information and you choose to analyze it, that content (or extracts of it) may be processed by the public LLM under their terms.

VaultsHive is not PCI, HIPAA, or similarly certified. Do not use the Service as a system of record for payment-card, protected-health, or other regulated data.

• Local preview: indexing / extract outputs used for Artifact Preview and Hive Search—such as text extracted from documents (OCR / native extract), embeddings or similar vectors, object labels (images), and related technical representations—processed in VaultsHive’s and its non–public-LLM infrastructure unless we tell you otherwise in-product
• Hive Search: search queries you enter, optional vault scope, and matching against filenames, dates, OCR / extract text, Public AI Analyze fields (where Analyze has run), and embedding-based similarity for eligible images. Hive Search is not face or people search
• Public AI Analyze (third-party / public LLM): When you confirm Public AI Analyze, we may send Local outputs and related analysis inputs (extracted text, OCR, labels, and similar) to a third-party AI provider. We do not intend to attach account personal information (name, email, phone, account ID) to those API requests under the current design. Document contents and extracts may contain personal data; if present in what you choose to send, the AI provider processes that data under their terms
• Hive Help (how-to chat): answers VaultsHive product questions. As of the Last updated date, VaultsHive does not send your vault documents or other stored User Content to OpenAI for Hive Help. We do not intend to attach account personal information to Hive Help API requests. Only what is strictly necessary is transmitted (for example, user-typed prompt text). Your prompts are processed by OpenAI; do not enter sensitive personal information in Hive Help prompts. The app displays this notice on the Hive Help screen
• Model training (vendor): We do not permit the AI vendor to use submitted data for model training where such controls are available through the API and our account configuration. The vendor’s own terms describe how they may process, cache, or retain API traffic
• AI application logs: We do not design the Service to retain a long-lived VaultsHive chat transcript of every Hive Help or Public AI Analyze call for marketing analytics. We may store analysis results needed for the Information page, Hive Search, reminders, and product operation. Incidental debug, infrastructure, or security telemetry, and processing/retention by the AI vendor under their terms, may still occur
• Hive Reminders: reminder dates, titles/fields you confirm, timezone, and delivery status for push / in-app notifications
• Speech-to-text / text-to-speech (where offered) may send audio you choose or text you choose to a vendor and consume additional credits

2.4 Communications

• Transactional emails (welcome, security alerts, billing notices, share notifications, account and deletion notices) sent via providers such as Zoho Mail from [email protected]. That address is a send-only From line; replies are not read. Write [email protected], [email protected], or [email protected] as appropriate
• SMS or voice messages sent via Twilio (or similar) for phone verification
• Support messages when you contact us
• Push notifications on iOS and Android when you grant permission: a device push token (via Expo Push, Apple Push Notification service (APNs), and/or Firebase Cloud Messaging (FCM)) so we can deliver social, share, billing, reminder, security, and similar alerts while the app is in the background or not running. Web does not use the same OS push path. You can refuse or later disable notification permission in system settings; we then stop using that token

2.5 Payment information

VaultsHive may use Stripe, Apple, and/or Google Play for one-time analysis credit packs, depending on how and where you purchase.

Stripe (web). Card and bank data are generally collected and processed directly by Stripe subject to Stripe’s privacy policy. VaultsHive typically receives limited billing metadata (such as payment status, partial card details, billing address fragments, and transaction references).

Web and mobile apps. Paid items may be purchased and managed:

(a) on the web through Stripe (for example at https://app.vaultshive.com); and/or
(b) in the iOS and/or Android apps through Apple App Store and/or Google Play in-app purchases, where that option is offered in-product.

• Stripe: Card and bank data are generally collected by Stripe; VaultsHive receives limited billing metadata.
• Apple / Google: Payment is processed by Apple or Google under their terms and privacy policies. VaultsHive receives purchase status and related entitlements (for example product identifiers, transaction references, and credit-grant signals), not full payment card numbers.

Which store or processor applies depends on how and where you purchase. Managing or requesting a store refund may require using Apple or Google tools as well as (or instead of) VaultsHive.

