Privacy Policy

FlameVault (“we,” “us,” or “our”) operates the FlameVault web application. This policy explains what information we collect, how we use it, and what rights you have over it. We have written it in plain English on purpose.

1. What We Collect

Account information

When you create an account we collect your email address and a hashed password. We never store your password in plain text. Authentication is handled by Supabase.

Lighter photos

When you scan a lighter you upload photos (JPEG, PNG, or WebP, up to 5 MB each). These photos are:

• Sent to Anthropic’s Claude API for AI identification and analysis. Anthropic processes the images to return identification data and does not retain them for training by default under our API agreement.
• Stored in Cloudflare R2 (object storage) tied to your account so you can view them in your vault.

If you delete a lighter from your vault, its photos are deleted from storage. If you delete your account, all photos are deleted.

Scan results and vault data

The AI identification results — brand, model, estimated value, condition, flags, and related fields — are stored in our database (Supabase, hosted on AWS in the United States) and associated with your account.

Billing information

If you upgrade to Pro, payments are processed by Stripe. We never see or store your full card number, CVV, or bank details — Stripe handles all of that. We store your Stripe customer ID and subscription status so we know whether your account is Free or Pro.

Usage data

We track how many scans you have used in the current month so we can enforce plan limits. We do not use third-party analytics or advertising trackers.

eBay market data

When you view market comps, we query the eBay Browse API and cache results in our database for up to 6 hours. This data is not linked to your identity — the cache is shared across all users.

2. How We Use Your Data

• To operate the service — authenticate you, run AI scans, store your vault, show market prices.
• To enforce plan limits — track monthly scan usage and gate features by subscription tier.
• To send transactional emails — account confirmation, password reset, billing receipts, scan limit notifications. We do not send marketing emails unless you opt in.
• To improve the service — we may review aggregate, anonymised statistics (e.g., most scanned brands) to inform product decisions. We do not review individual users’ vault contents for this purpose.

We do not sell your data. We do not use your data for advertising. We do not share your lighter photos with any third party other than Anthropic (for AI processing) and Cloudflare (for storage).

3. Third-Party Services

Each of these services has its own privacy policy. We choose services that operate under standard data protection frameworks and do not use your data for their own advertising purposes.

4. Data Retention

We keep your account data for as long as your account exists. If you delete your account via Settings → Danger Zone, we immediately delete your lighter records, photos, and profile from our systems. Your Stripe subscription is cancelled automatically. Some data (e.g., payment records) may be retained by Stripe for their legal obligations.

5. Cookies

We use only essential cookies — specifically, Supabase authentication tokens stored in your browser so you stay signed in. We do not use advertising cookies, tracking pixels, or analytics cookies.

6. Your Rights

• Access — you can see all your data by browsing your vault.
• Correction — you can update your email in Settings at any time.
• Deletion — you can delete individual lighters or your entire account in Settings.
• Export — Pro users can export their vault data. Free users can contact us for a data export.
• Portability — your scan data belongs to you. We don’t lock you in.

If you have questions or requests about your data, email us at support@flamevault.app.

7. Security

We use industry-standard security practices: HTTPS everywhere, hashed passwords, row-level security on the database (users can only access their own data), and access-controlled photo storage. No system is perfectly secure, but we take it seriously.

8. Children

FlameVault is not directed at children under 13. We do not knowingly collect data from anyone under 13. If you believe a child has created an account, contact us and we will delete it.

9. Changes to This Policy

If we make material changes, we will update the date at the top of this page and notify you by email if the changes significantly affect how we handle your data.

10. Contact

Questions about this policy: support@flamevault.app

FlameVault is operated from Virginia, United States.