Privacy policy

In short

• Your notes and files are stored in Frankfurt. We only use them to run WhyVault for you – not for advertising, not to train AI models, and we don't sell them.
• An AI assistant only receives content when you connect it and it fetches that content. That content is then subject to its provider's privacy terms.
• The Pro subscription is sold by Link (Stripe). We never see card or bank details.
• No advertising or tracking cookies, no profiling, no sharing with data brokers.
• You can export everything at any time and delete your account yourself.

Controller

The controller for processing your data on whyvault.io, app.whyvault.io and mcp.whyvault.io is:

Represented by its managing director Kilian Wimmer. Email: post@ohrlaf.com · Questions about WhyVault and privacy: hello@whyvault.io

We are not required to appoint a data protection officer (Art. 37 GDPR, § 38 BDSG). For any privacy question, simply write to the address above.

Visiting the website and the app

When you open whyvault.io or the app, our host Vercel processes technically necessary data: IP address, time, requested address, amount of data transferred, referrer, browser and operating system. This is needed to deliver the pages, find errors and fend off attacks. Vercel keeps server logs for us for one day.

For visitor statistics we use Vercel Web Analytics. It sets no third-party cookies and stores no IP addresses. Visits are counted via a hash of the request that is discarded after 24 hours; we only see aggregated numbers, such as which pages are viewed how often.

We serve fonts and graphics ourselves. Opening our pages does not send data to font or advertising services.

The legal basis is our legitimate interest in a secure, working and continuously improved website (Art. 6(1)(f) GDPR).

Account and sign-in

For your account we store your email address, a display name (optional), your language, timestamps such as registration and last sign-in and – if you set one – a password, only as a hash. We email you sign-in links and sign-in codes. Sign-in runs on Supabase Auth; account and sign-in data are stored with Supabase in Frankfurt. Supabase keeps sign-in logs with IP addresses for one day.

When you set a password, we check whether it appears in known data breaches. We only send the first five characters of its SHA-1 hash to the “Have I Been Pwned” service and compare the response on our side – the password itself and anything that identifies you never leave our servers.

If your password, email address or a sign-in method changes, we send you a security notification.

The legal basis is our contract with you (Art. 6(1)(b) GDPR); the breach check and security notifications rely on our legitimate interest in protecting your account (Art. 6(1)(f) GDPR). We can't create an account without an email address.

Abuse protection (captcha)

We protect the sign-in and sign-up forms against automated access, such as mass sign-in emails, with Cloudflare Turnstile. Turnstile checks in the background whether a human is using the form; usually you won't notice, sometimes a checkbox appears.

Cloudflare processes your IP address, technical characteristics of your browser and connection (e.g. user agent, TLS characteristics) and the page the form is embedded in. Cloudflare acts on our behalf; it also uses the resulting signals under its own responsibility to improve bot detection. Details: https://www.cloudflare.com/turnstile-privacy-policy/

The legal basis is our legitimate interest in protecting WhyVault and your email address from abuse (Art. 6(1)(f) GDPR). Where Turnstile reads or stores information in your browser for this, it is strictly necessary for the service you requested (§ 25(2) no. 2 TDDDG).

Content of your vault

We store what you put into WhyVault: notes, folders, folder colours, files (attachments) and links between notes. For every change we store a version and a history entry – with the time, a short description and whether the change came from you or a connected assistant. Everything is stored with Supabase in Frankfurt, encrypted at rest (AES-256) and only transferred encrypted.

Deleted notes go to the trash, from which you can restore them. The trash and older versions are kept until you delete your account. If you want individual notes and all their versions deleted permanently before that, write to us – we'll do it right away.

We only use your content to run WhyVault for you. We only look at it if you ask us to (e.g. in support), if we are legally required to, or if it's necessary to fend off specific abuse or a malfunction. We don't run AI models over your content and don't use it for training.

If your notes contain personal data of other people, you decide what you store; we only process that data to keep it available for you. If you use WhyVault professionally, we conclude a data processing agreement with you (see “Data processing agreement” in the footer).

The legal basis is our contract with you (Art. 6(1)(b) GDPR).

Connected AI assistants (MCP)

You can connect AI assistants to your vault via the Model Context Protocol – by signing in (OAuth, e.g. Claude or ChatGPT) or with a personal access token (e.g. Claude Code or Cursor). For each connection we store its name, type, permissions (access tokens: read only or read and write; OAuth connections: read and write), and when it was created, last used and, if applicable, revoked. We store access tokens only as a hash plus a short prefix so you can recognise them.