2.6 Technical and usage data

• IP address and derived approximate location (for example, country via GeoIP for security notifications and fraud prevention)
• User agent, browser or app version, operating system, language preferences
• Logs and diagnostics: timestamps, request paths, error reports, performance metrics
• Cookies and similar technologies on web surfaces, where used (see Section 8)

2.7 Abuse reports and safety

When you use Report or similar flows on shared links, we may collect:

• Report content (description, category, and related fields)
• Optional file attachments you choose to upload
• Identifiers tying the report to the vault, share link, artifact, or comment
• Reporter technical data such as hashed IP, user-agent, and optional contact email you provide
• CAPTCHA signals (for example, Cloudflare Turnstile tokens) to reduce automated abuse

Routing. In-product Report submissions are routed by issue type: Abuse to [email protected]; Copyright / IP to [email protected]. For other communications, use [email protected].

We generally do not notify the content owner that a report was filed only because a report was submitted, unless required by law or in specific enforcement situations.

2.8 Advertising (AdMob) and device advertising identifiers

Free VaultsHive (and leftover free/trial credits before any paid ads window) may show third-party ads (currently Google AdMob inline banners in the iOS and Android apps). Web may show Google AdSense in the same page slots when that surface is enabled. We do not use your vault documents as an advertising product.

Who sees ads. Ads are per app. A paid VaultsHive credit pack can hide ads in VaultsHive only, and only while both are true: (1) the ads-free date (ads_free_until) is still in the future, and (2) your analysis credit balance is greater than zero. Ads-free windows are 2 months (Micro), 4 months (Pro), or 6 months (Premium) from that paid purchase. A later paid pack extends the date using max(existing date, new purchase + window) — it never shortens an existing date. Ads return on whichever happens first: that date, or your credit balance reaching zero. AlbumHive storage plans do not remove VaultsHive ads. LooksHive packs do not remove VaultsHive ads. Free / admin / promo grants do not start an ads-free window.

Data used for ads. VaultsHive shows non-personalized ads only. When ads are shown, Google AdMob (and AdSense on web, if enabled) may receive device identifiers (for example the Android Advertising ID or an app-level identifier on iOS), IP address, user agent, approximate location (for example country), app and placement identifiers, and ad performance signals, which Google uses to serve and measure ads and to prevent fraud. We do not request App Tracking Transparency permission on iOS and do not use your data for personalized or cross-app targeted advertising. Users known to be under 18 are not treated as an audience for targeted advertising (see §11).

Sale / sharing. We do not sell personal information for money. Because VaultsHive shows non-personalized ads only, we do not share personal information for cross-context behavioral advertising under the CCPA/CPRA. See §8.1 and §10.2. We do not sell your private User Content.

Android AD_ID. The Android app includes the Advertising ID permission both for AdMob and because Google Play Billing and related Play libraries may declare it.

2.9 Trust and safety processing (automated and manual)

VaultsHive may use automated analysis of User Content and derived metadata to detect abuse, enforce policies, and prioritize human review, including:

• CLIP-style embeddings or similar signals for internal triage
• OCR or keyword cues for admin review queues
• Manual review by authorized personnel when investigating reports

Automated signals may not be the sole basis for account-level enforcement; human review may apply depending on the product workflow.

2.10 Legal and compliance

• Records required for tax, accounting, billing disputes, or regulatory obligations
• Preservation of information subject to legal holds or lawful requests

2.11 Device contacts (optional)

If you allow Contacts permission on iOS or Android, VaultsHive uses it only when you choose to search your contacts to add people to a vault or a Collaboration Group. The app searches your device contacts on your phone and sends only the last seven digits of the matching phone numbers to our servers to find people who already have a Hive account. We do not upload or store your contact list or those partial numbers.

When you add a registered user from the results, we store that person as a member of the vault or group (their Hive account ID and the phone number on their account) so sharing works. You can remove members at any time, and you can decline or later withdraw Contacts permission in system settings — searching by phone number still works without it. VaultsHive never writes to or changes your device contacts.

