Cookie Policy

1. What this covers

This policy explains how vvault uses cookies and similar technologies — local storage, pixels and web beacons — on vvault.app, on the public pages we serve, and in the emails sent through vvault. Read it alongside our Privacy Policy, which explains what we do with personal data generally.

vvault is operated from Belgium by Tom Nsengiyumva (sole proprietor), company number BE 1022.549.155. Questions: vvaultapp@gmail.com.

2. What these technologies are

Cookies are small text files a site stores on your device so it can recognise your browser between requests — to keep you signed in, to remember a preference, or to count a visit.

Local storage does the same job with more room and lives outside the cookie jar. We use it for things like your theme and interface preferences.

Pixels and web beacons are tiny invisible images or requests embedded in a page or an email. Loading one tells the sender that the page was opened or the content was viewed.

This page calls all of them “cookies” for short.

3. We ask first

Under EU law we must have your consent before placing anything that is not strictly necessary. So on your first visit nothing but essential cookies is set: analytics and marketing stay switched off until you choose in the banner.

That is enforced technically, not just described here. Google Consent Mode is initialised with every consent signal set to denied before any measurement SDK loads, so a tag that fires early has nothing to work with. If you never answer the banner, the non-essential categories stay off.

4. The three categories

Essential. Signing you in and keeping you signed in, remembering your language and theme, routing you to the right region, securing forms and preventing abuse. These cannot be switched off, because without them the product does not work. We do not use them to build a profile of you.

Analytics, only with your consent. Google Analytics 4 and Vercel Analytics, so we can see which pages are used, where things break, and how quickly they load. Used to run and improve the product, not to target you.

Marketing, only with your consent. The Meta Pixel and Meta's Conversions API, so we can measure whether our advertising actually brings anyone here.

5. What goes to Meta if you accept marketing

We would rather state this plainly than bury it. If you accept marketing cookies, we send Meta events about actions you take on our marketing pages. Alongside the event we send a hashed version of your email address, a hashed user identifier, your IP address and your user agent — the last two are visible to Meta as they are.

Hashing means Meta does not receive your email in readable form, and it is not reversible in practice. It is still a sharing of personal data with an advertising platform, and it happens only because you consented. Decline marketing cookies, or withdraw consent later, and it stops.

This runs on our marketing and landing pages. Your library, your tracks and what you do inside the app are not part of it.

6. Emails

Emails we send you, and campaigns you send through vvault, can contain a beacon that reports when the message was opened and which links were clicked. That is what produces the engagement figures in your analytics.

It depends on images loading, so the numbers are approximate — many mail clients block or pre-load images, which under-counts some opens and over-counts others. If you would rather not be measured, turn images off in your mail client.

If you send campaigns through vvault, you are the sender of those emails and responsible for the lawful basis to contact each recipient. See the Terms of Use.

7. How to change your mind

Use the cookie settings link in the banner or in the site footer. Your choice is remembered per browser and per device, so you will be asked again on a new one.

You can also clear or block cookies in your browser settings; most browsers let you remove existing cookies and refuse new ones. Blocking essential cookies will break sign-in and other core features. Privacy-focused browsers and content blockers work here as they do anywhere.

Withdrawing consent stops future collection. It does not undo measurement that already happened, though you can ask us to delete data we hold about you — see Your rights in the Privacy Policy.

8. Do Not Track

Some browsers send a “Do Not Track” signal. There has never been an agreed standard for what a site must do in response, so we do not act on it. The cookie banner is the control we do act on, and declining there is honoured.

9. Changes

If we change which cookies we use, we update this page and the date at the top, and where the change is material we ask for consent again rather than relying on an answer you gave about something else.