Vector Privacy Policy

Effective date: 4 August 2026

Vector (“Vector”, “we”, “us”, “our”) is an AI-powered productivity app operated by Mahati Suvvari (ABN 51 230 741 357), an individual sole trader based in Australia, trading as “Vector by Momentum”. We are the controller of the personal information described here. You can reach us at privacy@vectorbymomentum.com.

This policy explains what personal information Vector collects, how we use it, who we share it with, and the choices and rights you have. Vector is designed to be private by default: your content is yours, it is scoped to your account, and we do not sell it or use it for advertising.

Because Vector uses AI, some of your content is sent to third-party AI providers so the app can turn it into tasks, plans, and answers. This policy is specific about when that happens. Please read sections 3 (AI processing) and 5 (who we share with) in particular.

1. The short version

Your content is yours. Everything you capture is scoped to your account and is not visible to other Vector users unless you deliberately share it. Messages, assignments and shared groups are the deliberate sharing: what you send there is visible to the people you sent it to, and stays in their copy of the conversation. See section 5a.
We do not sell your personal information and we do not run advertising against it or use it to target you.
We do not train AI models on your content. We send content to AI providers only to generate your results. See section 3.
You can delete everything you own. Deleting your account permanently erases your content and files. Messages you sent other people stay in their conversation with your text removed and your name detached, because that thread is their record too. See sections 5a and 8.
Some things leave the app. AI processing, connected accounts (Gmail, calendars), and features like SMS task-sharing send specific data to third parties. We list each one below.

2. Information we collect

2.1 Information you provide

Account: email address, display name, and (optionally) a profile photo. If you sign in with Apple or Google, we receive your email and name from them.
Your content: everything you create in Vector, including captures, tasks, checklists, thoughts, notes, goals, reminders, comments, spaces, focus sessions, and any photos, files, or voice recordings you attach. Voice recordings are transcribed to text; the audio itself is not stored.
People and contacts: names, and where you provide them, phone numbers and email addresses of people you add as connections, assign tasks to, or collaborate with. If you grant permission, Vector reads your device’s address book to help you find and add contacts; contact data is used only for that and is not otherwise shared (but see section 3.7 on SMS task-sharing).
Profile settings: things like your timezone, working hours, and notification preferences.

2.2 Information you connect (optional integrations)

You can connect external accounts. We only access these if you explicitly authorise them, and you can disconnect at any time.

Google Calendar / Apple Calendar / Outlook Calendar: we read your event titles, times, locations, and attendee counts to show your schedule alongside your tasks. We do not retain attendee names or email addresses.
Gmail: if you connect Gmail, we read message content (subject, sender, and body text) so Vector can surface relevant items. This email content is sent to an AI provider for processing (see section 3) and stored in your account. We request read-only Gmail access.
Apple Health (special-category health data): if you turn it on, per data type, Vector reads Apple Health samples for the types you enable: workouts, mindfulness, sleep, steps, heart rate, and active energy. This is used to give you energy-aware scheduling and weekly insights. Health data is sensitive; we treat it as a special category, it is never used for advertising or sold, and it is sent to an AI provider only to compute your insights (see section 3.6). Reading is one-way; we do not write anything back to Apple Health.

2.3 Information collected automatically

Usage and diagnostics: device type, operating system, app version, and how you interact with the app (features used, screens viewed, errors).
Push tokens: a device token so we can send you notifications you have enabled.
Operational telemetry: to run and debug the AI pipeline, we log records of AI requests. These logs can include the text of the content you submitted and the AI’s response. They are retained for 30 days and then automatically deleted. See section 7.

2.4 Payment information

If you subscribe, payment is handled by the Apple App Store or Google Play and their payment processor RevenueCat. We receive your subscription status and a subscription identifier, but we never receive or store your card number.

3. AI processing: how your content reaches AI providers

Vector’s core features work by sending your content to third-party large language model (LLM) providers, which return structured results (tasks, summaries, plans, answers). We do this to provide the service to you, not to build advertising profiles and not to train models.

The providers we use are OpenAI, Anthropic, and Google. What we send:

3.1 Captures and content: the text of what you capture, and the content of thoughts and tasks, is sent to OpenAI (and, for some features, Anthropic or Google) to classify it and generate structured output.
3.2 Photos and images you attach are sent to OpenAI to extract text and describe them.
3.3 Documents (PDF, Word) you attach are sent to Anthropic to extract their text.
3.4 Voice recordings are sent to OpenAI to transcribe them to text.
3.5 Gmail content (if connected), the subject, sender, and a portion of the body, is sent to OpenAI for processing.
3.6 Health data (if enabled), aggregated recent sleep, heart-rate, workout, and mindfulness data, is sent to Anthropic to compute your weekly correlations and energy insights.
3.7 Web-grounded features: when you create a goal plan, or when you save a link, the relevant text (for example your goal, its deadline, and context you provided, or the URL and your caption) is sent to Google and may be used to run Google Search queries so the AI can ground its answer in current information. This means that specific content leaves the direct AI interaction and is issued to Google Search.
3.8 Messages you send to other people are sent to OpenAI to be checked for objectionable content (for example threats, harassment, hate speech, or sexual content involving minors) before they are delivered. This happens on every message you send, including messages that have nothing to do with the AI features. The check is automated: no person reads your message, OpenAI returns only a pass or fail and a category label, and we do not store the result. A message that fails the check is not delivered. We do this because app store rules require us to filter objectionable material, and because the people you message have not agreed to anything you send them. See section 5b.

