← Back to Couple Vault

Privacy Policy

Effective date: 7 November 2026 · Version 0.13.0 (accounts + encrypted cross-device sync by default; local-only build as the alternative). Changed since 0.12.10: Couple Vault now also comes as an iPhone app. We describe what the app keeps in the iPhone Keychain, the Apple push notification service, and purchases through Apple (sections 2, 3, 4a and 5), and we point to the support page (section 10). Changed in 0.12.10: we say plainly that the app's code comes from our server, and what that means for "we cannot read it" (section 3). The sign-in text step now runs a person check from Cloudflare Turnstile before we send a code (section 4a). We count, with no information about who you are, how many visits reach the front page, start sign-up and finish it (section 2). Changed in 0.12.9: after you connect with your partner, you can ask to be told when your partner changes something you share. If you turn it on, we store this device's push subscription, and our server sends one fixed sentence, with no content, through the push service of your browser (sections 2 and 4a). Changed in 0.12.8: you can buy Couple Vault Plus. Stripe processes the payment as our payment processor, and our server keeps a record of your plan and of each payment event, with amounts but no card details (sections 2 and 4a). Changed in 0.12.7: in the cloud build you can choose Couple Vault (hosted) as the place for your private documents. Then we store the encrypted file on our sync server, and we still cannot read it (section 4). Also, the app now pads every record and file to a size range before it encrypts it, so the sizes we store are ranges, not exact sizes (section 2).

1. Who we are

Couple Vault is operated by Venture Returns LLC, a Missouri limited liability company ("we", "us", "our"). Venture Returns LLC is the provider of the Couple Vault app and, for the purposes of the GDPR and similar laws, the data controller that determines the purposes and means of any processing of personal data through the app. In the build we publish, cloud sync is on: we run an account service and a sync server, and as described below your vault content is encrypted on your device before it reaches them, so we hold it but cannot read it. In a local-only build there is no account and no sync, and we process no personal data through the app at all. Couple Vault provides a tool for two people to organize shared life and store sensitive information. This policy explains what we do, and don't do, with data. It is written to meet the expectations of the GDPR, the ePrivacy Directive, the CCPA/CPRA, and the broader US state-privacy landscape, built to the strictest common denominator.

