PolicyVector

Privacy Policy

Effective Date: September 7, 2026

PolicyVector is provided by Graywheel ("PolicyVector," "Graywheel," "we," "us," or "our"). PolicyVector includes the desktop study application and the native PolicyVector Reader for iOS and Android. PolicyVector helps users organize policy documents, generate study materials, import encrypted Reader bundles, create newly encrypted Reader bundle copies for user-directed sharing, optionally synchronize eligible study materials through Live Sync, and import or export user-selected Google Drive and Google Docs content or Microsoft OneDrive files.

This Privacy Policy explains what information PolicyVector accesses, uses, stores, shares, retains, and deletes, including how PolicyVector handles Google user data when you connect Google Sign-In, Google Drive, or Google Docs features; how supported desktop and iOS licensing clients handle Microsoft licensing sign-in and optional OneDrive import/export; and how the mobile Reader handles Sign in with Apple, local data deletion, and account deletion.

1. Information We Collect

PolicyVector is designed to keep study content local whenever possible. Depending on how you use the app, we may process:

• Account and licensing information, such as your email address; Google, Apple, or Microsoft identity proof and stable provider account identifier; provider-supplied email or display-name hints; license status; app-generated device fingerprint hash; device label; payment/license metadata; and license replacement or move history.
• Local study content, including documents, outlines, flashcards, multiple-choice materials, oral board scripts, notes, encrypted Reader bundles, locally merged Reader bundles, transfer phrases, transcripts, checklist results, local practice attempts, bundled audio, and related study outputs.
• Google account information, when you connect Google features, such as your Google email address and OAuth authorization tokens.
• Google Drive and Google Docs content, only when you explicitly use Google import or export features.
• OneDrive folder and file metadata, selected file contents, export files, and OAuth connection information when you use optional OneDrive features, as described in Section 6A.
• Microphone audio and speech recognition data processed by the platform speech provider when you choose mobile Reader Oral Board speech practice, as described in Section 7.
• Approximate desktop or iOS Reader location, only when you explicitly choose to use or refresh it for Swing Shift sunrise and sunset scheduling. This information remains in local app settings and is not collected by Graywheel.
• Live Sync information, when you enable the feature, including client-encrypted eligible study materials and the account, workspace, device, object, revision, activity, security, and deletion metadata needed to synchronize and protect them.
• Technical information, such as app version, operating system, hardware and resource characteristics, error messages, update status, Local AI runtime and model status, workflow timing and performance measurements, support reports, product feedback, optional screenshots you choose to attach, and diagnostic information you choose to export or send.

2. Google User Data Accessed

PolicyVector uses Google APIs only for user-facing features that you explicitly start.

PolicyVector may request access to the following Google OAuth scopes:

• https://www.googleapis.com/auth/drive.file: used to create, edit, and manage Google Drive files that you export from PolicyVector, and to import files you explicitly select through Google Picker or platform file-selection flows, including encrypted PolicyVector Reader bundles selected by the mobile Reader.

Depending on the Google feature you choose, PolicyVector may access or interact with:

• Your Google account email address and Google connection status.
• Google identity proof, such as an ID token, when Google Sign-In is used to verify PolicyVector license entitlement.
• Google OAuth authorization codes, access tokens, refresh tokens, and token expiration metadata.
• Google Drive file metadata for files you explicitly select, such as names, IDs, and MIME types.
• The Google Doc file that you explicitly select for import, including the exported DOCX bytes needed to create a local PolicyVector study item.
• The Google Sheet or XLSX file that you explicitly select in Google Drive for import, including spreadsheet contents and the exported or downloaded XLSX bytes needed to import local flashcards or multiple-choice questions.
• The encrypted PolicyVector Reader bundle file that you explicitly select for import on iOS or Android.
• PolicyVector-generated study files that you explicitly export to Google Drive, such as Google Docs or Google Sheets created from your local study materials.

