Privacy Policy · Obelisk

Scope

This Policy explains how VaultSpark Studios LLC ("VaultSpark", "we", "us") handles personal data when you use Obelisk at obeliskgate.com and the Obelisk identity service (the "Service"). It applies to individual account holders and to organization members.

Data we process

Category	What	Why
Account identifiers	Your chosen username and display name	To identify your account and present it to you and relying parties
Passkey credentials	Public keys + credential IDs (never private keys)	To verify your sign-ins
Authentication factors	TOTP secret (encrypted) and recovery-code hashes, if you enable them	Second-factor and recovery
Session & device metadata	Device identifiers, session timestamps, scopes	Security, session management, anomaly detection
IP address	The address your request comes from. Our rate limiters hold it in memory only, while it counts toward a limit or a lockout. Within about a minute after that it is dropped, and a restart clears it. A request counter that watches our limiters keeps only a hash of it. Our audit records store a hash of it instead of the address. That is a pseudonym, not anonymisation: the address space is small enough that a hash can be matched back. Our bot check sends it to Cloudflare (see Subprocessors).	Rate limiting, abuse and bot protection
Email	Only if you provide one (e.g., for magic-link or org invites)	To deliver sign-in links and invites
Security receipts	Hashed, chained records of sensitive actions (no secrets)	Tamper-evident audit
Organization & project data	Org membership/roles; per-project profile slices a project stores about you	Team features and the on-top project layer

What we do NOT do

We do not use passwords — there is none to store.
We do not receive or store your biometrics; they never leave your device.
We do not set advertising or cross-site tracking cookies, and we do not sell or rent personal data.
We do not log secret material (private keys, TOTP secrets, session tokens).

How we use it & legal bases

We process data to provide and secure the Service (performance of a contract), to protect accounts and detect abuse (legitimate interests and legal obligation), and — where applicable — with your consent (e.g., optional product-update emails). Organization and project-profile data is processed on behalf of the relevant organization or relying party.

Retention

We keep account data for as long as your account exists. Security receipts are retained to preserve audit integrity. When you delete your account, we remove your identity record and credentials; immutable audit entries are minimized to the extent compatible with their tamper-evidence purpose.

Your rights

Subject to applicable law (including GDPR/UK GDPR and similar regimes), you may access, export, correct, or delete your data and object to or restrict certain processing. You can export a portable copy any time from your account, and delete it yourself from your account (or ask via privacy@obeliskgate.com). You may also lodge a complaint with your supervisory authority.

Security

We encrypt the identity database at rest (AES-256-GCM), build the Service not to expose secret material through its APIs, and maintain a tamper-evident audit. See the Security page for details.

Subprocessors

These are the service providers that process personal data for us when you use the Service. We list only what our code actually sends them.

Provider	What they do for us	Data involved
Hetzner Online	Hosts the servers that run the Service	All Service data at rest and in use, including the encrypted identity database
Cloudflare	Bot protection on sign-up and contact forms (Turnstile); storage for our encrypted off-site backups (R2); content delivery and network protection in front of some of our hosts	IP address and browser signals for the bot check; encrypted backup files; request metadata where traffic passes through them
Brevo	Delivers our transactional email: sign-in links, organization invites, security alerts	Your email address and the message we send you
Stripe	Billing for paid plans	Billing contact and payment details for paying organizations; Stripe collects card details directly, and we never see your full card number

International transfers

Our providers above may process data in more than one country. Where data is transferred across borders, we rely on appropriate safeguards consistent with applicable law.

Children

Obelisk is not directed to children under 16, and we do not knowingly process their personal data.

Cookies

Obelisk uses only strictly-necessary cookies. See the Cookie Policy.

Changes & contact

We will update this Policy as the Service evolves and post the new "last updated" date. Questions: privacy@obeliskgate.com.