PRIVACY POLICY FOR VESPER

Last updated: August 23, 2026

This Privacy Policy describes the information practices applicable to Vesper (the "App").

1. INFORMATION COLLECTED

The App uses Sentry solely for crash reporting. Crash reports may contain stack traces, device model, operating system version, and App version. Sentry server-side scrubbing is enabled. Crash reports do not contain user identity, Amazon session data, browsing history, item data, cookies, or IP addresses.

When a Pro subscriber enables push notifications, the App collects an Expo push token (a device-level delivery address for push notifications) as described in Section 7.

The App does not use analytics, telemetry, advertising identifiers, or user accounts.

2. ON-DEVICE PROCESSING

The App's functionality, including browsing an Amazon Vine queue, viewing items, and storing user preferences, is processed locally on the user's iPhone or iPad. Except for technical crash reports described in this Privacy Policy, the App does not transmit user data to a server operated for the App.

3. YOUR AMAZON SESSION COOKIES

The App displays Amazon's website through Apple's built-in WKWebView component. You access Amazon within the App using your own Amazon session, as you would when using Safari. Your Amazon session cookies:

• Are stored only in the WebView's sandboxed, on-device storage managed by iOS
• Are not read, copied, extracted, logged, or transmitted by the App
• Are not sent by the App to its operator or to a third party
• Remain subject to Apple's standard WebView security model

The App does not access your Amazon session, Amazon password, or Amazon account data. The App displays the web page and does not inspect or intercept activity within the web page.

4. THIRD-PARTY SDKS

The App includes the following third-party SDKs:

• Sentry: used exclusively to process crash reports as described in Section 1.
• expo-notifications: used to manage push notification permissions and token registration. Push notifications are delivered through Expo's Push API (exp.host), which acts as a delivery intermediary to Apple Push Notification service. Expo's privacy policy is available at https://expo.dev/privacy.
• RevenueCat: used to manage subscription entitlements as described in Section 9.

The App does not include third-party analytics, advertising, or data-collection SDKs.

5. PERSONAL INFORMATION

The App does not request, store, process, or transmit personally identifiable information, including name, email address, postal address, or order history. The limited technical information contained in crash reports is processed solely for crash reporting as described in Section 1.

6. PRO TIER DATA

The App offers an optional paid subscription ("Pro"). When Pro is active:

• The App communicates with a Cloudflare-hosted API operated for the App to retrieve shared Amazon Vine item alerts (AI and AFA queues only). Data retrieved: item ASIN, title, image URL, estimated tax value, queue type, locale, and detection timestamp. No personal information, Amazon session data, or browsing history is transmitted.
• Retrieved item data is cached locally for up to 7 days and automatically purged.
• The RFY (Recommended For You) queue remains on-device only and is never sent to any server.

7. PUSH NOTIFICATIONS

When a Pro subscriber enables push notifications in the App's Settings:

• An Expo push token (a device-level push delivery address, not a personal identifier) is transmitted to and stored by the App's Cloudflare-hosted API, keyed by push_token along with an anonymous device_id and locale.
• Push notifications contain only aggregate alert information (e.g., "X new items detected") and never include item titles, ASINs, or personal data.
• Push notifications are delivered through Expo's Push API (exp.host) as an intermediary to Apple Push Notification service.
• The push token is automatically deleted on sign-out, when Apple Push Notification service reports the device is no longer registered (DeviceNotRegistered), or when the device has not been seen for 90 days.
• The user can disable push notifications at any time via the App's Settings toggle. Disabling immediately deregisters the push token from the server.

8. DEVICE ATTESTATION

When using Pro features, the App uses Apple's App Attest service to verify device integrity. App Attest generates a device-specific cryptographic key pair; only the public key material and an anonymous key identifier are transmitted to the App's API for verification. No device serial number, Apple ID, or personal identifier is collected through this process.

9. SUBSCRIPTIONS

Pro subscription purchases are processed by Apple through the App Store. The App uses RevenueCat to manage subscription entitlements. RevenueCat receives an anonymous user identifier and purchase receipt from Apple. The App's operator does not receive payment details, Apple ID, or billing information. RevenueCat's privacy policy is available at https://www.revenuecat.com/privacy.

10. CHILDREN'S PRIVACY

The App is not directed to children. The App does not knowingly collect personal information from children.

11. CHANGES TO THIS POLICY

This Privacy Policy may be updated from time to time. Any updated version will be published with a revised "Last updated" date and will describe material changes to the App's information practices.

12. CONTACT

Questions concerning this Privacy Policy may be submitted to vespersupport00@gmail.com.