3. Google User Data Usage

PolicyVector uses Google user data only to provide the Google workflow you request:

• Verify your license entitlement when you sign in with Google for PolicyVector desktop or the mobile Reader.
• Show Google Drive folders, Google Docs, Google Sheets, XLSX files, and likely encrypted PolicyVector Reader bundles that your account is allowed to access so you can select a document, spreadsheet, or bundle for import.
• Download the single Google Doc that you explicitly select and convert it into a local PolicyVector study item.
• Export or download the single Google Sheet or XLSX file that you explicitly select and process its contents locally to import flashcards or multiple-choice questions.
• Download the single encrypted PolicyVector Reader bundle that you explicitly select and unlock it locally in the mobile Reader.
• Create or update Google Drive files that you explicitly export from PolicyVector.
• Maintain local connection state so PolicyVector can complete requested import and export workflows without asking you to sign in for every action.
• Display success, error, and authorization status messages related to the Google workflow you started.

PolicyVector does not use Google user data for advertising, profiling, or unrelated analytics. PolicyVector does not sell Google user data. PolicyVector does not use Google Drive or Google Docs content to train generalized AI or machine learning models.

PolicyVector's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

4. Google User Data Sharing

PolicyVector does not sell, rent, or share Google user data with advertisers or data brokers. PolicyVector does not share Google user data with third parties except in the limited situations needed to provide the app features you request or comply with law.

Google user data may be shared or transferred only as follows:

• With Google APIs, to complete the Google Drive or Google Docs import/export action you request.
• With PolicyVector licensing systems, to verify license entitlement when you use Google Sign-In for desktop or mobile Reader access.
• With your local PolicyVector desktop app, where imported Google Doc, Google Sheet, and XLSX content and exported study materials are processed as local study content on your device. Selected spreadsheet contents do not pass through PolicyVector licensing servers.
• With service providers only if necessary to operate, secure, or support PolicyVector, and only under obligations consistent with this Privacy Policy.
• With authorities or other parties if required by law, legal process, or to protect the security and integrity of PolicyVector and its users.
• With support personnel only if you deliberately provide Google-related information or files for troubleshooting, or if access is necessary for security or legal reasons.

Human review of Google Drive or Google Docs content is not part of normal app operation. We do not allow humans to read your Google Drive or Google Docs content unless you explicitly provide that content for support, it is necessary for security or legal reasons, or you otherwise give permission.

5. Google User Data Storage and Protection

Google authorization tokens are stored locally on your device and protected using the operating system's local protection mechanisms where available.

For Google Docs export, PolicyVector may store a protected refresh token locally so you can export documents without signing in every time.

For Google Drive import, PolicyVector stores only temporary access needed for the active chooser/import session.

Google authorization codes, Google tokens, selected document metadata, exported Google Doc content, and imported Google Doc, Google Sheet, and XLSX content are not sold or used for advertising.

Google API requests use encrypted transport. PolicyVector limits Google access to the scopes needed for the user-facing import and export workflows and stores only the Google data needed to complete those workflows.

6. Google User Data Retention and Deletion

Google authorization tokens remain on your device until you disconnect Google features, revoke access, uninstall PolicyVector, delete the app's local data, or the tokens expire or are replaced.

Google Picker metadata and temporary Google Drive import session data are retained only as long as needed to complete the active selected-file import workflow, unless retained locally as part of normal app state needed to finish the requested action.

Imported Google Doc, Google Sheet, and XLSX content becomes local PolicyVector study content after import and remains on your device until you delete it from PolicyVector or remove the app's local data. Files exported to Google Drive remain in your Google Drive until you delete them there.

You can revoke PolicyVector's Google access from your Google Account security settings. Where supported in the app, you can also disconnect Google features from within PolicyVector. To request help deleting account, license, support, or other server-side records associated with PolicyVector, contact us at privacy@graywheelhq.com.

6A. Microsoft OneDrive

OneDrive is an optional connection, separate from Microsoft licensing sign-in. The desktop app can import selected study documents and spreadsheets and export study materials to OneDrive. The iOS Reader can import selected encrypted Reader bundles. You can use local study features without connecting OneDrive.

