Privacy Policy

The Vault ("we," "us") is operated by Shop The Vault LLC, a Michigan limited liability company. The Vault is a peer-to-peer resale marketplace for designer and streetwear pieces, powered by Million Dollar Streetwear. This policy explains what information we collect when you use The Vault, how we use it, and who we share it with. Questions about this policy or your data can be sent to support@shopvault.io.

Account information. When you sign up, we collect your email address, username, and password (handled by our authentication provider — we never see or store your password in plain text). You may optionally add a display name, bio, and avatar photo to your profile. If you sign in with Google or Apple, we receive the name and email address (or Apple's private relay address) you choose to share with us; we never receive your Google or Apple password.

Listings, offers, and messages. Anything you post or send through The Vault — listing photos and descriptions, offers, messages to other users, reviews — is stored so the marketplace can function and so the relevant parties (buyers, sellers, and The Vault for support/dispute purposes) can see it.

Camera and photo library. If you allow it, The Vault accesses your camera or photo library only so you can attach photos to a listing or your profile. We don't access your photos or camera for any other purpose, and you can revoke access at any time in your device settings.

Order and shipping information. When you buy or sell an item, we collect the shipping address, order amount, and shipping/tracking details needed to fulfill and track that order. This information is shared between the buyer and seller as needed to complete the transaction.

Payment information. Payments and seller payouts are handled entirely by Stripe. The Vault never sees or stores your full card number — we only receive transaction records (amounts, status, and identifiers) needed to track orders and payouts. Stripe's own privacy policy governs the payment details you give it directly.

Usage and device information. We use PostHog to understand how the app is used and to catch errors — this includes pages visited, features used, general device/browser information, and, when something breaks, automatically captured error reports. When you're signed in, this activity is linked to your account (user ID, email, and username). We use this data only to run and improve The Vault — we don't use it for advertising, we don't sell it, and we don't combine it with data from other companies' apps or websites to track you.

Photo moderation and listing autofill. Listing photos are checked automatically for prohibited content by Sightengine before they can be added to a listing. If you choose to use the optional listing autofill feature, the photos you've uploaded for that listing are sent to Anthropic, which uses its Claude AI model to suggest a title, description, brand, category, size, condition, and color. You review and edit every suggestion before publishing. We send only those photos, not your name, email, or other account details, and the feature is off unless you use it.

Communications. We send transactional emails (order updates, offers, messages, account notifications) through Resend, addressed to the email you signed up with.

We use the information above to:

• Operate the marketplace — listings, offers, messaging, orders, and reviews
• Process payments and seller payouts through Stripe
• Send order, offer, message, and account notifications
• Respond to support requests and resolve disputes between buyers and sellers
• Detect and prevent fraud, abuse, and violations of our terms, including reviewing reports of listings or users and blocking users on your request
• Understand usage patterns and fix bugs, using aggregated and per-user analytics

We don't sell your personal information. We share it only with the service providers that make The Vault work, and with other users where the marketplace itself requires it (e.g. a seller sees a buyer's shipping address to ship an order):

• Supabase — database, authentication, and photo storage
• Stripe — payment processing and seller payouts
• PostHog — product analytics and error tracking
• Resend — delivery of transactional emails
• Sightengine — automated moderation of listing photos
• Anthropic — AI-generated listing suggestions from your photos, only when you use listing autofill
• Google and Apple — if you choose to sign in with them
• Vercel — hosting of the website and app

Each of these providers processes data under their own privacy policy. We may also disclose information when required by law, to respond to valid legal process, or to protect the rights, safety, or property of The Vault or its users.

We keep your information for as long as your account is active, or as needed to provide the service, resolve disputes, and comply with legal obligations (for example, transaction records related to payments). You can update your display name and other profile details at any time from Account settings. You can delete your account there too, at any time (unless an order is still in progress). Deleting your account removes your profile, listings, photos, favorites, and saved searches, and replaces your messages with a "deleted" placeholder. We may keep limited records we're legally required to retain, such as transaction and payout records, but they're no longer linked to your identity. To request access to or correction of your personal information, or if you can't use the in-app option, email support@shopvault.io from the address on your account and we'll respond within 30 days.

Depending on where you live (for example, California), you may have additional rights to know what personal information we hold, to have it corrected or deleted, and not to be discriminated against for exercising those rights. We don't sell or share personal information for cross-context behavioral advertising. To exercise any of these rights, contact us at the address above.

The Vault is for users 18 and older and is not directed at children. We don't knowingly collect information from anyone under 18. If you believe a minor has provided us with personal information, contact us and we'll delete it.

We use industry-standard measures to protect your information, including encrypted connections and access controls on our database. No method of storage or transmission is 100% secure, and we can't guarantee absolute security.