Privacy Policy
This Privacy Policy describes how Tricon Strategic Intelligence ("Tricon", "we", "us") collects, uses and protects information when you access the Vault application — whether through the iOS app, the Android app, or the web at tricon-monitor.ai/vault-mobile.html. By using Vault you accept the practices described here.
Who Vault is for
Vault is a private, internal-use and partner-use intelligence surface for petrochemical desk personnel and authorised counterparties. It is not a consumer product and is not advertised. Access is gated by a shared organisational password; no public registration is offered.
What we collect
| Data type | What it is | Where it lives |
|---|---|---|
| Access password | A single shared organisational password used to gate the app | Validated client-side only; never transmitted, stored or hashed remotely |
| Lens preference | Which operator-agent lens (Trader, Risk, Ops, Strategic, Commercial, Compliance) is active | Browser/app local storage on your device |
| Conversations | The text of your questions and the Vault's HTML answers | Browser/app local storage on your device (up to 50 most-recent threads) |
| Saved reports and scenarios | Reports and hypothetical vectors you explicitly save | Browser/app local storage on your device |
| API call payload | The current question plus the canonical-state context sent to the AI backend to generate an answer | Transmitted in transit over TLS to tricon-monitor.ai |
What we do NOT collect
- No name, email, phone number, IP address logged with your identity, or any other personally identifying field
- No analytics SDKs (no Google Analytics, no Mixpanel, no Sentry, no third-party trackers)
- No advertising identifiers (IDFA, AAID)
- No device contacts, photos, microphone, location, or any other sensor data
- No payment information — Vault is not transactional
How we use information
Information is used solely to:
- Render the Vault's canonical state (scenarios, prices, freight, sulphur, geopolitical timeline, and integrated research) on your device
- Generate AI-assisted answers via the Anthropic API (Claude models) invoked through our
ai-streambackend function - Persist your local conversations, saved reports, and scenario simulations on your device only
We do not sell, rent, lease or share user-side data with third parties for marketing or any other purpose.
Third-party services
Vault relies on the following service providers strictly to deliver the product. Each receives only the minimum data required to function.
| Provider | Purpose | What they receive |
|---|---|---|
| Anthropic, PBC | AI model inference (Claude Sonnet, Claude Haiku) | The current question, conversation history within the session, and compact canonical-state context. Anthropic processes inputs to generate responses and does not train on or retain commercial API inputs (commercial terms). |
| Netlify, Inc. | Web hosting + serverless functions (the canonical-state and AI proxy endpoints) | HTTPS request metadata necessary to route the call (URL, timestamp). No application-layer personal data. |
| Apple, Inc. / Google LLC | App Store / Play Store distribution and (optional) push notifications via APNs / FCM | If push is enabled by the user, a per-device push token. No further linkage to identity. See Apple and Google's own privacy policies for any data they collect at the store level. |
Data storage and retention
On your device: conversations, saved reports, scenario simulations, lens preference, and the most recent canonical-state cache are stored only on your device (browser local storage or app sandbox). Signing out clears the session token; deleting the app or browser data clears the local store entirely.
On our servers: Vault does not maintain a per-user database. There is no user table, no profile, no usage log keyed to an identity. The Anthropic API call returns a streamed response and is not stored on the Vault backend.
Retention: Because no identified user record exists on our side, there is no retention period to disclose; nothing identifiable is held to delete.
Security
- All traffic between the app and
tricon-monitor.aiis encrypted with TLS 1.3 - The Anthropic API key is never exposed to the client — calls are proxied through the Netlify serverless function
- The access password is verified client-side and never leaves the device in plain text or as a hash
- The native app shell uses the system WebView with App Transport Security (iOS) and cleartext traffic disabled (Android)
- No third-party SDK has access to your conversations or saved content
Your rights
Because we do not collect identifying information server-side, there is no remote record to access, correct, port, or erase. To clear all local Vault data, sign out of the app and either uninstall it or clear browser site data for tricon-monitor.ai.
If you believe Vault has collected information about you in a manner inconsistent with this policy, contact us at the address below.
Children
Vault is intended for professional adult users. We do not knowingly direct it at children under 16 and do not collect data from children.
International users
Vault is operated from the United States. By using it from outside the U.S. you understand that limited application-layer data (the question and canonical-state context sent to Anthropic) transits to U.S. infrastructure for processing.
Changes to this policy
We may update this policy as the product evolves. When we do, we update the effective date at the top. Material changes are communicated through an in-app notice on next launch.
Privacy inquiries: vault@triconenergy.com
Confidentiality: this product is internal & partner-use only.