Desktop connections request Microsoft Graph Files.ReadWrite and offline_access. This permission allows reading, creating, updating, and deleting the signed-in user's files; it is broader than access to the PolicyVector folder alone. PolicyVector uses it to browse folders, download files you select, and create export folders and files you request. It does not scan or download your entire library or use this integration to delete your existing OneDrive files. Older app-folder-only connections require renewed consent for exports outside the Apps folder. The iOS import connection requests Files.Read, which allows reading the signed-in user's files, and downloads the bundle you select.

PolicyVector processes folder and file names, identifiers, file types, sizes, download links, selected file contents, authorization codes, access tokens, and applicable refresh tokens and expiration metadata to complete these workflows. File transfers go directly between your device and Microsoft services; OneDrive file contents and connection tokens are not routed through Graywheel licensing or Live Sync servers as part of the OneDrive transfer. Imported content becomes local study content and may subsequently be processed by other features you choose, including eligible Live Sync or cloud AI workflows described in this policy.

On desktop, the refresh credential is protected locally using macOS Keychain or Windows DPAPI and retained to maintain the connection until you disconnect or remove it. Access tokens are cached in memory until expiry or invalidation. The iOS OneDrive importer keeps its access token in memory and does not persist a OneDrive refresh token. PolicyVector does not use OneDrive data for advertising, sell it, or use it to train generalized AI or machine learning models.

New desktop exports are stored in OneDrive/PolicyVector, organized by study type. Reader bundles retain their package encryption; ordinary Word, Excel, and other raw exports do not receive Reader-bundle encryption. Microsoft processes and retains these files under its applicable terms, privacy policies, and your account or organization's settings. See the Microsoft Privacy Statement.

Desktop Settings → Account & Storage → OneDrive → Disconnect clears the saved local connection and in-memory authorization. Disconnecting does not delete imported local content, exported OneDrive files, or copies held by others, and does not revoke Microsoft's account-wide consent. Manage consent through your Microsoft account or organization and delete exported files in OneDrive separately. Deleting your PolicyVector account does not delete your OneDrive exports. Older exports in Apps/PolicyVector Licensing remain there unless you move or delete them.

7. Local Study Content

PolicyVector stores your study library and generated study materials locally on your device unless you choose to export, back up, share, or send content to another service.

Your local study content may include documents, outlines, flashcards, multiple-choice questions, oral board scripts, transcripts, and other study artifacts.

On iOS and Android, PolicyVector Reader imports encrypted study bundles into app-local storage and can merge imported bundles into new app-local Reader bundles. The Reader stores local flashcard progress, Multiple Choice attempts, Oral Board practice transcripts, checklist results, and attempt history on the device. The Reader does not upload imported or merged bundle contents, transfer phrases, transcripts, checklist results, bundled audio, or study progress to PolicyVector licensing servers.

On iOS, Reader-owned imported bundle data, bundled audio, flashcard progress, Multiple Choice attempts, and Oral Board attempt history are stored in app-local Application Support storage that the app marks as excluded from device backups.

When you choose to share an imported package from the iOS Reader, the Reader creates a newly encrypted copy on your device with a fresh transfer phrase and presents only the encrypted file to the iOS sharing service you select. The shared package may contain the imported study materials and valid bundled audio. It does not include your PolicyVector account or license information, Google tokens, device information, local flashcard progress, Multiple Choice attempts, Oral Board attempts or transcripts, or checklist results. PolicyVector does not receive the shared package, transfer phrase, recipient identity, selected sharing destination, or delivery status.

The transfer phrase is presented separately so you can provide it through a different channel. AirDrop, Messages, Mail, Files providers, and other services you select handle the file under their own terms and privacy practices. Anyone who obtains both the encrypted package and its transfer phrase may be able to read the package in a compatible Reader. Copies may remain with recipients or third-party services after you delete your local copy; PolicyVector cannot recall, revoke, or remotely delete a package you shared.