Training. We do not use your content to train, fine-tune, or improve AI models. We send content to the providers above solely to generate your results. Each provider processes the data it receives under its own terms and privacy policy; we encourage you to review them (OpenAI, Anthropic, Google). We select providers on the basis that they act as our processors for this purpose.

No pre-scanning/redaction. Vector does not strip names or other identifiers from content before sending it to a provider; it sends what is needed to produce your result. Only turn on integrations (Gmail, Health) if you are comfortable with the processing described here.

4. How we use your information

We use your information to:

Provide and operate Vector: store your content, sync it across your devices, and run the AI features that turn it into tasks, plans, and answers.
Personalise your experience (for example, energy-aware scheduling from Health data, or surfacing relevant items).
Send you notifications and emails you have enabled, and transactional messages (account, security, subscription). You can opt out of non-essential email at any time.
Maintain security, prevent fraud and abuse, debug problems, and improve the app.
Comply with our legal obligations.

Legal bases (GDPR/UK GDPR). Where this law applies, we rely on: performance of a contract (to provide the app you signed up for); legitimate interests (to secure, debug, and improve the app, balanced against your rights); consent (for optional integrations such as Health and Gmail, for the address book, and for marketing email, which you can withdraw at any time); and legal obligation where applicable. For special-category health data we rely on your explicit consent, given through the per-type Health toggles.

We do not sell your personal information. We share it only as follows:

Service providers (processors) who run Vector on our behalf:
- Supabase: database, authentication, and file storage (hosted on Amazon Web Services).
- OpenAI, Anthropic, Google: AI processing, as described in section 3.
- RevenueCat, and the Apple App Store / Google Play: subscriptions and payments.
- Expo: delivery of push notifications (notification content, which may include a task or reminder title, passes through Expo’s push service and then Apple/Google).
- Brevo: sending transactional and, if you opt in, product emails.
- Sentry: crash and error reporting. To diagnose errors, Sentry may receive your account identifier and email, and a screenshot of the app screen at the time of an error (which can contain your content). Sentry is hosted in the EU.
- PostHog: product analytics (structural events about feature usage; we do not send your content to PostHog).
Other people, when you choose to share: if you assign a task, collaborate, or add someone as a connection, we share what is necessary, for example when you assign a task to someone by SMS, the recipient’s phone number and the task title are sent through Twilio to deliver the message. Only share another person’s contact details where you have their consent.
Legal and safety: we may disclose information if required by law, or to protect the rights, property, or safety of you, us, or others, or to investigate fraud or abuse.
Business transfer: if Vector is ever transferred to another operator (for example, a sale of the app), your information may be transferred as part of that, subject to this policy.

Vector lets you message another person, assign them a task, and post work in a shared group. This content is joint: it exists in your account and in theirs at the same time, and that changes how it behaves.

What the other person sees. Anyone in a conversation or group can see the messages and work posted in it, along with your display name and avatar. Members of a shared group can see each other’s display names.
You cannot un-send from their account. Deleting a message removes it for everyone, but we cannot remove what someone has already read, screenshotted, or written down.
Deleting your account does not delete the conversation. We remove the text you wrote and detach your identity from it, so your messages show as being from a deleted user. The conversation itself remains for the other participants, because it is their record too. Descriptions of shared work (task titles, who did what) stay legible, or the remaining person is left with an unreadable thread. This is permitted under GDPR Art. 17(3) and equivalent rules, which allow us to keep a record where erasing it would override someone else’s rights.
Invites. When you invite someone who is not on Vector, we create a link you choose how to send. We do not send it for you and we do not store their contact details from that action.

5b. Reporting, blocking and moderation

Messages are checked automatically before they are sent, and you can report a message and block another user from inside the app.