A connected assistant reads and writes notes when you ask it to. What it fetches goes to the assistant's provider (e.g. Anthropic, OpenAI or Anysphere). The provider processes that content under its own responsibility and terms; we have no influence on that. So only connect assistants you want to entrust with this content, and grant read-only access when in doubt.

If a connection writes unusually much in a short time (more than 30 changes per minute), we temporarily reject further changes. Every change by an assistant appears in your history with its name and can be undone.

The legal basis is our contract with you (Art. 6(1)(b) GDPR) and our legitimate interest in protecting your vault from abuse (Art. 6(1)(f) GDPR).

Payment (Pro)

We sell the Pro subscription through Stripe Managed Payments. The seller is Link, a Stripe service; Link issues invoices, collects payments and handles refunds. Link and Stripe process your payment and billing data (such as name, address, payment method, invoices, tax details) as independent controllers under their privacy policy: https://stripe.com/privacy

From Stripe we only receive what we need for your subscription: a customer ID, the subscription ID, status, plan and billing interval, the end of the current period and whether a cancellation is scheduled. We never see card or bank details.

The legal basis is our contract with you (Art. 6(1)(b) GDPR). Records we need for our accounting are kept for the statutory periods (Art. 6(1)(c) GDPR with § 147 AO, § 257 HGB).

Emails

We send sign-in links, confirmations, security notifications and account emails via Plunk. For this we create a contact for you in Plunk – with email address, language, plan (Free or Pro) and your registration date. Plunk stores data in the EU (Hetzner, Germany) and delivers emails via Amazon SES; on the way to the recipient emails may pass servers outside the EU. Plunk keeps logs with IP addresses for 30 days. The legal basis for account emails is our contract with you (Art. 6(1)(b) GDPR).

We only send news (new features, tips) if you expressly agree – after sign-up or in your profile. We store whether and when you agreed, as proof. You can withdraw your consent at any time with effect for the future: in your profile under “News by email” or via the unsubscribe link in every such email; an unsubscribe via the link is reflected in your profile by the next day at the latest. The legal basis is your consent (Art. 6(1)(a) GDPR). You receive account emails regardless.

Feedback and support

If you send us feedback via the button in the app, we store the type (idea, problem, praise), your text, the page you were on and the time; the email to us also contains your email address, plan and language so we can reply. If you email us, we process your message and contact details to answer your request. Our mailbox runs on Google Workspace.

The legal basis is our contract with you or steps prior to a contract (Art. 6(1)(b) GDPR) and otherwise our legitimate interest in answering requests and improving WhyVault (Art. 6(1)(f) GDPR).

Cookies and local storage

We don't use advertising or tracking cookies. When you sign in to the app, we set session cookies to keep you signed in. In your browser we also store display settings: the colour scheme (light or dark), expanded folders, whether the history column is shown and – for the current session only – focus mode. These settings never leave your device. Turnstile (see “Abuse protection”) may also store information in your browser for its check.

All of this is strictly necessary for the features you expressly use (§ 25(2) no. 2 TDDDG). No consent is required, which is why there is no cookie banner.

Service providers and recipients

We work with a small number of carefully selected providers. We have data processing agreements (Art. 28 GDPR) with all processors; they may only process your data on our instructions.

• Supabase

  DPA

  Purpose

  Database, file storage and sign-in (hosting your notes and account)

  Provider and location

  Supabase Pte. Ltd., 65 Chulia Street #38-02/03, Singapore 049513; data is stored in Frankfurt (AWS eu-central-1). Transfers based on the EU Standard Contractual Clauses.

  Role

  Processor

• Vercel

  DPA

  Purpose

  Hosting of website and app, server functions, visitor statistics

  Provider and location

  Vercel Inc., 440 N Barranca Ave, Suite 4133, Covina, CA 91723, USA; server functions in Frankfurt (fra1), delivery via a global network (CDN). Certified under the EU-US Data Privacy Framework, plus EU Standard Contractual Clauses.

  Role

  Processor

• Plunk

  DPA

  Purpose

  Sending sign-in links, account emails and – with consent – news

  Provider and location

  Storage in the EU (Hetzner, Germany); delivery via Amazon SES, which may pass servers outside the EU in transit only (EU Standard Contractual Clauses).

  Role

  Processor

• Google Workspace

  DPA

  Purpose

  Our mailbox hello@whyvault.io – support and feedback

  Provider and location

  Google Cloud EMEA Limited, 70 Sir John Rogerson's Quay, Dublin 2, Ireland; parent Google LLC (USA) is certified under the EU-US Data Privacy Framework.