Mobile Reader Oral Board speech practice uses native device speech recognition after you grant microphone and any required speech recognition permission. On iOS, this uses Apple's Speech framework and requires on-device recognition when the recognizer supports it. When on-device recognition is unavailable, audio may be sent to Apple for processing. On Android, the Reader uses the configured system speech recognition provider, which may send audio to its servers for processing. Such processing is subject to the platform permission prompts and the speech provider's privacy practices.

The Reader saves transcript text and checklist result data locally after practice, but PolicyVector does not save microphone audio. Local transcript storage does not mean that speech recognition audio always remains on your device. As described in Section 8, eligible transcript text may also be synchronized in encrypted form when you enable Live Sync.

8. Encrypted Live Sync

Live Sync is an optional service that synchronizes eligible study materials and, when enabled, policy library content between supported PolicyVector desktop and Reader devices. The licensing service authenticates account entitlement and issues short-lived authorization to a separate synchronization service. You can use PolicyVector's local study features without enabling Live Sync.

Eligible content is encrypted on an authorized device before upload. The synchronization service stores ciphertext and does not receive plaintext study or policy content, private encryption keys, or recovery code. Eligible study materials can include outlines, flashcards, multiple-choice materials, Oral Board materials and encrypted transcript text, favorites, progress, and study activity. When Include Policy Library is enabled on a supported desktop (selected by default), original and redacted PDFs, highlights, policy views, and related user-created library data also synchronize with end-to-end encryption. Library titles and file metadata carried with that content are encrypted. Practice microphone audio is not synchronized. Authorized devices decrypt downloaded content locally; Reader download settings let you choose Wi-Fi, allow cellular downloads, or save storage by downloading policies on demand.

End-to-end encryption does not hide every operational fact. The synchronization service and its hosting and network providers may process opaque account, workspace, generation, device, operation, entity, collection, and revision identifiers; bounded content-category or scope labels; public device keys and key identifiers; ciphertext sizes and digests; counts, sequence and cursor positions, quota use, and approximate activity times; membership, enrollment, recovery, and deletion state; protocol and cipher-suite versions; signed request and receipt metadata; IP and network information; request timing; and service result codes. This metadata is used to authenticate devices, synchronize changes, prevent stale data from returning, enforce limits, investigate abuse or failures, and protect the service.

Authorized Graywheel administrators can view whether your account has activated Live Sync, when its current workspace was activated, the latest successful device sync acknowledgment, and current encrypted storage usage counted toward its quota. We use these account-linked operational metrics for customer support, troubleshooting, and capacity management. The licensing service retrieves current sync metrics through a private service connection; this does not give administrators access to decrypted study content, filenames, or policy titles. We keep one latest acknowledgment timestamp rather than a sync-activity history, and remove it when the workspace is deleted. Existing account activation and deletion records follow the account and security retention periods described in this policy.

PolicyVector uses Cloudflare infrastructure to operate and protect Live Sync, including encrypted object storage, synchronization state, queues, and operational security records. If content-free push hints are enabled for an Apple device, PolicyVector also sends Apple Push Notification service a device token and a silent notification containing no study content, title, account information, or transcript. The device token is protected at rest by the synchronization service, but it is not protected by the study-content end-to-end encryption because the service must use it to contact Apple.

Your authorized devices and recovery code control access to the encrypted workspace. Graywheel cannot use the recovery code or decrypt Live Sync content for you. If every authorized device and the recovery code are lost, the encrypted content may be permanently unrecoverable. Removing a device revokes that device without deleting the workspace. Disabling Live Sync on one device stops that device from synchronizing but does not by itself delete the server workspace. Start Over With Live Sync deletes the synchronized workspace and disconnects all devices; it does not delete local policy PDFs, redaction work, or local study records.

Deleted synchronized collections retain associated ciphertext and anti-resurrection tombstones for at least 180 days and, when necessary, longer until non-stale active devices have acknowledged the deletion. A workspace or account deletion immediately marks the synchronized workspace deleted, revokes memberships and pending enrollments, destroys server-held recovery material, and starts a bounded purge of encrypted objects. Limited signed deletion-proof records containing opaque identifiers, deletion and purge status, and related timestamps may be retained for up to ten years to prevent deleted workspaces from reappearing after infrastructure restoration and to document deletion completion.