Automatic checking. Every message you send is screened for objectionable content by OpenAI before it is delivered, as described in section 3.8. It is automated, no person reads it, and we keep no record of it. A message that fails the check is not delivered.
A report copies the reported message. When you report something, we take a copy of that message at that moment, including its text and who sent it. We keep the copy even if the message is later deleted or the sender deletes their account, because otherwise a report could be erased by the person being reported.
A human reads it. Reports go to our support address and are reviewed, normally within 24 hours. We may hide the message, and we may suspend or remove the account responsible.
How long we keep the copy. The copied message is deleted 12 months after we finish dealing with the report. The record that a report was made, and what we decided, is kept as our moderation history. A report nobody has dealt with yet is never deleted on a timer.
Blocking stops that person messaging you, removes you from each other’s conversations, and takes you out of shared groups you were both in.

6. International data transfers

Vector is operated from Australia, and our providers are located in various countries, including the United States and the European Union. When you use Vector, your information may be transferred to and processed in countries whose data-protection laws differ from your own. Where required, we rely on appropriate safeguards (such as the European Commission’s Standard Contractual Clauses) for transfers out of the EEA/UK.

7. Data retention

Your content (captures, tasks, thoughts, files, health samples, connected-account data) is kept for as long as your account exists. We do not currently apply an automatic time limit to content while your account is active.
Messages and shared work do not expire. We deliberately do not delete them on a timer. The history of what you asked someone to do, and what they did, is the point of the feature, and a conversation that quietly erased itself would be worse than useless. They are removed when you delete them, when a report leads us to hide them, or when an account is deleted (see section 5a for what survives, and why).
AI operational logs that may contain submitted content are automatically deleted after 30 days.
When you delete your account, your content and files are erased from our active systems (see section 8), with the joint-content exception described in section 5a and the anonymised billing-event record described in section 8. Residual copies may persist for a short period in encrypted infrastructure backups before being overwritten on the backup rotation.

8. Your rights and choices

You can, at any time:

Access and export your data: most of it is visible in the app, and you can request a copy.
Correct inaccurate information in your profile and content.
Delete your account and all associated data from within the app. Deletion is permanent: it removes your content, your files in storage, and the AI operational logs tied to your account, then deletes your account itself. Three things deliberately survive, and only these three: messages and shared work you sent to other people, with your text removed and your identity detached, so the other participants keep their own record (section 5a); copies attached to a content report, so a report cannot be erased by the person it is about (section 5b); and a record that a billing event from the app store was processed, with your account identifier removed so it no longer refers to you. That last one holds no purchase amount, product, or receipt - it exists only so a duplicate notification from the app store is ignored rather than counted twice, and deleting it is what would break that.
Withdraw consent for optional processing: disconnect Gmail or a calendar, turn off any Health data type, revoke address-book access in your device settings, or unsubscribe from product email, without affecting the rest of the app.
Control notifications through your device and in-app settings.

Depending on where you live, you may also have the right to object to or restrict certain processing, to data portability, and to lodge a complaint with your data protection authority. To exercise any right, contact privacy@vectorbymomentum.com. We may need to verify your identity first, and we will respond within the time required by applicable law.

Regional specifics are in sections 11 (Australia), 12 (EEA/UK), and 13 (California).

9. Security

We protect your information with encryption in transit (TLS) and at rest, account-scoped access controls (row-level security so you only ever see your own data), and service-role isolation for sensitive operations. No system is perfectly secure, and we cannot guarantee absolute security, but we work to protect your data and to respond promptly if an issue arises.

10. Children

Vector is not directed to children. You must be at least 16 years old to use Vector. We do not knowingly collect personal information from anyone under 16. If you believe a child under 16 has provided us personal information, contact privacy@vectorbymomentum.com and we will delete it.

11. Australia

We handle personal information in accordance with the Australian Privacy Principles under the Privacy Act 1988 (Cth). You may request access to or correction of your personal information, and you may complain to us about how we handle it at privacy@vectorbymomentum.com. If you are not satisfied with our response, you can complain to the Office of the Australian Information Commissioner (oaic.gov.au). Some of your information is disclosed to and stored by overseas recipients (see sections 5–6), principally in the United States and the European Union.

12. EEA and UK

If you are in the European Economic Area or the United Kingdom, we process your personal data on the legal bases described in section 4, and you have the rights described in section 8, including the rights to access, rectification, erasure, restriction, objection, and portability, and to lodge a complaint with your supervisory authority. We transfer data internationally as described in section 6. We do not currently have an appointed EU/UK representative under Article 27; if that changes we will update this policy with their details.

13. California

We do not sell or “share” (as defined under the California Consumer Privacy Act, as amended) your personal information for cross-context behavioural advertising, and we do not use or disclose sensitive personal information beyond the purposes described in this policy. California residents have the right to know, delete, correct, and to non-discrimination for exercising these rights. To exercise them, contact privacy@vectorbymomentum.com.

14. Changes to this policy

We may update this policy from time to time. If we make material changes we will notify you in the app or by email and update the effective date above. Your continued use of Vector after a change takes effect means you accept the updated policy.

15. Contact

Questions or requests about this policy or your data: privacy@vectorbymomentum.com.