Website Privacy Policy

1. What information do we collect?

The kind of Personal Information that we collect from you will depend on which Valaciel product or service you use.

Contacting us

• email address (when you contact us)

Gloam (account holders)

• email address and sign-in provider identity (Google, GitHub, or Discord)
• profile information (e.g. display name, currency, timezone, app preferences)
• expense and receipt data synced to our servers (not photos) — encrypted by default; if you turn encryption off in the app, this data may be stored in plain text (amounts, dates, categories, merchant/store names, notes, OCR-derived fields). Receipt photos and images never leave your device
• shared expense information if you use Ponds (membership, invites, shared receipts and comments — encrypted by default)
• subscription and entitlement status
• Discord account link, if you choose to connect Discord
• usage and authentication metadata (e.g. daily usage counts, sign-in timestamps, IP address)

Still Falling (Patreon sign-in)

• Patreon user identifier
• reading progress (list of chapters read, last chapter read, last updated time)

Products with no server-side storage

• Gloam Assets Vault: data remains on your device; we do not store your vault contents on our servers
• Luminary: usage CSV files are processed in your browser; we do not receive your CSV data
• valaciel.com portfolio pages: no accounts or on-site analytics; no first-party cookies

2. Types of information

The Privacy Act 1988 (Cth) (Privacy Act) defines types of information, including Personal Information and Sensitive Information.

Personal Information means information or an opinion about an identified individual or an individual who is reasonably identifiable:

• whether the information or opinion is true or not; and
• whether the information or opinion is recorded in a material form or not.

If the information does not disclose your identity or enable your identity to be ascertained, it will in most cases not be classified as “Personal Information” and will not be subject to this privacy policy.

Sensitive Information is defined in the Privacy Act as including information or opinion about such things as an individual's racial or ethnic origin, political opinions, membership of a political association, religious or philosophical beliefs, membership of a trade union or other professional body, criminal record or health information.

Sensitive Information will be used by us only:

• for the primary purpose for which it was obtained;
• for a secondary purpose that is directly related to the primary purpose; and
• with your consent or where required or authorised by law.

3. How we collect your Personal Information

We may collect Personal Information from you whenever you input such information into the Website, related app or provide it to Us in any other way.

We generally don't collect Sensitive Information, but when we do, we will comply with the preceding paragraph.

Where reasonable and practicable we collect your Personal Information from you only. However, sometimes we may be given information from a third party; in cases like this we will take steps to make you aware of the information that was provided by a third party.

4. Where we store information

Personal Information processed on our behalf may be stored or processed outside Australia. Where this occurs, we take reasonable steps to ensure overseas recipients handle your information in accordance with this policy and applicable law.

5. Encryption

• Default: Gloam encrypts synced receipt data (metadata, payloads, and OCR-derived fields) before upload. In this mode, Valaciel cannot read your encrypted receipt content without your encryption keys.
• If you disable encryption: Synced receipt data may be stored on our servers in plain text.
• Receipt photos are never uploaded — they remain on your device regardless of your encryption setting. OCR runs on-device.
• Account and profile fields (email, display name, subscription status, etc.) are stored in readable form so we can operate the service.
• Pond shared data follows the same encryption model (encrypted by default; no receipt photo upload).

6. Purpose of collection

We collect Personal Information to provide you with the best service experience possible across our Website, applications, and products, and to keep in touch with you about developments in our business.

We customarily only disclose Personal Information to our service providers who assist us in operating the Website, our applications, and related infrastructure. Your Personal Information may also be exposed from time to time to maintenance and support personnel acting in the normal course of their duties.

Our service providers include:

• Supabase — Gloam authentication and database (receipt data, profiles, ponds)
• Cloudflare — Still Falling reading progress (KV) and site hosting
• Patreon — Still Falling authentication (subject to Patreon's privacy policy)
• RevenueCat — Gloam subscription management
• Google, GitHub, and Discord — Gloam sign-in (subject to each provider's privacy policy)
• Google Fonts — typography on our portfolio and legal pages

All service providers who access Personal Information are required to execute a Data Processing Agreement incorporating obligations consistent with the Privacy Act 1988 (Cth), including restrictions on use, disclosure, and cross-border transfer of data. We reserve the right to audit service provider compliance with these obligations and require prompt notification of any unauthorised access or data breach involving Personal Information.

By using our Website, you consent to the receipt of direct marketing material. We will only use your Personal Information for this purpose if we have collected such information direct from you, and if it is material of a type which you would reasonably expect to receive from use. We do not use sensitive Personal Information in direct marketing activity. Our direct marketing material will include a simple means by which you can request not to receive further communications of this nature, such as an unsubscribe button link.

7. Security, access and correction

We store your Personal Information in a way that reasonably protects it from unauthorised access, misuse, modification or disclosure. When we no longer require your Personal Information for the purpose for which we obtained it, we will take reasonable steps to destroy and anonymise or de-identify it. Most of the Personal Information that is stored in our client files and records will be kept for a maximum of 7 years to fulfil our record keeping obligations.

The Australian Privacy Principles:

• permit you to obtain access to the Personal Information we hold about you in certain circumstances (Australian Privacy Principle 12); and
• allow you to correct inaccurate Personal Information subject to certain exceptions (Australian Privacy Principle 13).

Where you would like to obtain such access, please contact us in writing on the contact details set out at the bottom of this privacy policy.

8. Complaint procedure

If you have a complaint concerning the manner in which we maintain the privacy of your Personal Information, please contact us on the contact details set out at the bottom of this policy. All complaints will be considered by Valaciel and we may seek further information from you to clarify your concerns. If we agree that your complaint is well founded, we will, in consultation with you, take appropriate steps to rectify the problem. If you remain dissatisfied with the outcome, you may refer the matter to the Office of the Australian Information Commissioner.

Upon receiving your complaint, we will acknowledge receipt within 14 business days and endeavour to resolve the matter within 30 days. If we are unable to resolve your complaint within that period, we will notify you in writing with an estimated resolution timeframe. You may escalate your complaint to the Office of the Australian Information Commissioner at any stage of this process.

9. GDPR

In some circumstances, the European Union General Data Protection Regulation (GDPR) provides additional protection to individuals located in Europe. Where this is the case, there may be additional rights and remedies available to you under the GDPR if your Personal Information is handled in a manner inconsistent with that law.

10. How to contact us about privacy

Valaciel is an Australian business operating under the registered business name VALACIEL. If you have any queries, or if you seek access to your Personal Information, or if you have a complaint about our privacy practices, you can contact us at privacy@valaciel.com.