9. Shift Mode and Approximate Location

Swing Shift can follow local sunrise and sunset times. You may explicitly choose Use Approximate Location or Refresh Approximate Location in the supported desktop or iOS Reader app. PolicyVector does not request location on launch. The operating system supplies a one-time location only after its native permission flow, and PolicyVector rounds the result to one decimal place before shared application code stores it in local settings.

The rounded coordinates and the time they were saved remain on your device. PolicyVector does not send them to Graywheel, the licensing service, update systems, AI providers, support reports, diagnostics, Reader bundles, or any location service. PolicyVector does not use continuous or background location tracking, browser geolocation, IP geolocation, reverse geocoding, weather services, or cloud location APIs for this feature.

You can choose Forget Saved Location at any time. Swing Shift also works without location by using the Day and Night/Graveyard start times you set. A denied, cancelled, unavailable, or timed-out refresh does not delete a previously saved valid location.

PolicyVector's normal desktop runtime backup excludes settings.json. A full desktop data-root copy or migration, or an operating-system device backup containing iOS Reader preferences, can contain the rounded coordinates and should remain private under your control. Old backups or manually created copies can retain those coordinates until you delete those copies.

10. AI Features

PolicyVector may include local AI and cloud AI features.

Local AI features run on your device when configured and do not require sending study content to a cloud AI provider.

Cloud AI features may send the specific content needed to complete the requested AI task to the configured AI provider. A larger or multi-source task may send selected source excerpts and instructions through multiple requests, including bounded retry or repair requests when needed to finish the task. PolicyVector is designed to warn or restrict use of sensitive or unredacted content where applicable. You should review any third-party AI provider's privacy terms before using cloud AI features.

11. Licensing, Payments, and Updates

PolicyVector may use third-party services for licensing, payment processing, updates, and fraud prevention.

Payment information is handled by our payment processor. PolicyVector does not store full credit card numbers.

After a verified paid checkout grants or extends access, PolicyVector may send a transactional welcome email to the licensed purchase email with public desktop download, Reader, App Store, and support links. PolicyVector may retain the delivery status, provider message identifier, and a privacy-safe delivery error code associated with the Stripe event and checkout session. The welcome email does not include card details, payment method data, billing addresses, or the raw Stripe webhook payload.

We may send release update emails to addresses with active, unexpired PolicyVector license access. These emails describe a new software version, user-facing changes, and download instructions. We use your license email and access status to select recipients and keep release, send-status, provider message identifier, and unsubscribe records to administer these notifications and prevent duplicate sends. Messages are sent individually through Cloudflare Email Service. You can stop release update emails using the unsubscribe link; licensing, security, and requested support messages are unaffected.

Licensing systems may process your email address, license status, app-generated device fingerprint hash, device label, app version, platform, session metadata, license replacement or move history, and activation or update metadata.

Supported desktop and iOS licensing clients can use Microsoft browser sign-in alongside their other available sign-in providers. For Microsoft sign-in, PolicyVector processes signed Microsoft identity proof, a stable tenant-scoped account identifier, and Microsoft-provided email or display-name hints. Those hints do not prove which email owns a PolicyVector license. When a Microsoft identity is linked for the first time, PolicyVector separately verifies the licensed email using the email address and one-time code you enter.

For Microsoft licensing sign-in, authorization codes, ID tokens, PKCE values, nonce values, and short-lived return tickets are used only to complete and verify the sign-in transaction. For that licensing flow, PolicyVector does not retain Microsoft authorization codes, ID tokens, access tokens, refresh tokens, PKCE values, nonce values, or return tickets after that transaction. OneDrive credentials are handled separately as described in Section 6A.

