Privacy Policy

Last updated October 19, 2026

WeVault is a product of Chams Enterprises LLC, a Utah limited liability company ("WeVault", "we", "us"). This policy explains what information we collect when you use the WeVault apps and the websites wevault.app and app.wevault.app (together, the "Service"), how we use it, and the choices you have.

The short version. We never see or store your bank username or password. Your private chat and your location are encrypted on your device with keys we don't have. We don't sell your data, and we don't show ads.

1. Information we collect

Account information

Your email address, display name and a hashed password. We also keep the time of your last sign-in, the devices you've signed in from, and push-notification tokens so we can deliver notifications to your phone.

Workspace information

The name and type of your workspace, the people you invite and their roles, the businesses you add (name, entity type, state, EIN and dates if you choose to enter them), and settings such as your saved places.

Financial information

When you connect a bank through Plaid, Plaid provides us with account names, account types, balances, and transaction history (date, amount, merchant, description). We store this so the Service can show your spending, your businesses' profit and loss and your net worth. We also store categories and notes you or the assistant assign to transactions, and any transactions or asset values you type in by hand. We do not receive, see or store your bank login credentials. Plaid's use of your information is governed by the Plaid End User Privacy Policy. If you connect a bank through SimpleFIN instead, the same applies to SimpleFIN.

Documents you upload

Files you put in the vault (for example formation documents or leases) and photos or files you send in chat. Private-chat attachments are encrypted on your device before upload.

Messages

Messages in the private room are end-to-end encrypted. Our servers store ciphertext and cannot read them. Messages in the Team + AI room are stored in readable form so the assistant can answer you; the app labels that room clearly.

Location and safety information

If you turn on location sharing, your phone sends your position, speed, heading, battery level and the time you arrived where you are. This data is encrypted on your device with your workspace's keys; our servers relay ciphertext to the other members of your workspace. SOS and crash alerts include your last known position so your people can find you.

Usage and device information

App version, operating system, crash and error logs, and the IP address and approximate time of requests. We use these to keep the Service working and to debug problems.

2. How we use information

To provide the Service: show your finances, deliver messages and notifications, share locations within your workspace.
To categorize transactions and answer questions in the Team + AI room. For this we send transaction descriptions, amounts and your own notes to our AI provider (Anthropic). We do not send private-room messages, documents from the vault, or locations to any AI provider.
To send you service email: sign-in codes, invites, bank re-connection notices, a daily digest if you turn it on, and billing receipts.
To bill you, once paid plans launch, through Stripe. We never store full card numbers.
To protect the Service from abuse and to comply with the law.

3. Who can see your information

Members of your workspace. WeVault is built for people who share money. Everyone in a workspace sees the same connected accounts, businesses and transactions, and can see each other's location if sharing is on. Only invite people you would share your bank statements with. Roles control who can invite members, connect banks and manage billing.

Service providers. Plaid and SimpleFIN (bank connections), Anthropic (AI categorization and assistant), Stripe (billing), SendGrid (email), Apple and Google (push notifications), and our hosting provider in the United States. Each receives only what it needs to do its job.

Legal. We may disclose information if required by law, subpoena or court order, or to protect the rights and safety of WeVault, our users or the public.

We do not sell personal information and we do not share it with advertisers.

4. Security

Data moves over TLS. Bank tokens and API keys are encrypted at rest. Private chat, attachments and locations use end-to-end encryption (X25519 key exchange, HKDF and AES-256-GCM) with keys stored in your phone's secure storage. Sign-in uses a one-time code sent to your email in addition to your password. No system is perfectly secure; if we learn of a breach affecting your information we will tell you.

5. Keeping and deleting information

We keep your information while your account is active. You can delete your account at any time in the app (Settings → Delete account) or at wevault.app/delete-account. When you delete your account we disconnect your bank connections immediately and delete your account data within 30 days. If you own a workspace, deleting it deletes the workspace database, including every member's view of that data. Backups are overwritten on a rolling 30-day schedule. We may keep billing records as required by tax law.

6. Your choices and rights

Disconnect a bank at any time in Settings → Banks. We stop receiving new data at once and delete the connection token.
Turn location sharing on or off per phone.
Export your transactions and documents from the app.
Ask us for a copy of your information, correct it, or delete it by emailing support@wevault.app. We respond within 30 days.

If you live in California, Colorado, Virginia, Utah or another state with a consumer privacy law, those rights apply to you and you may exercise them by the same email. We do not sell or share personal information for cross-context behavioral advertising, and we do not use it for profiling that produces legal or similarly significant effects.

7. Children

The Service is not for anyone under 18, and we do not knowingly collect information from children. If you believe a child has created an account, email us and we will remove it.

8. Changes

If we make a material change to this policy we will email the address on your account and show a notice in the app at least 14 days before it takes effect.

9. Contact

Chams Enterprises LLC, Utah, United States. support@wevault.app