2. What data we process

• Content you create (places, lists, calendar events, dates, gift ideas, vault secrets, links between them): stored in your browser via IndexedDB on the device you use, and encrypted on your device before it is persisted. In the cloud build, a copy is also sent to our sync server so it reaches your other device and your partner; that copy is ciphertext under keys the server never holds, so we cannot read your content, but we do store it along with the technical metadata needed to sync it (record identifiers, version numbers, timestamps, sizes (padded on your device to a size range, so we see the range and not the exact size), which account first created a record, which accounts have edited it, and whether a record is private to one partner rather than shared). We store that last one so the server can refuse to hand a private record to your partner at all, rather than relying only on encryption to keep it from them. In a local-only build this content never leaves your device.
• Documents you upload (e.g. insurance policies, IDs): the file is encrypted on your device with AES-256-GCM before it is stored, so storage only ever holds ciphertext. We extract a short summary from the document on your device (including running OCR on scans locally), so the text of your documents is never sent anywhere. A private document's file stays in the storage you choose (this device by default, your own Google Drive, or, in the cloud build, our sync server if you choose Couple Vault (hosted); see section 4). In the cloud build, once you have connected with your partner, a document you share is also sent to our sync server so your partner's phone can open it. It is encrypted on your device, under the shared key described in section 3, before it is sent, so we store the file but cannot read it. We also store its size (padded to a size range) and which account uploaded it. A shared file can be up to 8 MB. The encrypted details of every document sync like everything else.
• Account data (the cloud build requires an account; a local-only build has none): we process your phone number (verified by SMS) and an optional backup email, an account identifier, and the fact that your account is linked to your partner's. In the cloud build we also hold the second-factor material it manages: a salted hash of your password (never the password itself) and device-trust tokens. Our servers keep ordinary security logs, including your full IP address, to prevent abuse, and the security events on your own account (sign-ins, password changes, device removals) are visible to you in the app.
• Billing data (only if you buy Plus on the web, in the cloud build): you pay on the checkout page of our payment processor, Stripe. Stripe collects your card details, billing email and country, and we never receive your card number. Our server keeps: your plan, its status and renewal date, which account pays for it, and the Stripe customer and subscription identifiers; and a ledger of each payment event Stripe tells us about (the event type, the amount in cents, the currency and the date). We use this only to give you the plan you paid for and to keep the accounting records the law requires. If you delete your account, we delete your plan record and the identifiers that join the ledger to your account, and we cancel a plan you pay for; the ledger amounts and Stripe's own event identifiers stay as our accounting record. Stripe keeps its records under its own legal duties.
• Notifications when the app is closed (optional, off by default, only in the cloud build after you connect with your partner): if you turn on Tell me when my partner changes something (Us), your browser gives us a push subscription for this device: an address on your browser maker's push service and two keys that let us encrypt a message to this device. We store it against your account, with which sign-in added it, when, and when we last sent to it. When your partner saves a change to something you share, our server sends this device one fixed sentence, "Your partner updated your shared space.", at most once every 10 minutes. It never says what changed, it never names an item, and a change to something private never sends one. Turning it off, signing out and deleting your account each delete the subscription from our server. In the iPhone app, the same control asks for the iPhone's permission, and then we store a device token from the Apple Push Notification service (APNs) in place of a browser subscription. We use it the same way and delete it on the same events. The message is the same fixed sentence.
• The iPhone app: purchases (only if you buy Plus in the iPhone app): you pay through Apple, with your Apple Account, and Apple's terms govern the payment. We never receive your card number or your Apple payment details. Apple tells our server about each purchase, renewal, refund and expiry. Our server keeps: your plan, its status and renewal date, which account pays for it, and the transaction identifiers Apple gives us, plus an identifier that we generate to link the purchase to your account; and a ledger of each event (the type, the amount, the currency and the date). We use this only to give you the plan you paid for and to keep the accounting records the law requires. A plan you buy on the web works in the iPhone app, and a plan you buy in the iPhone app works on the web, because both attach to the same account.
• The iPhone app: what it keeps in the iPhone Keychain. The app keeps these items in the iOS Keychain on this iPhone: your sign-in session, the device-trust token, the encryption key of your vault (unless your PIN or passphrase lock wraps it), and the secret that unlocks the pairing keys. The Keychain items are marked for this device only: they are not copied to iCloud Keychain or to another device, and they are available only after the iPhone has been unlocked once since it started. The app's other data stays in its on-device storage, sealed as described in section 3. We do not receive the Keychain items. The one exception is the sign-in session: our server issues it and verifies it on each request, as it does on the web.
• No tracking: no cookies for advertising or analytics, no pixels, no device fingerprinting, no location tracking, no "last seen", by design. Cookies: in the cloud build our authentication provider sets first-party session cookies (stytch_session, a session JWT, and part-way through signing in a short-lived intermediate token) that keep you signed in. They are strictly necessary to provide the service you asked for, are not used for advertising, analytics, or profiling, and are not shared, so no cookie-consent banner is required for them under the ePrivacy strictly-necessary exemption. A local-only build sets none. We use no other cookies. Other storage in your browser: in the cloud build the authentication provider's software also keeps its session and a cached copy of your account record (including your phone number) in this browser's local storage, and we keep a device-trust token there so a device you have already verified isn't asked for the second factor again. Signing out clears the provider's copy; the device-trust token is deliberately kept, so that signing in again on this device needs only the SMS code.
• Optional, local-only usage record: off by default. If you turn it on (Us → Product analytics), the app keeps a list of which features you open on your device only. It is never transmitted to us or to anyone: there is no server that receives it. Three things are worth stating plainly. First, the list includes what you did earlier in the same visit, from the moment you opened the app, because those entries are held in the page's memory until you decide and are written down only if you say yes. Second, each visit's entry point records how you arrived, meaning any campaign parameters in the link you followed and the address of the site that linked to you (the site's address only, never the page or anything after it), also held in memory until you agree. Third, it exists for you: you can read the whole list in the app, and it is included in your export. Turning it off erases it, including anything merely held in memory.
• Optional usage counts sent to us: off by default, separate from the record above, and only in the cloud build when you are signed in. If you turn it on (Us → Usage counts → Share usage counts with the Couple Vault team), the app sends our server a short note when you open the app (at most once a day), pair, file a quick capture, use Decide for us, save a place or add a list item. What is sent: the name of the action, the day (UTC), your role in a pairing, and for a quick capture which kind of item we suggested, which kind you chose and whether they differ. What is never sent: anything you write or save, names, item identifiers, the text you type, your location, the time of day or your IP address. We store each note against a keyed hash of your account identifier and of your couple's sync identifier, never the identifiers themselves, so the table alone does not say who you are; the hash lets us count couples where both partners use the app and delete your rows when you ask. We use it only to measure whether the pilot works (for example, how many couples use the app each week). We keep it for 400 days. Turning the switch off deletes what was sent, and so does deleting your account. Turning the record above on does not turn this on, and the reverse is also true.
• Anonymous sign-up counts: in the cloud build our server keeps three numbers per day: how many times the front page was opened, how many times someone started sign-up, and how many times someone finished it. Each is only a number. We store no account, device, cookie, IP address or anything else that could tell one visitor from another, so these counts are not tied to you and there is nothing of yours in them to delete. Your IP address is used for a moment, in memory only, to stop one network sending too many counts, and is not stored with them. We use the counts to see whether a change to the front page helps people sign up.