3. How we use personal information

We use personal information to:

1. Provide and operate the Service (hosting, Hive authentication including email/password and Sign in with Google / Apple, vaults, sharing, collaboration, Local preview, Hive Search, reminders, push and email notifications)
2. Process payments and grant analysis credits (via Stripe on the web and/or Apple / Google Play in-app purchases where offered; see §2.5)
3. Communicate with you (service-related email from [email protected], SMS, and push when permitted; marketing only if you opt in where required)
4. Verify phone numbers and protect accounts (via Twilio or similar)
5. Deliver AI features — Local preview on our infrastructure; Public AI Analyze and Hive Help via OpenAI (or comparable) only as described in §2.3 (you control what goes to a public LLM)
6. Maintain security (fraud prevention, abuse detection, session limits, rate limits, logging)
7. Enforce our Terms, including moderation and compliance strikes
8. Comply with law and respond to lawful requests
9. Improve the Service (analytics, debugging, product development), consistent with applicable law and your choices
10. Show ads on Free Vault / when the ads-free window is not in effect, as described in §2.8

4. Legal bases (EEA, UK, and similar jurisdictions)

Where GDPR or similar laws apply, we rely on one or more of the following:

• Contract: processing necessary to provide the Service you request
• Legitimate interests: security, fraud prevention, product improvement, moderation, and analytics (balanced against your rights)
• Legal obligation: compliance with law
• Consent: where required (for example, certain cookies or marketing, or Public AI Analyze / optional features where we ask explicitly)

You may withdraw consent where processing is consent-based, without affecting processing prior to withdrawal.

5. How we share personal information

We do not sell personal information for money. We do share information with service providers and, when Free VaultsHive shows ads, with Google AdMob / AdSense as described in §2.8 (non-personalized ads only, which is not “sharing” for cross-context behavioral advertising under the CCPA/CPRA). We do not sell your private User Content. When you run Public AI Analyze (or Hive Help prompts), we share the analysis inputs or prompt text with the AI vendor as described in §2.3.

5.1 Service providers (subprocessors)

We use third parties that process personal information on our behalf or receive it to deliver the Service, including:

We may update our list of service providers from time to time. Material changes will be reflected in this Policy (including the Last updated date at the top of this document). Links to each provider’s privacy policy are available on their official websites.

5.2 Legal and safety

We may disclose information if we good-faith believe it is necessary to:

• Comply with law, regulation, legal process, or government requests
• Protect safety, rights, or property of VaultsHive, users, or the public
• Detect, prevent, or address fraud, security, or technical abuse
• Enforce our Terms or policies

This may include CSAM reporting or preservation where applicable law requires.

5.3 Business transfers

If VaultsHive / HiveApp Technologies LLC is involved in a merger, acquisition, financing, or sale of assets, information may be transferred as part of that transaction. We will require the successor to honor this Policy or notify you of changes.

6. International transfers

VaultsHive’s operator is based in Texas, United States. We currently process and store personal information in the United States in systems operated by us or our service providers. VaultsHive does not commit to EU-only or other single-jurisdiction residency unless we explicitly offer a specific product or region in the future.

Where personal information is transferred across borders and required by law (for example, EEA/UK), we implement appropriate safeguards such as Standard Contractual Clauses or equivalent mechanisms when applicable.

7. Data retention

We aim to minimize retention and delete personal information when it is no longer needed for the purposes described in this Policy, consistent with legal, safety, and legitimate business requirements. In practice, we retain information as long as needed to provide the Service and for those purposes, including:

