Privacy Policy

This policy explains what ConceptVault (“we”, “us”) collects when you use the product, why, and what control you have over it. It is written to match how the product actually works, not as generic boilerplate.

What we collect

• Account information: your name and email address, from Google sign-in or the email/password you provide.
• What you capture: the text or voice transcript of each idea (never the audio itself), your confirmed goal, your answers (or skips) to clarifying questions, and anything you add afterwards as context.
• Sources you add: when you add a web page, its address and the text read from it (not the page itself); when you upload a PDF, the file itself and the text read from it.
• What ConceptVault produces for you: research findings, evidence and its sources, claims, scores, recommendations, generated artifacts, and the status of any next steps you accept or mark done.
• Usage information: the time of each sign-in, the AI tokens and estimated cost each idea uses, when you last opened each idea, and technical error logs (where in the product an error happened and its message). A bug report you send also records the page you were on and your browser’s user-agent.
• People you share a verdict with: the email address you send it to, the optional message you write, when you shared it, whether you switched the link off, and how many times the link was opened (a count and the time of the last opening, nothing about who opened it).
• Feedback: the “Helpful” / “Not helpful” rating and any comment you leave on a result.

How it’s used

Everything you capture is used for one purpose: researching and evaluating your idea, for you. We don’t use your ideas — their text, evidence, or generated artifacts — to train AI models, and we don’t publish or sell them. Your ideas, evidence and artifacts are visible only to your account — nothing is made public or used to contact anyone unless you export it yourself or share a verdict with someone.

The content we use beyond producing your own result is your feedback (the rating and comment you optionally leave on a result) and anything you submit through “Report an issue.” That content is used only to understand whether ConceptVault’s output quality is good or to fix a problem you ran into — it’s never used to identify you to anyone else, and it never changes or is attached to any other user’s ideas.

The person who runs this deployment has an admin dashboard. It shows account email addresses, idea titles, sign-in counts, usage and cost, the timing and outcome of each research step, errors, feedback and bug reports. It does not show an idea’s text, goal or findings.

Who we share data with

We use a small number of service providers to make the product work, each only for that purpose and bound by their own data-handling terms:

• Supabase — hosts our database, authentication and file storage, including any PDF you upload, which is stored privately and readable only by your account. Your data is isolated to your account at the database level.
• Vercel — hosts the website and the server code, so every request you make to ConceptVault passes through it.
• Inngest — runs research in the background. It stores the result of each step of a run (which can include search results, the evidence found and the drafted findings) so a run can resume where it stopped.
• Google — if you sign in with Google, Google handles that authentication; we receive only your name and email.
• Your browser’s speech recognition — only if you use voice capture. Turning speech into text is done by your browser, not by us, and some browsers (Chrome, for example) send the audio to their own speech service (Google’s) to do it. ConceptVault receives only the resulting text and never stores the audio. Type your idea instead if you don’t want audio to leave your device.
• Anthropic — powers the AI models that plan research, draft findings and generate recommendations from your idea and the evidence gathered for it. The text you capture, the goal, any context you add and your notes are sent to Anthropic to do that work, and each capture is also checked once for sensitive subject matter (health, legal, financial, safety) and for a harmful purpose. Please don’t include other people’s personal details in an idea — they would be processed the same way.
• Resend — sends three emails. The “your research is ready” email receives your email address and the title of the idea that finished, plus a link back. The Monday email, sent only when something is waiting on you, receives your email address, the titles of the ideas it lists and the wording of next steps you accepted, plus links back. Neither ever includes the findings. You can turn each one off separately on the Account page. When you share a verdict, Resend receives the address you typed, your name and email address (so the recipient knows who sent it), the idea’s title, your message if you wrote one, and the link; the findings stay behind the link.
• Tavily — performs the web searches ConceptVault runs on your behalf while researching an idea. Tavily receives short search queries the AI writes about your idea, never your capture itself.
• Websites you add as sources — when you paste a web address, ConceptVault’s server requests that one page from the site, the way a browser would. The site sees a request from our server, not from you. Only addresses on the public internet are fetched.

Text from the pages and PDFs you add is treated like any other context you add: it is sent to Anthropic when a run uses it, and it is treated as data, never as instructions.

We don’t sell your personal information, and we don’t share it for anyone else’s advertising.

What ConceptVault never does

It never spends money, sends messages, signs anything, or changes systems outside the product on your behalf. The one message that goes to someone else is a verdict you choose to share, after you have seen exactly what the email and the page will say. Every real-world action — and every export, deletion or publication of your data — is something you explicitly confirm first.

Your controls

From inside the product you can edit an idea’s goal, add context, export an artifact, and delete an idea entirely — which removes its evidence, claims, artifacts, history and any PDFs you uploaded to it. From your Account page you can also delete your account entirely, which permanently removes every idea, its evidence, claims, artifacts, uploaded PDFs, run history, shared links and the addresses you shared them with, feedback and bug reports, along with your sign-in itself. Both kinds of deletion are permanent and cannot be undone once confirmed.

Sharing a verdict

When you share an idea’s verdict, the person you send it to gets a private link they can open without an account. It shows the result as it stood when you shared it: the title and goal, the verdict and scores, the claims with their support labels and sources, the recommendations, and the first step as written. It never shows your notes, the progress of your next steps, your usage, your account details, or anything else you captured. Where a claim rests on context you added yourself (a note, a web page or a PDF), the page says only “Context the owner added”, never its text, address or file name. Anyone who has the link can open it, so share it only with people you trust with that result. The page asks search engines not to index it.

You can switch a link off at any time from “Shared with” on the idea; from then on it shows “This link is no longer available”. A switched-off link stays in that list so you can see whom you sent what. Deleting the idea, or your account, deletes its shared links and the addresses you sent them to, and every link stops working.

How long we keep data

We keep your ideas, their evidence, claims, artifacts and research history for as long as your account exists, or until you delete the specific idea they belong to. Deleting your account removes that data immediately, not after a delay — except where we’re required to retain records by law. Copies held by the providers listed above (for example Inngest’s record of past runs) are kept for as long as each provider’s own terms allow.

A PDF you upload is kept with the idea you added it to, for as long as that idea exists. It is deleted when you delete that idea or your account. A PDF you upload to preview and then don’t add is deleted within two days.

Three kinds of data are kept for a fixed time instead: technical error and sign-in logs, which we use only to keep the service working, are deleted after 90 days; the words you type when you ask for a kind of document we don’t list are erased after 90 days (we keep only which kind of document was asked for, to count what to add next, never what you wrote); and cached web-search results, which contain no personal data and are shared across users, are deleted after 7 days.

Children

ConceptVault is not directed at children under 16, and we don’t knowingly collect their data.

Changes to this policy

If this policy changes materially, we’ll update the date at the top of this page and, where the change is significant, let you know directly.

Contact

Questions about this policy or your data can be sent to the account owner listed for this deployment. See also our Terms of Use.