3. The two security tiers

We are deliberately honest about encryption and do not claim product-wide "zero-knowledge":

• Tier A · encrypted on your device (secrets, gift ideas, documents): encrypted at rest with a key generated on your device. That key never leaves your device, and it protects everything you keep private, including every gift idea, so your partner cannot open those items. When you connect with your partner, your two phones also create a second, shared key and exchange it directly between the two phones (you confirm a matching phrase to prove no one is in the middle), never through us. A secret or document you choose to share is encrypted under a key derived from that shared key, so your partner's phone can open it and our server cannot. Neither key ever reaches our server. If you stop sharing an item, it is encrypted again under the key only your device holds. If you set the optional PIN or passphrase app-lock, the key on your device is additionally wrapped with it; the PIN is never stored or sent anywhere, so it can't be reset remotely and if you forget it we can't recover it for you. A short numeric PIN mainly deters casual access; for a lost or seized device use a longer passphrase plus your device's full-disk encryption.
• Tier B · syncable (calendar, places, lists): encrypted on your device exactly like Tier A, so in the cloud build the server cannot read them either. The label marks the data we designed to be shareable with your other apps later (for example your existing calendar). If you ever turn such an integration on, that provider would be able to read what you share with it, and we will say so at the time. We label the tier on every item so the distinction is never hidden.

One limit you should know about. On the web, the app's code comes from our server each time it updates. The encryption above is real, and our server cannot read what it stores. But the code that holds your keys is code we send, so a version of the app that we published, or that someone who broke into our hosting published, could read your keys on your device. This is true of every web app that encrypts on your device. What we do about it: the app's code comes only from our own site, and the browser is told to refuse scripts from anywhere else, except the Cloudflare person check on the sign-in step (and Google's sign-in, only if you connect your own Drive). Changes to the app go through our own review and tests before we publish them. If this risk matters to you, keep your most sensitive items behind the PIN or passphrase lock. The iPhone app works differently on this point: its code is packaged inside the app you install from the App Store, and it changes only when you install an update from the App Store, not each time you open it.