• Account records and credentials — While your Hive account is active or suspended (deactivated) in-product, we retain identifiers and authentication-related data (for example, hashed passwords and OAuth provider subject IDs) needed to operate the Hive identity. Suspension is per app only: you can suspend VaultsHive and still use AlbumHive or LooksHive (and the reverse). Hive storage stays available so the other apps can keep working. AlbumHive share-link entitlements stay with the Hive storage plan. Suspension is not Hive-wide deletion. Unused analysis credits are not refunded on suspend.
• Voluntary complete account deletion — After you follow the in-product Delete account flow in AlbumHive, VaultsHive, or LooksHive (including the acknowledgement checkbox described in our Terms of Service), deletion is immediate and Hive-wide: it removes the single Hive identity and cascades deletion of your data in AlbumHive, VaultsHive, and LooksHive (where used). SlamHive is not deleted. Deletion removes your vaults, artifacts, share links, groups, reminders, analysis results, credits (forfeited, non-refundable), OAuth links, and push tokens, and removes your membership from vaults and groups where you were a contributor or invitee. Files you contributed to another user’s vault may remain; attribution may show as “Unknown.” You are responsible for cancelling recurring billing in Stripe, Google Play, and the Apple App Store; any cancel we attempt is best effort only and does not stop Apple (and may not stop Stripe or Play). VaultsHive credit packs are one-time; there is typically no VaultsHive monthly subscription to cancel, but AlbumHive storage or other Hive store items may still bill you if you do not cancel them. Deletion may take time to propagate and may be subject to technical or backup retention for a limited period, and we may retain certain records where law, safety, or legal process requires (for example, abuse reports, billing, or tax records).
• Analysis credits — One wallet. A new paid pack adds credits and sets one expiry for the entire remaining balance (purchase time + 365 days). Older leftovers ride the new date. When that date hits, the wallet goes to 0. The date shown in-product is that single wallet expiry, not a per-lot FIFO clock. Free-trial credits expire 12 months after grant if you never buy a pack.
• Push tokens — Retained while the device is registered; removed on logout, token rotation, permission withdrawal, or account deletion
• User Content — You may be able to delete or remove certain User Content through in-product controls where available. Removed items may persist in technical or backup systems for a limited period (typically short-term rolling deletion). VaultsHive is not a backup service.
• Billing records for periods required by tax and accounting law
• Stripe webhook logs or similar operational records for fraud and reconciliation for a limited period
• Report and moderation records as needed to investigate, audit, and defend claims, subject to law
• Expired share link metadata may be deleted after extended periods (for example, after one year in expired state in some cases) per system hygiene

In-app notifications may be purged after a limited period (for example, 90 days, where implemented).

8. Cookies and similar technologies

We use cookies, local storage, and similar technologies on web surfaces, for example to:

• Keep you signed in
• Remember preferences
• Secure public forms (e.g., CAPTCHA)
• Measure performance and usage (if enabled)

Where required by law, we will obtain consent before non-essential cookies.

8.1 Global Privacy Control and Do Not Track

We honor Global Privacy Control (GPC) signals where required by law. Depending on jurisdiction and product surface (for example, web browsers that send a valid GPC signal), we apply GPC in line with applicable rules (including, where applicable, California requirements to treat GPC as an opt-out of sale or sharing for cross-context behavioral advertising, to the extent those concepts apply to our processing).

Do Not Track (DNT). The legacy Do Not Track browser setting is not consistently standardized across browsers and services. We do not guarantee a specific response to DNT signals alone; where you seek to exercise opt-out rights that GPC can signal under applicable law, we prioritize recognized mechanisms such as GPC as described above.

9. Security

We implement technical and organizational measures appropriate to the risk, including:

• Encryption in transit (for example, TLS/HTTPS) between clients and our services
• Access controls and authentication for administrative systems
• Presigned URLs or equivalent time-limited access to stored objects where designed for private files
• Server-side encryption for object storage and databases as provided by our vendors (for example, Cloudflare R2, MongoDB Atlas)

No method of transmission or storage is 100% secure. You use the Service at your own risk. Sending content to a public LLM has additional residual risk described in §2.3.

Breach notification. In the event of a data breach, we will notify affected users and regulators as required by applicable law.

10. Your rights and choices

Depending on your location, you may have rights to:

• Access personal information we hold about you
• Correct inaccurate information
• Delete certain information (subject to exceptions)
• Export or port information in a machine-readable format
• Object or restrict certain processing
• Withdraw consent where processing is consent-based
• Opt out of sale or sharing for cross-context behavioral advertising (CCPA/CPRA concepts) if applicable

Data export and portability. We provide data exports in a structured, commonly used format where feasible, consistent with applicable law, technical limits, and security review. To request an export, contact [email protected].

