Privacy Policy

This policy explains what Untangled stores, where, and for how long. The short version: we can't read your vault, we don't track you, and everything self-deletes in 90 days.

Controller

Untangled, Netherlands. Questions about your data: privacy@tryuntangled.com.

What we store

• Encrypted vault content — ciphertext only (AES-class XSalsa20-Poly1305). Keys never leave your devices.
• Anonymous member identifiers.
• Timestamps required for sync and 90-day expiry.

No names, no email addresses, no phone numbers, no advertising identifiers.

Where it's stored

Supabase, Frankfurt (eu-central-1). Data stays in the EU.

AI processing

When you use the Vault Assistant, one decrypted note plus your question is sent over TLS, via our EU servers, to Anthropic (Claude) for transient processing under a Data Processing Agreement. The content is not stored by the AI provider and is not used to train models.

No tracking

No accounts. No ads. No analytics SDKs. No cookies on this website.

Retention

Vaults hard-delete 90 days after creation, or immediately on request from inside the app ("Delete vault now"). This satisfies your right to erasure (GDPR Art. 17). You can export your vault at any time (GDPR Art. 20).

Legal basis

Performance of contract (providing the service) and your consent.

Your rights

Access, rectification, erasure, and portability. You can also file a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).

Sub-processors

• Supabase — hosting, EU region.
• Anthropic — AI processing under DPA with EU transfer safeguards.
• Apple — app distribution via the App Store.