4. Where documents are stored (your storage, your choice)

Documents are always encrypted on your device first; you choose where the ciphertext lives:

• This device (default): the encrypted files of your private documents stay in your browser's storage and never leave the device in either build; only their encrypted details sync.
• Our sync server, for shared documents (cloud build only, once you have connected with your partner): a document you share is stored there encrypted under your shared key, whichever option you chose above, because it is the one place your partner's phone can fetch it from. Your partner's phone keeps a copy once it has fetched it. The server copy is deleted when you stop sharing the document or delete it; if that attempt fails, the app tries again on a later sync while you stay connected. It is also deleted when you disconnect from your partner; if that fails, the app tells you, and deleting your account removes it. And it is deleted when you delete your account. Shared files can be up to 8 MB.
• Your Google Drive (optional, off by default): if the operator of your build has enabled it and you connect your Google account, encrypted blobs are stored in a hidden, app-private folder in your own Drive (the narrow drive.appdata scope, so we can see only the files this app creates, never the rest of your Drive). In this case Google acts as a storage processor and receives ciphertext it cannot read.
• Couple Vault (hosted) (optional, cloud build only, while you are signed in): the encrypted files of your private documents are stored on our sync server instead of this device. Each file is encrypted on your device under a key that stays on it, so we store it but cannot read it, and your partner's account cannot fetch it. We store its size (padded to a size range) and which account uploaded it. A file can be up to 8 MB, and your shared and hosted files together can use up to 256 MB. The server copy is deleted when you delete the document, and when you delete your account. A local-only build does not offer this option.

4a. Who else processes your data (sub-processors)

In the cloud build we use a small, fixed set of providers to run the account and the sync service. They act as our processors under our instructions, and none of them can read your vault contents. A local-only build uses none of them:

• Stytch · authentication. Receives and stores your phone number, optional backup email, and account identifier, and delivers your SMS/email one-time codes.
• Our sync server · a Replit-hosted relay over Postgres. Stores the encrypted vault records, the encrypted files of documents you share with your partner and of private documents you choose to keep there, couple membership, and ordinary server logs including IP addresses, plus the second-factor material it manages: a salted password hash (never your password) and device-trust tokens.
• Google · only if you connect your own Drive for document storage (see above).
• Apple · only for the iPhone app. Apple processes purchases of Plus made in the app, under its own terms and as the payment processor for those purchases. It also runs the Apple Push Notification service, which carries our notifications to your iPhone if you turn them on. Our server sends Apple the same fixed sentence and your device token. Apple learns that a notification went to your iPhone, when, and its size.
• Your browser's push service (Google for Chrome and Android, Mozilla for Firefox, Apple for Safari, Microsoft for Edge on Windows) · only if you turn on notifications in a browser. Our server sends it the fixed sentence, encrypted to your device, so the push service learns only that a notification went to your browser, when, and its size. Your browser chose this service; it is the only way a web app can reach a device whose app is closed.
• Cloudflare Turnstile · a person check on the sign-in text step, in the build we publish. Before we send you a code, your browser loads Cloudflare's check, which receives your IP address and signals from your browser to tell a person from a script, and gives our server a one-time pass. It exists because each text costs money and scripts send them in bulk. It is loaded only on that step, and not for advertising or tracking.
• Stripe · payment processing, only if you buy Plus on the web. Receives your card details, billing email and country on its own checkout page, and tells our server the result. The app itself loads nothing from Stripe; your browser goes to Stripe's page only when you choose a plan.

We will update this list before adding a processor, and we do not sell or share your personal information.

