Privacy Policy - CoreVecta
The free Products collect nothing and run entirely on your device - no accounts, no analytics, no advertising, no trackers, no crash reporting, and no telemetry. What you calculate, convert, scan, or check never leaves your device. The only time a Product uses the network is optional and purchase-related: if you choose to buy or restore a paid upgrade, the app verifies that purchase and checks whether it is still valid, and can download a signed, encrypted pack you purchased (see "Purchases & permissions" below). Nothing you enter is ever transmitted.
1. What we do NOT collect
We do not collect, and the Products do not transmit, any of the following:
- Personal identifiers (name, email, phone, device ID, advertising ID).
- Location data.
- What you calculate, search, scan, store, or check - your inputs, history, case files, vault contents, or saved boards.
- Usage or diagnostics / analytics data.
- Contacts, photos, files, or any device content you have not explicitly imported into an app for on-device processing.
Calculation and content state (locale preference, calculation history, case files, vault entries, and scanned documents) is stored only in local device storage and never leaves the device, except where you explicitly choose an optional sync destination (see KeyVecta below). Purchase credentials are sent only for the verification, revocation, and paid-pack delivery described below.
2. How each product handles data
Every CoreVecta app shares the same spine - on-device processing, no accounts, no telemetry - with a short product-specific note on top:
- Calculator Bundle (ConvertVecta, FinanceVecta, ElectronicsVecta,
ConstructionVecta, ScientificVecta, ManufacturingVecta, ProgrammerVecta): reference data
(tax tables, component data, unit conversions) ships inside the app as a cryptographically
signed pack, and every conversion and calculation runs on your device with no
network access. The apps that offer paid upgrades - ConvertVecta, FinanceVecta,
ConstructionVecta, and EnergyVecta - request the Android
INTERNETpermission for one purpose only: to verify an optional purchase (exchange the store receipt for a signed offline license) and to check a signed revocation list so access is withdrawn after a refund, and deliver a signed, encrypted pack the user purchased. No inputs, history, identifiers, or analytics are ever sent. The calculator apps that do not yet offer purchases make no network requests and do not requestINTERNET. (A future ConvertVecta version may also add an optional, user-initiated FX-rate refresh that downloads only a public, non-personalised, signed snapshot; this policy will be updated to present tense when it ships.) - LegalVecta: jurisdiction packs install once and work offline after that. Case files, drafts, and evidence stay on the device.
- ScanVecta: capture and recognition (cropping, text, layout, tables) run on the device. Originals and the archive are encrypted at rest with keys only you hold; nothing is uploaded.
- KeyVecta: the vault is a file you own, encrypted with keys derived from your master password. CoreVecta operates no vault server and receives no vault contents. Optional sync rides storage you choose yourself (for example a cloud drive you control) - that storage provider, not CoreVecta, holds the encrypted file under its own policy. Breach-check lookups use k-anonymized hash data on the device, so a password is never transmitted.
- AutoVecta: scans of service manuals and VIN reads stay on the device and are never uploaded.
- VeriVecta: messages you check for scam patterns are read on the device; an optional case file, if you keep one, stays local and exportable by you.
- StudyVecta / CodeVecta: study packs and code references ship as signed, on-device content; practice history stays on the device.
- OEP enterprise deployments run inside infrastructure the customer controls; data handling for a specific deployment is governed by that engagement's own data-processing terms, not this consumer-app policy.
3. Purchases & permissions
The Products are usable for free. The current paid products are one-time per-app Pro upgrades and separately sold dated packs; there is no cross-app pass or subscription. We do not process or store your payment details:
- Android (Google Play Billing): Google processes the purchase and handles all payment data under Google's Privacy Policy. We receive only a purchase confirmation sufficient to grant your entitlement.
- Web / browser extension (Merchant of Record - Lemon Squeezy): the Merchant of Record processes checkout and payment under its own privacy policy as the seller of record.
When you redeem a purchase, our license service receives the Play purchase token and product id over HTTPS, verifies and acknowledges the purchase with Google, and issues a signed offline license. The raw token is not written to our purchase ledger. We retain a SHA-256 hash of the token, the app package, and the exact product id to prevent cross-SKU reuse and revoke the exact entitlement after a refund or chargeback. We do not link that pseudonymous record to your name, email, payment details, device id, or app usage.
How the network is used, and the permissions we request. To grant an
entitlement, the app sends the store receipt/token and the product id to our license
service over an encrypted (HTTPS) connection, then periodically fetches a signed revocation list
so access is withdrawn after a refund or chargeback. When you request a purchased pack, the app
sends its signed license credential and pack id to the license service, which checks the exact
entitlement and returns the pack signed and encrypted for that license. On web/Chrome, choosing to buy also opens
the merchant's checkout page in your browser. These are the only network calls
the app makes; they carry no personal data beyond the pseudonymous purchase identifier and never
occur while you are simply converting or calculating. On Android, the
INTERNET permission is requested only by the apps that sell upgrades (currently
ConvertVecta, FinanceVecta, ConstructionVecta, and EnergyVecta), solely for those purchase and
revocation and paid-pack-delivery checks - never for ads,
analytics, tracking, or your inputs; no location, contacts, storage, or camera permissions are
requested. The browser extensions request zero permissions and zero host
permissions.
4. Children
The Products are general-purpose utilities and are not directed at children. We do not knowingly collect personal data from children. The only personal data we process is the pseudonymous purchase/license identifier described above, generated through a store purchase.
5. Data sharing and sale
We do not share or sell the pseudonymous purchase record, and never use it for advertising, analytics, or profiling. The payment processors named above handle payment data under their own policies, and any self-chosen sync storage (KeyVecta) is governed by that storage provider's own policy.
6. Your rights
You may request access, correction, or deletion of a purchase record by emailing privacy@corevecta.com with the order id needed to locate it. Deletion may revoke paid access where the record is needed to prove the purchase. We retain purchase and revocation records for the supported lifetime of the product and any longer period required for legal, accounting, fraud, or dispute purposes. App data on your device is removed when you uninstall or clear storage.
7. On this website
No analytics, no cookies, no fingerprinting, no third-party scripts. Static pages served from a CDN. Standard CDN access logs operated by our hosting provider are the only traffic record; we add nothing to them.
8. Changes
We may update this policy as products and features ship. The effective date will change and material changes will be reflected in the app listing.
9. Contact
Privacy questions: privacy@corevecta.com.