The iOS Reader can verify licensing with Google Sign-In, Sign in with Apple, or Microsoft browser sign-in. Microsoft licensing sign-in does not request Microsoft Graph access or Microsoft 365 content. For Sign in with Apple, PolicyVector may process the Apple user identifier, Apple-provided email address or Hide My Email relay address, Apple identity token or authorization code, and the licensed email address and one-time verification code you enter when linking an Apple sign-in to an existing PolicyVector license. If Apple provides a refresh token for revocation support, PolicyVector stores it only for account-management purposes such as revoking Sign in with Apple access during account deletion.

Authorized PolicyVector administrators may view limited linked-identity metadata for account support, including the provider, provider-supplied email hint, link date, and last-use date. The administrative browser does not receive provider account identifiers or provider tokens. An authorized owner may disconnect one PolicyVector identity mapping. Disconnecting a mapping does not revoke the PolicyVector license, sign out active devices, or claim to revoke authorization in the user's Google, Apple, or Microsoft account. Administrative disconnects are recorded in PolicyVector's security audit log.

12. Website, Browser Storage, and Tracking

PolicyVector does not use the public website or app for cross-site behavioral advertising and does not include third-party advertising pixels or advertising analytics. PolicyVector and its hosting, identity, and security providers may process ordinary request information, such as IP address, user agent, request path, timestamps, and security signals, to deliver and protect the website and connected services.

PolicyVector and its identity or security providers may use cookies, session storage, or similar browser storage when necessary for sign-in, administrative access, security, or functional interface state. This storage is not used by PolicyVector for advertising. Because PolicyVector does not conduct cross-site advertising tracking or sell or share personal information for cross-context behavioral advertising, browser Do Not Track and Global Privacy Control signals do not change that behavior.

13. Sharing of Information

We do not sell your personal information.

We may share limited information only when necessary to:

• Provide app functionality you request.
• Host, transmit, synchronize, secure, and delete client-encrypted Live Sync data.
• Process payments or licensing.
• Deliver updates.
• Provide support or troubleshoot problems.
• Send metadata-only support notifications to configured Graywheel support recipients.
• Comply with legal obligations.
• Protect the security and integrity of PolicyVector.

Support notification emails do not include diagnostic packages, screenshots, local logs, policy content, prompts, completions, auth tokens, license tokens, or other attachments. When you provide a valid contact email with a support request, PolicyVector may send a receipt containing the report number, request type, selected topic, and submission time. The receipt does not repeat your message or include diagnostics, screenshots, policy content, or attachments.

A support diagnostics bundle that you export remains on your device unless you choose to provide it. When you submit a bug report, PolicyVector automatically attaches a sanitized diagnostics package that can include app and operating-system details, hardware and resource measurements, workflow timings, update and error state, and Local AI runtime and model status. Before transmission, PolicyVector removes raw logs and is designed to exclude identifying information, policy text, filenames, prompts, completions, API keys, authentication or license tokens, and other credentials. Screenshots are attached only when you select them and may contain whatever information is visible in the captured image.

14. Data Retention

Local study content remains on your device until you delete it or uninstall/remove the app data.

On iOS and Android, deleting an imported or merged Reader bundle removes the bundle from the Reader library and removes associated local practice state where the app supports that cleanup. The iOS Reader includes Delete Local Data, which removes Reader-owned local bundles, flashcard progress, Multiple Choice attempts, Oral Board attempts, transcripts, checklist results, license state, and device-local account state from that device. Android local data deletion also removes imported bundles, flashcard progress, Multiple Choice attempts, Oral Board attempts/transcripts, license state, and device-local account state. Uninstalling the mobile Reader or removing its app data removes app-local Reader bundles and local study state from that device.

Google access can be disconnected from within PolicyVector where supported. You can also revoke PolicyVector's Google access from your Google Account security settings.

Google, Apple, and Microsoft identity mappings are retained while they remain linked to the PolicyVector account and as needed for account administration, security, and legal obligations. A selected identity mapping can be removed through authorized account support, and identity mappings are removed when the associated PolicyVector account is deleted where supported. Removing a PolicyVector identity mapping does not automatically remove provider-side authorization; provider-side access controls remain available in the user's Google, Apple, or Microsoft account settings.

Licensing and payment records may be retained as needed for account administration, fraud prevention, legal compliance, and business records.

