The short version
Our apps do their useful work on your device. Notes, ledgers and scans stay local unless you ask for something that genuinely needs a server. We do not sell personal data, and we run no third-party advertising inside the apps.
Privacy Policy
What we collect, why we collect it, how long it stays with us, and what you can ask us to do about it.
What we collect
From the website: nothing that identifies you. No analytics script is loaded and no tracking cookie is set — the theme and language you choose are stored in your own browser, as the localStorage keys gv-theme and gv-lang, and never leave the device. From the apps, where you sign in: an email address, a display name and the minimum account state needed to sync. When you write to us: your message, and whatever you chose to put in it.
Crash and usage data
We collect crash reports in aggregate, so that an issue which closed your app at three in the morning can be found without waiting for you to describe it. A report carries device model, system version, app version and a stack trace. It does not carry the contents of your notes, and it does not carry a persistent identifier. Every platform we ship has a switch for this in Settings.
Retention
Account data is kept while the account exists and erased within thirty days after you close it, except where a record has to be kept longer by law. Crash logs roll up into statistics after ninety days and the raw entries are dropped. Synced history keeps thirty days of previous versions so an accidental deletion can be undone. When information is no longer needed, we delete it, de-identify it or securely isolate it where deletion is not immediately possible. Information stored only on your device can generally be removed by deleting it in the app or uninstalling the app; backups may persist according to your device or cloud backup settings.
Who else sees it
Three kinds of party, and no others: our own staff, on a need-to-know basis; the providers who host and move data for us, under processing terms at least as strict as this policy; and regulators who ask under a lawful basis. A cross-border transfer happens only where it is necessary to serve you, using the mechanism the law requires for that transfer.
Your choices
You can export your data, correct it, or ask for it to be deleted at any time, and you can switch crash reporting off in Settings without losing anything else. To exercise any of this, or to ask a question about the policy, write to galaxyvast@galaxyvast.ltd — we answer within fifteen working days.
Children, and changes to this policy
The apps are made for adults. They are not directed at children under fourteen and we do not knowingly gather their personal data; if you find some, tell us and we will remove it. Material changes to this policy are dated at the top and called out in the apps, not just left here.
Advertising and analytics choices
Where an app uses advertising or analytics SDKs, those SDKs may collect identifiers, app interactions, diagnostics, approximate location inferred from an IP address, and advertising or attribution data, depending on the SDK, your device settings and the app configuration. You may be able to reset or limit your Android advertising ID and adjust ad privacy settings in Android. Where required, the app will present a consent or privacy choices flow. Your choices may affect advertising and measurement features but not the app’s core functions, unless otherwise explained in the app.
International data transfers
Because our service providers may operate in multiple countries, information may be processed in a country different from where you live. Data protection laws in those countries may differ. Where applicable law requires safeguards for an international transfer, we will use an appropriate legal transfer mechanism.
Security
We use reasonable technical and organizational measures designed to protect information against unauthorized access, loss, misuse or alteration. No method of storage or transmission is completely secure, and we cannot guarantee absolute security. Please use device security features and contact us promptly if you believe an account or information has been compromised.
Your privacy rights and contact
Depending on where you live, you may have rights to request access to, correction or deletion of personal information, object to or restrict certain processing, withdraw consent, or lodge a complaint with a privacy regulator. We may need to verify your identity and may retain information where the law permits or requires. Contact galaxyvast@galaxyvast.ltd to make a request or ask a privacy question. We will respond within the period required by applicable law.
California residents
If you are a California resident, you have specific rights under the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA). You may request disclosure of the categories and specific pieces of personal information we have collected about you in the past 12 months, the categories of sources, the business or commercial purpose for collecting it, and the categories of third parties with whom we shared it. You have the right to request deletion of your personal information, subject to certain exceptions. We do not sell your personal information. We do not use or disclose personal information for purposes that would constitute "sharing" under the CCPA/CPRA. To exercise your rights, contact galaxyvast@galaxyvast.ltd. We will verify your identity by matching information you provide with our records. You may designate an authorized agent to make a request on your behalf. We will not discriminate against you for exercising your rights.