  Role

  Processor

• Cloudflare Turnstile

  Turnstile privacy

  Purpose

  Protecting sign-in and sign-up from automated access (captcha)

  Provider and location

  Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA; certified under the EU-US Data Privacy Framework.

  Role

  Processor; independent controller for improving bot detection

• Stripe (Link)

  Privacy policy

  Purpose

  Selling and billing the Pro subscription (Stripe Managed Payments, seller: Link)

  Provider and location

  For consumers in the EU: Stripe Technology Company Limited, Ireland, and “Sold through Link, LLC”; Stripe is certified under the EU-US Data Privacy Framework.

  Role

  Independent controller

• Have I Been Pwned

  Privacy

  Purpose

  Checking whether a new password appears in known data breaches – only the first five characters of its SHA-1 hash, no personal data

  Provider and location

  Superlative Enterprises Pty Ltd, Australia; served via Cloudflare.

  Role

  Recipient of non-personal data

Data may also go to authorities if we are legally required to, and – if necessary – to advisers bound by confidentiality (e.g. tax advisers, lawyers).

Transfers to third countries

Your notes and account are stored in Frankfurt. Some providers are based outside the EU (Singapore, USA, Australia) or may access data from there, for example for maintenance and support. We only transfer data there if the requirements of Art. 44 et seq. GDPR are met:

• USA: Vercel, Cloudflare, Google and Stripe are certified under the EU-US Data Privacy Framework; the European Commission's adequacy decision applies to them (Art. 45 GDPR). Where the providers offer them, EU Standard Contractual Clauses are agreed in addition.
• Singapore (Supabase) and the transit path via Amazon SES (Plunk): EU Standard Contractual Clauses (Art. 46(2)(c) GDPR).
• Australia (Have I Been Pwned): no personal data is transferred, only a fragment of a hash.

You can get a copy of the relevant safeguards on request at hello@whyvault.io.

How long we keep data

We only keep data as long as we need it for the respective purpose or are legally required to:

• Account, vault (notes, versions, trash, files), connections and feedback: until you delete your account.
• Server logs at Vercel and sign-in logs at Supabase: one day; delivery logs at Plunk: 30 days.
• Database backups, where our database provider creates them: overwritten after 7 days at the latest; until then deleted data may still be contained in them.
• Consent to news: as long as it applies and afterwards as long as we must be able to prove it (up to three years).
• Emails and feedback to us: until the request is resolved, then at most two years where we need them for traceability.
• Accounting records: six or eight years (§ 147 AO, § 257 HGB); Link/Stripe keeps invoices for the Pro subscription under its own legal obligations.

When you delete your account (Profile → “Delete account”), we end a running Pro subscription and immediately delete your account, your vault with all versions and files, your connections and your feedback; we remove your contact at Plunk after sending the confirmation. Data we must keep for legal reasons is restricted until the period expires.

Security

We protect your data with technical and organisational measures under Art. 32 GDPR, including:

• Encryption in transit (TLS, HSTS) and at rest (AES-256).
• Strict separation of vaults in the database (row level security): every request only sees the data of its own account. Automated tests verify this separation with every change.
• Access tokens and passwords only as hashes; writes only through vetted database functions with versioning and history.
• Abuse protection through a captcha, limits on writes, uploads and emails, and a strict content security policy.
• Access to production systems only by the managing director.

If you find a security issue, please write to us at hello@whyvault.io.

Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20) – for the latter you can export your vault yourself at any time as a zip of Markdown files. You can withdraw consent at any time with effect for the future (Art. 7(3)).

Right to object: where we process data based on our legitimate interest (Art. 6(1)(f) GDPR), you can object at any time on grounds relating to your particular situation (Art. 21 GDPR). We then stop processing unless we can demonstrate compelling legitimate grounds or need the data to establish, exercise or defend legal claims.

Just write to us at hello@whyvault.io or post@ohrlaf.com. We reply within one month, usually much sooner.

You can also lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), for example where you live. The authority responsible for us is the Bavarian Data Protection Authority (BayLDA), Promenade 18, 91522 Ansbach, Germany, https://www.lda.bayern.de

Obligation to provide data and automated decisions

We need your email address for an account; everything else is optional. Without an email address we can't offer you WhyVault.

We make no automated decisions within the meaning of Art. 22 GDPR and create no profiles.

Changes

We update this privacy policy when WhyVault, our providers or the law change. The version published here applies; we inform you about material changes by email.