5. Your rights & how to exercise them

Your data is readable only on your devices, and you can take it or destroy it at any time:

• Access / export: all your data is visible in the app, and Us → Your data → Export everything downloads it in open formats (Markdown plus your decrypted files).
• Deletion: Us → Your data → Delete account performs real, immediate deletion. On the device it removes your data, removes any document copies from a connected cloud, disconnects that cloud, and destroys the on-device encryption key, so any encrypted copy that lingers anywhere becomes permanently unreadable (crypto-shredding). In the cloud build, it also erases your account on our servers: your couple membership, password verifier and device tokens, every shared document file you uploaded, any usage counts you chose to send, and your record with our authentication provider (including your phone number). Your partner keeps the shared records, and any copy of a shared file their phone had already fetched. Your couple's encrypted records are deleted once both partners have deleted; until then they remain because they are also your partner's data, and we will not destroy their vault on your request. If a server-side step fails (for example you are offline), the local destruction still completes and you can re-run it or contact us to confirm the erasure. One item is left behind in this browser: the device-trust token described above, filed under your account identifier. Erasing the account removes its counterpart on our server, so the leftover can no longer sign anyone in, but it is not itself wiped; clearing this site's data in your browser removes it. In the iPhone app, deleting the account also removes the app's Keychain items from this iPhone. Deleting your account does not cancel a subscription that you bought through Apple, because only you and Apple can do that: cancel it in Settings (your name, then Subscriptions) before you delete the account. Apple keeps its own purchase records under its own terms.
• Correction / objection / portability: you can edit anything in the app directly; for requests we must action ourselves, contact us (section 10) and we will respond within the statutory deadline (GDPR: one month; CCPA: 45 days).

6. Your California (CCPA/CPRA) rights

California residents (and, in substance, residents of other US states with similar laws) have the rights to know, delete, and correct personal information, to opt out of its sale or sharing, to limit the use of sensitive personal information, and to non-discrimination for exercising these rights.

What we collect. To run your account and sync in the cloud build we process: your phone number (and an optional backup email) held by our authentication provider; an account identifier; your couple membership (that two accounts are linked); the encrypted contents of your synced vault and the encrypted files of documents you share with your partner, together with the technical metadata needed to sync it (record identifiers, version numbers and timestamps, sizes, the account that first created a record, which accounts have edited it, and whether a record is private to one partner rather than shared) and server logs including your full IP address. In the cloud build we additionally hold a password verifier (a salted hash, never your password) and device-trust tokens. We cannot read your vault contents: they are encrypted on your device with keys we never receive. A local-only build collects none of the above.

We do not sell or share your personal information as those terms are defined by the CCPA/CPRA, and we do not use it for cross-context behavioural advertising, so there is no "Do Not Sell or Share My Personal Information" mechanism to offer. This is a statement about what we do with the data, not a claim that we collect none.

Exercising your rights. Export and local deletion work entirely on your device ("Export everything" and "Delete account" in Us → Your data). In the cloud build, "Delete account" also erases your account on our server: your membership, password verifier, device tokens, every shared document file you uploaded, and your account with our authentication provider (including the phone number) are deleted. Your couple's encrypted records are removed from the server once both partners have deleted. While your partner still has an account, their vault is their data and we will not delete it on one partner's request. For anything else, or to confirm an erasure, contact us at the address in section 10 and we will respond within the statutory deadline.

7. Children

Couple Vault is for adults (18+) and is not directed to children; you confirm you are 18 or older when you set up your vault.

8. Safety

Couple Vault is designed never to be a surveillance tool. There are no covert affordances: any sharing between partners is mutual, visible, and reversible, and each person's device shows only their own view. If you are in an unsafe relationship, please contact a local support service; in the US, the National Domestic Violence Hotline is 1-800-799-7233.

9. Changes

If our data practices change, we will update this policy, its version, and its effective date, and surface the change in the app before any new processing begins.

10. Contact

Questions, or to exercise a privacy right, contact the data controller. Help with the app, with deleting your account and with cancelling a subscription is on the support page.

© 2026 Venture Returns LLC. All rights reserved. Couple Vault is a trademark of Venture Returns LLC.

Support · Terms · Privacy · Accessibility