Account deletion and erasure requests: Depending on your jurisdiction, you may have a right to delete or erase certain personal information. VaultsHive provides self-service complete account deletion for eligible accounts through the in-product flow described in §7 and the Terms of Service. That wipe is Hive-wide (AlbumHive, VaultsHive, LooksHive). Suspend is different: it is per app and keeps Hive storage for the other apps. You must cancel Stripe, Google Play, and App Store subscriptions yourself; our billing cancel is best effort. Unused credits are forfeited. Accounts subject to compliance suspension or other restrictions may require support review.

How to exercise: Contact [email protected]. We may need to verify your identity before responding. You may appeal a decision where applicable law requires.

Authorized agents: Some jurisdictions allow authorized agents to submit requests; we may require proof of authorization.

10.1 EEA/UK rights

If you are in the EEA or UK, you may lodge a complaint with your local supervisory authority (for example, a Data Protection Authority).

10.2 California residents (CCPA/CPRA summary)

If you are a California resident, you may have additional rights under the CCPA/CPRA, including:

• Right to know categories and specific pieces of personal information collected
• Right to delete personal information
• Right to correct inaccurate personal information
• Right to opt out of sale or sharing of personal information — we do not sell personal information for money; Free VaultsHive shows non-personalized AdMob / AdSense ads only and does not share personal information for cross-context behavioral advertising (see §2.8); we do not use or disclose sensitive personal information for targeted advertising to known minors as described in §11; Global Privacy Control (GPC) is addressed in §8.1

Sensitive personal information: We use sensitive personal information only as permitted by law and as described in this Policy. You decide whether a document that contains sensitive data is uploaded or sent to a public LLM.

Non-discrimination: We will not discriminate against you for exercising CCPA rights.

11. Children and teens

The Service is not directed to children under 13, and we do not knowingly collect personal information from children under 13 without verifiable parental consent where the law requires it.

Age brackets. For minors who use the Service where permitted by law, we may categorize protections by age band—for example Children (under 13), Young Teens (13–15), and Older Teens (16–17)—to apply privacy protections required in California, Utah, the EU, and other jurisdictions as they apply to our Service.

Practices for users under 18. For users known to be under 18, we do not engage in targeted advertising, profiling for solely automated decision-making that produces legal or similarly significant effects, or the sale of personal information without the opt-in consent required by law.

Data minimization for minors. We collect only the minimum personal information needed to provide the Service. We do not collect precise geolocation from known minors unless strictly necessary to provide the Service and with appropriate consent under applicable law.

Account registration is subject to the age and consent rules in our Terms of Service. If you believe we have collected information from a child in violation of this Policy, contact [email protected].

12. Automated decision-making

VaultsHive may use automated analysis of User Content and metadata for safety, search, Local preview, and internal triage. Public AI Analyze uses a third-party model under the limitations in §2.3; it is not used to make solely automated legal decisions about your account. Automated outputs may be incorrect; do not rely on them as definitive determinations of lawfulness, medical, legal, or financial facts.

Where solely automated decisions with legal or similarly significant effects are restricted in your jurisdiction, VaultsHive will comply with applicable requirements.

Your rights. You may request human review of decisions affecting your account (for example, enforcement or access decisions). Contact [email protected].

13. Third-party links and viewers

The Service may include links to third-party sites or allow viewers to access shared vaults without a VaultsHive account. Those third parties have their own privacy practices. VaultsHive is not responsible for third-party sites.

14. Changes to this Policy

We may update this Policy by posting a revised version and updating the “Last updated” date. For material changes, we will provide additional notice where required by law (for example, email or in-app notice).

15. Contact

Privacy questions, general support, and data rights requests: [email protected]
Abuse reporting (trust and safety): [email protected]
Copyright / DMCA: [email protected] (see the Terms of Service — §10.3)
Do not reply to automated mail from [email protected] — that mailbox is not monitored.

Legal notices

Operator: HiveApp Technologies LLC — 11639 Creek Point Drive, Frisco, TX 75035, United States.

© 2026 HiveApp Technologies LLC. All rights reserved. VaultsHive is a trademark of HiveApp Technologies LLC.

Document version 1.0 — Effective September 21, 2026 (Hive identity; OAuth; AdMob ads window; push; public LLM under user control; one-wallet 12-month credit expiry; user-owned store cancels; mailboxes; non-personalized ads only, no ATT; device contacts §2.11 — updated September 29, 2026)