Privacy Policy

Who we are

Viharnika Enterprise LLP, Ahmedabad, Gujarat, India, operates BuzVault (the “app”). We are the data controller for the information described here. Contact us at help@buzvault.com .

The short version

We store the links you save and the little you tell us about yourself.
We do not sell your data and we do not share it for advertising.
There are no ads and no third-party analytics or tracking SDKs in the app or on our website.
Your vault is private by default. Nothing becomes public until you press Share.
You can delete everything, at any time, yourself — see Delete your account.

What we collect

If you create an account

Email address. Used to identify your account and to sign you in.
Password. Stored only as a one-way hash (bcrypt). We never store or see your actual password.
Google account identifier and email, if you use Google Sign-In. We store the verified Google subject ID (a number Google assigns you, not your password).
Display name and, if you signed in with Google, your Google profile photo URL.
@handle and bio — only if you choose to create a public profile.
Referral code and subscription tier.

Always, account or not

A device identifier we generate (a random ID), your platform (Android or iOS), and when the device was last seen. BuzVault works without an account, so this is how your saves stay yours.
A push notification token, if you enable reminders.
What you save: the URL, its title, thumbnail image URL, platform, creator name, caption and description fetched from the public page, duration, your own notes, your tags, whether you favourited it, and any reminder time you set.
How you organise: your categories and collections (boards), their names, descriptions and colours.
Usage counters: how many links you saved in the current calendar month, to apply the free-tier limit.

If you report content

We store what you reported, the reason, any details you typed, and your IP address — the IP solely to rate-limit abuse of the report form. If you later delete your account, the report is kept but the link to you and your IP are removed (see “Deleting your data”).

What we do NOT collect

No location data. No contacts. No photos or files from your device.
No advertising ID. No device fingerprinting.
No browsing history — only the links you deliberately save.
No analytics events, screen views, or crash-reporting SDK.

Why we use it

To run the service — storing your saves, syncing them to your devices, and showing them back to you.
To sign you in and keep your account secure.
To organise your saves automatically — see “AI features” below.
To apply the free-tier limit and, if you subscribe, to unlock it.
To send reminders you asked for.
To keep public content safe — handling reports, blocking, and removing content that breaks our rules.

Our legal bases, where the GDPR applies, are performance of a contract (running the app you asked for), legitimate interests (security, abuse prevention, enforcing the free tier) and consent where you opt into something specific such as reminders.

AI features — what leaves our server

BuzVault uses Google’s Gemini API to categorise saves, generate the optional AI review and summary, answer “Ask your vault” questions, and build the search embeddings that make meaning-based search work. When one of those runs, we send Google the saved link’s URL, title, caption, description, creator, your tags and your notes for that save — the text we need for that feature — together with your question when you use Ask.

We do not send your email address, your name, your handle, or any account identifier.
Google processes it to return a result to us. We do not use it to train anything.
If you never use the AI features, categorisation and embeddings still run on saves you create, because search and sorting depend on them.

Who else sees your data

We use a small number of service providers. We do not sell data to anyone, and none of these is an advertising network.

Who	What for	Where
MilesWeb	Hosting — our server and database	India
Google (Sign-In)	Verifying your identity if you use Google Sign-In	Global
Google (Gemini API)	AI categorisation, review, Ask, embeddings — see above	Global
Resend	Delivering transactional email (password resets, report notices) when enabled	Global

We may also disclose information if we are legally required to, or where it is necessary to investigate abuse or protect someone’s safety.

Email. We send only transactional email — messages you caused, such as a password-reset link you asked for, or a notice about a report. We have no newsletter and send no marketing mail. Transactional email is delivered through our email provider (Resend), which processes the recipient address and the message in order to deliver it.

Email delivery is configurable per deployment and is currently switched off: this server is set to write outbound messages to its own private log instead of sending them, so no email is leaving it right now. The only effect on you is that a password reset has to be completed by an administrator until delivery is enabled.

What you choose to make public

Your vault is private. Two things change that, and only when you act:

Sharing a board. Pressing Share creates an unguessable link. Anyone holding that link can see that board’s name, description and the saves on it — their titles, thumbnails, links, creator names, durations and tags. Your private notes, your AI summaries, your reminders, your favourites and your categories are never published. You can rotate the link (which kills the old one) or turn sharing off at any time.
Creating a public profile. Setting an @handle makes /u/your-handle public: your handle, display name, bio, the first letter of your name as an avatar, your follower counts, and the boards you have shared. Clearing your handle takes it offline.

Shared pages are marked noindex so search engines do not list them, and they load no third-party scripts or fonts. The only off-site content is the thumbnail images themselves, which load from wherever the original link hosts them.

How long we keep it

Your saves and account — until you delete them, or delete your account.
Link previews — we cache what a public URL looks like (title, thumbnail) for a limited period. This cache is keyed by the URL, is shared between all users, and records nothing about who saved it.
Sign-in tokens — stored hashed, and revoked when you log out or delete.
After you delete your account — we keep a one-way hash (SHA-256) of your email address and of your Google ID, plus the number of saves you had used in that calendar month, for 365 days. We cannot read an address back out of a hash. This exists only to stop someone resetting the monthly free limit by deleting and re-registering; deleting your account does not refund the month’s usage. After 365 days those rows are deleted.
Reports you filed — kept, with you unlinked from them, so moderation decisions about other people’s content survive.

Deleting your data

You can delete everything yourself, from inside the app, with no email to us:

With an account: Settings → Account → Delete account.
Without an account: Settings → Delete my data.

Either one is immediate and permanent. Full detail, including the email fallback, is on Delete your account.

Your rights

Depending on where you live you may have the right to access, correct, export or erase your data, to object to or restrict processing, and to complain to a data protection authority. The app already gives you direct access to everything you have saved, and deletion is a button. For anything else, email help@buzvault.com and we will respond within 30 days.

Security

Traffic is encrypted with HTTPS. Passwords are stored as bcrypt hashes and sign-in tokens as SHA-256 hashes — a database copy would not reveal either. Share links use 160 bits of randomness. No system is perfectly secure, and we do not claim otherwise.

Children

BuzVault is not for children under 13, or under 16 where local law requires a higher age for consent. We do not knowingly collect data from children below that age. If you believe a child has created an account, email us and we will delete it.

International transfers

Our server and database are in India. Google’s Sign-In and Gemini services may process data outside India. Where required, transfers rely on the appropriate safeguards offered by those providers.

Changes

If we change this policy we will update the date at the top of this page. Material changes will be announced in the app before they take effect.

Grievance Officer

If you have a complaint about content on BuzVault, about how we have handled your data, or about a decision we made, you can raise it with our Grievance Officer. We acknowledge a complaint within 24 hours and give you a written outcome within 15 days.The officer is Viralkumar Patel, Grievance Officer, reachable at grievance@buzvault.com.

Full details, including what to put in a complaint and the faster timelines that apply to intimate imagery and to court orders, are on Grievance Officer.

Contact

Viharnika Enterprise LLP, Ahmedabad, Gujarat, India — help@buzvault.com