The Arcanum Vault
Effective September 17, 2026
Account details: your email address, display name, and (for Google sign-in) your Google profile picture. Collection data: the cards, sealed products, purchase prices, dates, notes, alerts, and chart views you add. Usage data: sign-in timestamps and basic activity (e.g. last-seen time) used to operate and improve the service. Feedback you send us. Billing data: subscriptions are processed by Stripe — we never see or store your full card number. We store your Stripe customer and subscription identifiers, plan status (trial, active, canceled), and billing timestamps.
To run your vault: computing valuations and daily snapshots, generating charts, briefs, statements, and alerts; to send the emails you enable; to secure accounts (hashed passwords, session cookies, rate limiting); and to understand beta usage at a small scale. AI features (vault chat, brief narratives, market pulse) send relevant portions of your collection context to our AI providers to generate responses — never your password or session data.
We do not sell your personal data. We do not share your collection with other users — every vault is private and isolated by account. The only third-party tracking we use is an advertising-measurement pixel from Reddit (see below); we run no other ad networks or analytics trackers.
We use a single first-party, httpOnly session cookie to keep you signed in. We also use the Reddit Ads pixel to measure whether our Reddit ads work: it records events like page visits and sign-ups and may set its own cookie or identifiers. For signed-in users it can receive a hashed version of your email and an internal account ID — Reddit's pixel hashes the email in your browser before it is sent. See Reddit's privacy policy for how Reddit processes this data.
Transactional emails (welcome, email confirmation, password reset, trial-ending reminders) are sent to operate your account; Stripe may send payment receipts and billing notices for your subscription. Optional emails — daily brief, vault movers, weekly recap, and alerts — are sent only to an address you add, and each can be switched off in Settings at any time.
We share the minimum data needed with processors that make the Vault work: Emergent/Google (authentication), Stripe (payment processing — when you subscribe, Stripe receives your card details, billing address, and email directly, under Stripe's own privacy policy; we only receive confirmation of payment and subscription status), Resend (email delivery), market data APIs (card identifiers only — never your personal details), AI providers (Anthropic, OpenAI) for generated text and audio, and Reddit (advertising measurement — hashed email and account ID only). MongoDB hosting stores your data encrypted in transit.
Passwords are hashed with bcrypt and never stored in plain text. Sessions use httpOnly cookies with expiry. Reset and confirmation links are single-use and time-limited. Sign-in attempts are rate-limited. No system is perfectly secure, but we take reasonable measures appropriate to a small beta.
Your data is kept while your account is active. You may request deletion of your account and all associated data at any time — email us or use the Send feedback button, and we will remove your account, collection, snapshots, alerts, and email preferences within 30 days, and cancel any active subscription. Payment and transaction records are retained as required for tax, accounting, and fraud-prevention purposes.
The Vault is not directed at children under 13, and we do not knowingly collect their data. If you believe a child has created an account, contact us and we will delete it.
We may update this policy as the beta evolves; material changes will appear here with a new effective date.
Privacy questions or deletion requests: contact@thearcanumvault.co.
See also our Terms of Service.