Privacy Policy
Last updated: April 17, 2026
Who we are
Vault & Compass, LLC is a software company that builds financial tools for individuals and financial advisors. We are not a registered investment advisor, broker-dealer, or financial institution. Our products are software tools: they help you understand and organize financial information, but they do not manage money or provide regulated financial services.
This policy covers all Vault & Compass products: Prismfolio, Sheetful, and vaultcompass.io.
The short version
- We collect only what we need to make the products work.
- We do not sell your data. Ever.
- We do not use your financial data for advertising.
- We use Plaid for read-only bank and investment data. We never see your banking credentials.
- On vaultcompass.io we use Plausible Analytics for aggregate site statistics, not ad profiling or cross-site tracking.
- Prismfolio (free tier) keeps all data in your browser. Nothing leaves your device.
- You can request deletion of your data at any time.
What we collect and why
Website and waitlist
When you submit our contact or waitlist form, we collect your email address and any message you write. We use this to respond to you and, if you opted in, to send product updates. We do not add you to marketing lists without your consent.
On vaultcompass.io we use Plausible Analytics to understand aggregate traffic (for example, page views, referrers) and a small set of optional, action-focused events (for example, which call-to-action areas are used). Plausible is designed for privacy-friendly statistics: it does not use advertising cookies, and it does not follow you across unrelated websites. How Plausible handles data is described in Plausible's privacy policy.
You can turn site analytics on or off for this browser using the control below. Your choice is stored locally and applies only on this device.
Checking your analytics preference...
Prismfolio (free tier)
The free tier is a Chrome extension that reads portfolio data from supported brokerage pages (Fidelity, Schwab, Vanguard). On those pages, analysis runs locally in your browser. If you sign in, you can save up to three accounts and connect one read-only Plaid sync; we store only what sync requires, encrypted at rest. No sign-in is required to use the extension on a broker tab.
Prismfolio (Plus)
Plus adds account sync and historical tracking. To enable this, we collect:
- Google account: Your name and email via Google Sign-In (Chrome Identity API). Your Google credentials never touch our servers; authentication happens through Google's OAuth infrastructure.
- Investment data via Plaid: Holdings, balances, and securities data from your connected brokerage accounts. This connection is read-only. Plaid never grants us the ability to move or modify your funds. Your credentials are encrypted in your browser and passed directly to Plaid. They are never transmitted to or stored by Vault & Compass.
We store your Plaid access token encrypted using AES-256-GCM. Your investment data is stored to power historical tracking features. You can disconnect your accounts and delete all stored data at any time from your account settings.
Sheetful
Sheetful syncs bank transactions to your Google Sheet or Excel workbook (OneDrive). To do this, we collect:
- Bank transaction data via Plaid: Account names, balances, and transaction history from your connected bank and credit card accounts. Read-only access. Your banking credentials are encrypted in your browser and passed directly to Plaid. They are never transmitted to or stored by Vault & Compass.
- Google account (if using Google Sheets): OAuth access to write to your designated Google Sheet. We request the minimum permissions required: write access to the specific spreadsheet you connect, not your entire Google Drive.
- Microsoft account (if using Excel): OAuth access via Microsoft Graph to write to your designated Excel workbook in OneDrive. We request the minimum permissions required: Files.ReadWrite scoped to your connected file, not your entire OneDrive.
- Email address: For account management and product communications.
Plaid access tokens are stored encrypted using AES-256-GCM. Google and Microsoft OAuth tokens are stored with the same level of protection. You can revoke any connection at any time from your account settings or directly through your bank, Google, or Microsoft account.
Third-party services
We use a small number of third-party services to operate our products:
- Plausible Analytics: Privacy-oriented website statistics for vaultcompass.io (aggregate traffic and limited custom events). See plausible.io/privacy.
- Plaid: Bank and investment account connectivity. Plaid's privacy policy governs how Plaid handles data during the connection process. See plaid.com/legal.
- Google: OAuth authentication and Google Sheets integration. See Google's privacy policy.
- Formspree: Handles contact and waitlist form submissions on our website.
We do not use advertising networks, behavioral tracking pixels, or analytics providers that build cross-site advertising profiles of you. We do not sell personal data for marketing or ad targeting.
Data retention
We retain your data for as long as your account is active or as needed to provide services. If you delete your account, we delete your personal data within 30 days, except where retention is required by law or necessary to resolve disputes.
For waitlist signups with no associated account, we retain your email until you unsubscribe or request deletion.
Data deletion requests are confirmed within 24 hours of receipt. We will notify you by email once your data has been removed.
Your rights
You can request at any time:
- A copy of the personal data we hold about you
- Correction of inaccurate data
- Deletion of your data and account
- Disconnection of any Plaid or Google connection
To exercise any of these rights, email privacy@vaultcompass.io. We respond within 30 days.
Children
Our services are not intended for users under the age of 18. We do not knowingly collect personal information from minors. If you believe a minor has provided us with personal information, contact us and we will delete it promptly.
Security
We use industry-standard security practices including encrypted storage of tokens and credentials, HTTPS for all data in transit, and access controls limiting who can view your data internally. No system is perfectly secure. If you discover a vulnerability, please report it to security@vaultcompass.io.
Changes to this policy
We will update the "Last updated" date at the top of this page when we make material changes. If changes significantly affect how we handle your data, we will notify active users by email.