Last updated: July 18, 2026
PropVault ("we," "us," or "our") operates propvault.co, a comparison tool for futures prop trading firms. This policy explains what data we collect, why, and how we protect it.
When you create an account, we collect your email address and an optional display name. Accounts are managed through Supabase Auth. We do not store passwords directly; authentication is handled securely by Supabase.
When you subscribe to rule change alerts, we store your email address, subscription preferences (selected firms), and a verification status. Unverified subscriptions do not receive emails. You can unsubscribe at any time via the link in every email.
Reviews you submit include your rating, title, and body text. Reviews are associated with your account and displayed publicly with your display name (or "A Trader" if no name is set).
We use Vercel Analytics for anonymous page view tracking and Core Web Vitals monitoring. If you consent to analytics, we also use Google Analytics 4 (GA4) and custom Vercel Analytics events to measure rollout experiments, exact-plan interactions, and affiliate handoff clicks. Those custom events may include the source route or surface, selected plan, destination firm and referral placement, rollout stage and variant, and an anonymous rollout bucket; they do not include a direct account identifier or the email entered in a follow request. GA4 and custom behavioral events are only used after you grant consent.
When you use an affiliate link, we record the firm, timestamp, referring page, user agent, and IP address. For supported tracked programs, we also record a unique click identifier (sub ID); blocked, unmapped, or website-only handoffs may not have one. If you are signed in, the click may be associated with your account. Affiliate partners may return conversion events connected to that identifier.
Saved comparisons, watched firms, and theme preference are stored to provide a personalized experience. Comparison history is stored in your browser's localStorage.
Essential and functional storage: Theme preference and your analytics consent choice are stored in localStorage. Supabase Auth uses secure, HttpOnly cookies for session management. Feature rollouts use a pv-bucket cookie to keep your browser in a stable anonymous cohort. It uses SameSite=Lax, expires after one year, and is not used for cross-site advertising or to identify you. This storage supports core site behavior and does not require analytics consent.
Analytics cookies: Google Analytics 4 sets cookies for behavior analysis. GA4 and the custom behavioral events described above are only used after you provide consent via the cookie banner. You can withdraw consent at any time by clearing your browser cookies and site storage.
Vercel Analytics: Collects anonymous page view data and Web Vitals without setting analytics cookies. Consent-gated custom events use the functional rollout cohort described above when an experiment applies.
Each service processes data according to their own privacy policies. We do not sell your data to any third party.
PropVault contains affiliate links to prop trading firms. For supported programs, we add a unique click identifier to the partner link so the partner can attribute and report conversion events. The click data described above is not necessarily anonymous and may be linked to a signed-in account.
We keep individual attribution records. For analytical reporting, repeated clicks may be grouped or deduplicated into sessions; that reporting step does not delete the underlying attribution records.
Account data is retained until you delete your account. You can delete your account at any time from the dashboard settings page. Account deletion permanently removes your profile, reviews, saved comparisons, watchlist, and email subscriptions.
Account deletion does not necessarily remove de-identified records or records we must retain for fraud prevention, accounting, affiliate reconciliation, legal compliance, or dispute resolution, including relevant affiliate attribution and conversion records.
Email subscriptions can be removed independently by clicking the unsubscribe link in any digest email.
You have the right to:
We use HTTPS everywhere, secure HttpOnly cookies, rate limiting on all API endpoints, Row Level Security (RLS) in our database, and Content Security Policy headers. Admin access uses HMAC-based authentication with timing-safe comparison.
We may update this policy from time to time. Changes will be reflected by the "last updated" date at the top of this page.
For privacy-related questions, contact us at privacy@propvault.co.