Privacy notice

Information you choose to provide.

VEXUM stores account and profile details and the workspace information you add, such as items, photos, collections, tasks, reminders, calendar entries, routines and financial records. Connected services provide information only after you authorize a connection. Public profile and collection visibility follows the sharing settings you choose.

This information is used to provide the features you request, save and synchronize your workspace, maintain your account and investigate service or security issues. Payment and bank connections have their own provider permission screens. Connecting Gmail does not grant bank access or permission to make payments.

Optional Gmail access.

When you choose Connect Gmail for payment updates or package importing, Google asks you to grant read-only Gmail access. This permission technically permits reading messages across your mailbox, including their contents. For payment updates, VEXUM uses it only to identify and process supported payment-plan notices from Affirm, Klarna, Afterpay (including Cash App Afterpay), Sezzle, Zip, PayPal Pay Later, Bread Pay, Flex Pay/Uplift and Splitit. It does not request permission to send, edit or delete email.

VEXUM receives your connected Gmail address and authorization tokens. For payment updates, an initial search covers approximately the preceding 90 days, followed by periodic checks for new or changed matching notices. The application searches for messages from the supported lenders containing payment-plan terms, with additional product and receipt-template filters for general Cash App, PayPal and Upgrade senders, then validates the sender and receiving authentication information before extracting supported facts. Unbranded Cash App receipts can update only a payment plan already identified as Afterpay. It ignores spam and trash and does not download attachments.

Package email is a separate optional connection. After you choose to enable it and grant Google consent, VEXUM searches matching shipping notices from approximately the preceding 7 days, then checks about every 5 minutes for new matching notices. It validates receiving authentication and looks for supported tracking numbers in explicit tracking labels or recognized carrier links. It does not visit email links or retrieve attachments. Existing payment-email access is not silently reused for this purpose.

For packages, VEXUM stores the tracking number, carrier when identified, a short label derived from the shipping subject, a hashed message identity for duplicate prevention and connection/check timestamps. It does not store email bodies or attachments. Duplicate tracking numbers and archived package entries are not automatically added again. Carrier tracking limits apply.

Processing uses message metadata, receiving and sent dates, sender, subject, message identity and available text, including a safe text projection of HTML-only messages. VEXUM stores normalized plan facts: provider, plan reference, merchant when available, currency, payment amounts, remaining balance when explicitly reported, due dates, payment status and source timestamps. A hashed message identity helps prevent duplicate processing. Message bodies and attachments are not retained in the payment-plan database.

Address and place suggestions.

When you type at least three characters into a location search field, VEXUM sends that search text to Geoapify for address suggestions when configured, or to Photon as a fallback. The search can prefer your country based on the hosting service’s country hint; it does not request your device’s precise location. Suggestions are briefly cached in the field’s memory and are not saved to browser storage. Only the location text you choose or enter is saved with your workspace record when you save it. Map and directions actions may send the selected address to Apple Maps when you choose to open them.

How Gmail information is used.

Gmail information is used only for the payment-plan and package-import features you separately authorize. Package email adds matching shipments to your private Packages list and requests carrier updates. Payment features include identifying your plans, displaying balances and dates, matching confirmed payments and keeping those records up to date. You can enter a current balance as a starting point. VEXUM does not infer a missing balance from a purchase total or treat a pending payment as paid.

Gmail information is not sold, used for advertising, used to build marketing profiles, or used to train artificial intelligence models. This connection does not send raw email bodies or attachments to an AI model; selected normalized payment-plan facts may be used only for a question you explicitly send to Ask VEXUM, as described below. It is not used to decide eligibility for credit, lending, insurance, employment or housing.

VEXUM’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements.

Storage, security and service providers.

VEXUM uses Vercel to run its website and server functions and Supabase for account services and cloud storage. These providers process information needed to operate VEXUM. Gmail refresh tokens are encrypted before storage, kept on the server and used to maintain the connection you authorized. Owner checks and account security checks protect access to private payment-plan and package records. Data is transmitted over HTTPS.

Google processes authorization and mailbox API requests. If you separately choose selective email forwarding, those selected notices pass through Resend and VEXUM’s receiving service. Connecting Gmail does not silently enable forwarding or share the rest of your mailbox with Resend.

