Travel Vault

Privacy policy

Last updated 19 September 2026.

Travel Vault is made by me, Edward Morrison, trading as Pikeworks, a sole trader in Northern Ireland. This is what the app keeps, what leaves your phone, and why.

What stays on your phone

Your flights, trips and the countries you've visited are kept in the app's private storage on your phone, with everything you add to a flight, such as the seat, the cabin, the booking reference and your notes, and your badges and settings. None of it is sent to me unless you turn on Vault Social, described below, and even then your seat, booking reference and notes stay here.

Scanning a boarding pass reads it on the phone. The pass isn't sent anywhere.

A backup file or a CSV export is only made when you tap to make one, and it goes wherever you choose to send it. Importing flights from a CSV file reads the file on your phone. If your phone backs up its apps to your Google account or to iCloud, that backup can include this app's data. Google or Apple keep it for you. It isn't sent to me.

Looking things up

Travel Vault doesn't look anything up. The airports, airlines, aircraft and the map are built into the app, from OurAirports and Natural Earth. It only uses the internet for purchases and, if you turn it on, Vault Social.

Vault Social, if you turn it on

Vault Social is off until you turn it on in the app's Friends tab. It lets you add friends by their handle, an invite link or the code on their Friends tab, and see what each other logs. It doesn't ask for your name, email address or phone number. One account works in every Vault app you turn it on in. Once it's on, the Vault Social service, which I run on a server in the United Kingdom, holds:

• a handle, made up for you and changeable, and a display name if you add one;
• a sign-in key for each phone, stored only in a scrambled form that can't be turned back into the key, with which Vault app and which system it's on, the operating system version and the date it last signed in;
• a scrambled copy of your recovery phrase, if you make one;
• for each new flight you add: the route as airport codes, the two cities, and the airline and aircraft type if you picked them;
• the list of routes you've flown, so friends can compare;
• whether Travel Vault is shared with friends or kept private;
• your friends, requests and blocks, and the reactions and comments you add;
• any report you make, and, if someone reports you, a copy of what was reported until it has been dealt with;
• whether you've bought Travel Vault Pro, so friends see a small ring on your picture;
• if your account is linked to Apple (Sign in with Apple, offered on iPhone) or to Google (offered by Beer Vault on Android), the account number Apple or Google gives the service, never your email address, name or picture.

The date of a flight, the flight number, your seat, cabin, booking reference and notes, and your trips and countries, stay on your phone.

Only the friends you accept can see what you share, and you can make Travel Vault private in Settings at any time. There's no public profile, no directory and no search for strangers. Connections to the service go through Cloudflare, which protects it from attacks. If you sign in with Apple, Apple handles that step and isn't told anything about what you log. Your IP address is used to stop abuse such as mass sign-ups, and is kept for no more than two days. There are no adverts and no analytics.

The service is only used to run Vault Social. Nothing in it is sold or shared with anyone for any other reason. Other people only see what's listed above, and only if you're friends. The community rules cover what you post and comment.

Purchases

Travel Vault Pro is a one-off purchase through Google Play or the App Store. RevenueCat checks the purchase. It receives an anonymous app user ID and the purchase receipt, along with basic details such as the app's version, so it can confirm what you bought and restore it on another phone. I never see your name, email address or payment details. RevenueCat's policy is at revenuecat.com/privacy.

Permissions

Travel Vault asks for the camera only when you tap to scan a boarding pass or a friend's code. It doesn't show notifications, and it doesn't ask for your location, contacts or photos.

On Android, scanning uses Google's ML Kit, which reads the code on the phone and doesn't send what you scan. When the scanner is used, ML Kit sends Google some technical details: the phone's model and Android version, the app's name and version, a random number for this installation, and how well the scanner worked. Google uses them to keep ML Kit working and to measure how it's used. On iPhone, the phone's own scanner is used.

Age

Travel Vault is for anyone aged 13 and over. It isn't aimed at children, and Vault Social isn't for anyone under 13.

Deleting your information

Uninstalling Travel Vault deletes everything it stored on your phone.

Deleting an entry from your log doesn't take back what was already shared about it. You can delete any of your posts from the feed on the Friends tab, and making Travel Vault private hides everything it has shared. To delete your Vault Social account, open Settings, then Friends, then Delete the account. That deletes the account and everything it held straight away, in every Vault app, including your posts, comments, friends and the reports you made. Nightly backups of the service are kept for 14 days, so a deleted account is gone from those within 14 days. If you can't open the app any more, see deleting a Vault Social account.

Your rights

You can ask for a copy of what Vault Social holds about you, ask for it to be corrected or deleted, and complain to the Information Commissioner's Office at ico.org.uk. Vault Social relies on your choice to turn it on, and on my legitimate interest in keeping the service safe.

Changes

If this policy changes, the date at the top changes and the new version replaces this one.

Contact

Email me at hello@pikeworks.co.uk.