To enforce one trial per verified identity, we retain a keyed, coded identifier for the sign-in provider identity and its first trial-use date for as long as the lifetime trial eligibility rule applies, including after account deletion. This limited record does not contain policy content or a plaintext email address. It is pseudonymous, not anonymous. Deleting cloud data or recreating an account does not reset trial eligibility.

Support records are retained according to report type: bug reports and support requests for 90 days, and product feedback for 180 days. Submitted report metadata and associated private support-report packages, including screenshots that you intentionally attach, follow those periods unless an active support, legal, security, billing, or abuse issue requires longer retention.

Live Sync retention and deletion are described in Section 8. Encrypted synchronized content remains on the service while its workspace is active, subject to synchronization history, deletion, safety, and quota rules. Disabling Live Sync or removing one device does not delete the workspace; Start Over With Live Sync or account deletion initiates workspace deletion.

Account and cloud-data management remains available after trial expiry following sign-in. You may delete cloud-stored libraries and study materials while keeping your account, or delete your account and its cloud content. Sync remains suspended after cloud-data deletion until you explicitly authorize a new setup with an active license. Independent downloaded or exported copies can remain on your devices. The mobile Reader includes Delete Account where supported. When you delete your account from the Reader, PolicyVector removes or revokes the account, license session, device, identity, app-entitlement, Apple token, and related licensing records that PolicyVector controls, revokes beta website access where applicable, and initiates deletion of the account's Live Sync workspace where one exists. Payment records and records required for legal, tax, security, fraud-prevention, or dispute purposes may be retained as required or permitted by law.

15. Security

PolicyVector uses reasonable technical and organizational safeguards to protect information. These safeguards may include local token protection, secure transport for network requests, access controls, and limited data collection.

PolicyVector may maintain limited operational and security logs for account administration, support, abuse prevention, and system security. These logs may include administrator action records, timestamps, affected account, license, or support identifiers, request identifiers, and hashed network or user-agent metadata. These logs are not used for advertising.

No system can guarantee perfect security. You are responsible for protecting access to your device, connected accounts, shared Reader packages, and transfer phrases.

16. Your Choices

You can:

• Use PolicyVector without connecting Google features or OneDrive.
• Disconnect OneDrive locally in desktop Settings, manage Microsoft consent through your account or organization, and delete exported files separately in OneDrive.
• Disconnect Google Docs export or Google Drive import.
• Revoke Google OAuth access through your Google Account.
• Stop using Sign in with Apple for PolicyVector through your Apple Account settings where Apple provides that option.
• Choose another Microsoft account during Microsoft sign-in and manage PolicyVector authorization through your Microsoft account or organization where available.
• Contact us to inspect or disconnect a Google, Apple, or Microsoft identity mapping associated with your PolicyVector license.
• Use, refresh, or forget the approximate location saved for desktop or iOS Reader Swing Shift, or use the adjustable fallback schedule without granting location access.
• Choose whether to enable Live Sync, remove an authorized device, or delete the synchronized workspace.
• Delete local study content from your device.
• Use Delete Local Data in the mobile Reader where supported to remove Reader-owned local data from that device.
• Use Delete Account in the mobile Reader where supported to request deletion of your PolicyVector account and revocation of related licensing access.
• Delete imported Reader bundles and locally saved Reader practice state from the mobile Reader where supported.
• Contact us to request help with account, license, or support data.

17. Children's Privacy

PolicyVector is not intended for children under 13, and we do not knowingly collect personal information from children under 13.

18. Changes to This Policy

We may update this Privacy Policy from time to time and will post the updated policy with a new effective date. If a change materially affects how PolicyVector collects, uses, stores, shares, retains, or deletes personal information, we will provide additional notice or request consent where required. If we materially change how PolicyVector handles Google user data, we will also comply with the Google API Services User Data Policy and, where required, ask users to consent before using Google user data in a new way.

19. Contact

Graywheel
privacy@graywheelhq.com
https://policyvector.app

Back to PolicyVector · Terms of Service