When you add a package manually or enable automatic package importing, its tracking number and optional carrier are sent to EasyPost to obtain carrier-reported status, scans and estimated arrival. EasyPost sends signed status updates to VEXUM. The map uses carrier scan cities, not your device location or a live vehicle position; a geocoding service may process that city and region to place the marker.

Access by authorized personnel is limited to your explicit support request or consent, security and abuse investigations, and legal obligations. Gmail data is not made public through your social profile. Operational diagnostics are designed to exclude message bodies and authorization credentials.

Optional Ask VEXUM.

Ask VEXUM is an optional feature for eligible signed-in accounts, subject to availability, personal usage limits and a shared spending allowance. After you acknowledge its data-sharing disclosure and send a question, VEXUM sends the question, a bounded recent conversation and selected relevant saved record facts and calculations to OpenAI to generate a response. This may include task deadlines, collection values, financial summaries and normalized payment-plan balances or due dates relevant to that question. Connecting Gmail alone does not start AI processing.

Raw email bodies, attachments, private messages, account numbers, credentials and precise addresses are excluded from the assistant’s selected context. Requests disable provider response storage and do not authorize training on your records. OpenAI may retain API data for abuse monitoring according to its API data controls. VEXUM keeps conversations in the current app session by default and stores usage and spending entries without prompts or answers. If you explicitly save a chat or turn on “Keep this chat’s draft saved,” that text is stored in your account workspace on this device and follows normal cloud sync and workspace backups. Draft saving is off by default and turns off when you close, start a new chat or open another saved conversation; your last saved copy remains. Saving or recovering text does not send an AI request. Saved replies are historical text; opening them does not send a question or restore action permissions. You may explicitly include recent saved replies with a new message. Deleting a saved chat removes only that chat from the current workspace as normal sync succeeds; older downloaded backups, recovery copies and provider processing are not erased. Replies are suggestions based on saved data; an eligible debt-plan change requires your separate Apply plan action and never makes a payment.

Retention and your controls.

While connected, VEXUM retains the encrypted refresh credential needed for updates. Choose Debt → Manage email → Disconnect to remove the stored Gmail credential and stop new payment updates. Saved plan records and balances remain available after disconnecting so that your debt history is not erased unexpectedly.

Choose Life → Packages → Package email → Disconnect to stop future shipping-email checks and remove that connection's stored Gmail credential. Existing packages and hashed duplicate-prevention records remain. An in-progress carrier request may finish. Package email and payment-email connections are controlled separately.

You may also remove VEXUM’s access in your Google Account connections. Revoking access stops future authorized mailbox access; it does not delete records already imported into VEXUM.

To request deletion of your account, imported payment-plan data or other stored information, email support@vexum.app from the address associated with your VEXUM account. We may verify ownership before acting on a request. Do not include a password or verification code. Records needed to fulfill legal obligations or resolve an active security issue may be retained for that purpose.

Retired GroupMe schedule connection.

The GroupMe schedule connection has been retired. VEXUM no longer offers account connection, chat or image reads, image processing, schedule review or automatic imports through this feature. Personal shifts already saved remain in your Calendar and Schedule until you edit or remove them.

Retiring the feature does not itself delete historical server records or previously stored encrypted connection credentials. Historical records remain subject to applicable retention and deletion processes. Previously sent provider requests follow the provider's own retention rules.

Optional subscriptions.

If you buy a VEXUM subscription, Apple or Stripe handles payment. VEXUM stores the account link, plan, provider transaction identifiers, billing period and verified subscription status needed to deliver access, restore purchases and respond to cancellations or refunds. VEXUM does not receive your full card number from App Store purchases. Stripe may provide limited payment-method details such as card brand, expiry and the last four digits for the billing screen.

VEXUM links an Apple purchase to the VEXUM account used during purchase using an account token. Purchase receipts are verified on the server. Subscription details are not posted to your public profile and do not grant access to your bank accounts or inbox. Read the subscription terms for renewal, cancellation and account support.

Questions and changes.

Contact support@vexum.app with privacy questions or requests. Material changes to data use will be reflected here; additional Google permissions require a new consent request.