ResearchVault is built local-first. We operate no servers, hold no accounts, and have no technical means of reading anything you write.
Application: ResearchVault (Windows desktop) ·
Publisher: VMH Digital ·
Contact: [email protected]
Effective / Last Updated: July 31, 2026
This Privacy Policy explains how VMH Digital ("we", "us", "our") — the developer and publisher of the ResearchVault Windows desktop application (the "Application") — handles information in connection with the Application and this website (vmhdigital.com/researchvault).
Because the Application stores everything locally and we operate no back end, you remain in sole control of the content you create. We are not a processor of your research data, and we cannot retrieve, restore or inspect it. By installing or using ResearchVault you agree to this policy; if you do not agree, please do not use the Application.
ResearchVault does not collect, harvest, or transmit your research to us. All content you create — projects, project sections, papers, extracted PDF text, highlights and their comments, notes, links between notes, tasks, calendar events, imported files and your settings — is stored in a vault folder on your Windows machine.
There is no ResearchVault account, no sign-in, and no registration of any kind. The Application stores exactly one piece of information about you: the display name you enter in Settings, which is used to greet you on the dashboard. It sits in your vault, on your machine, and is never sent anywhere.
By default your vault is created at C:\Users\<you>\ResearchVault, containing:
This location is deliberately outside the application's own package folder, so that uninstalling ResearchVault cannot take your research with it. Your files sit in ordinary folders you can open in File Explorer at any time — nothing is hidden inside an opaque container.
ResearchVault contains no analytics, no telemetry, no error reporting and no crash reporting that communicates with any server of ours or anyone else's. We do not know how many projects you have, which features you use, how often you open the app, or whether you opened it at all. The Application neither creates nor reads any advertising identifier.
The Application is designed to work fully offline and does not require an internet connection for any research feature. There are only three moments at which anything crosses the network, and you initiate each one:
Two ordinary exceptions are worth stating plainly. First, Windows itself may generate operating-system-level crash reports if the Application stops responding; those are handled by Microsoft under Microsoft's own privacy terms, not by us, and contain none of your research that we can read. Second, if you choose to move your vault into a synced folder such as OneDrive, Dropbox or Google Drive, that provider will sync your files under its own terms — a choice you make, not something the Application does for you. We recommend against it for the database specifically, because cloud sync can copy a live database and its journal at different instants and corrupt it. Use the ZIP backup instead: that is what it is for.
When you import a PDF, ResearchVault copies it into your vault's Papers folder and leaves your original exactly where you put it. It reads the text out of the PDF so the paper becomes searchable, and stores that text in your local database. Nothing about the file is transmitted anywhere, and the file is never opened by us because we never receive it.
Highlights and comments you make while reading are stored separately in your vault. The original PDF is never modified — your copy stays byte-for-byte as it arrived, so it remains valid for citation and for sharing.
The free edition of ResearchVault displays a single banner at the foot of the window promoting VMH Digital's own software. We want to be precise about what that does and does not involve:
Purchasing the ad-free upgrade removes the banner entirely — not merely the image, but the space it occupied.
The ad-free upgrade is purchased through the Microsoft Store as a one-time in-app purchase. Microsoft handles the entire transaction. We never see, receive or store your payment card details, billing address or Microsoft account credentials.
The Application asks Windows a single question — whether the Microsoft account signed in to the Store on this device holds that licence — and stores only the yes-or-no answer locally, so the ad-free layout keeps working when you are offline. Your licence follows your Microsoft account rather than the machine, which is how it becomes available again when you install ResearchVault on another computer and sign in with the same account.
Microsoft's handling of your purchase, payment and Store account is governed by the Microsoft Privacy Statement, not by this policy.
If you install ResearchVault from the Microsoft Store, Microsoft necessarily knows that your account acquired the app, and provides us with aggregated, anonymised reporting such as install counts, ratings and reviews, and crash rates in Partner Center. We cannot identify you from any of it, and it contains none of your research content.
Research often involves information about other people: interview transcripts, participant identifiers, clinical or trial records, survey responses, or notes from a supervision meeting. Where you store such information in ResearchVault, you — not VMH Digital — are the data controller for it under applicable data protection law, including the EU/UK GDPR.
We never receive it, so we cannot respond to an access or erasure request on your behalf. It is your responsibility to ensure you have a lawful basis and any necessary ethical approval to hold it, to keep no more of it than you need, and to respond to requests from the people it concerns. Where a name is not required, we recommend using participant identifiers rather than full personal details. If your institution requires research data to be held in a particular location or under particular controls, check that a local vault satisfies that requirement before relying on it.
Copyright deserves a separate mention. Journal articles you import are usually licensed to you personally. Keeping a copy in your own vault for your own reading is ordinarily fine; redistributing it is not. That judgement is yours to make, not something the Application can make for you.
Because ResearchVault stores everything locally, backups are your responsibility — and the Application gives you the tool for it. Settings → Backup writes your entire vault into a single ZIP that can be restored on any machine. We recommend keeping one on a separate drive.
Your content is retained for exactly as long as you keep it. We impose no retention period and perform no automatic deletion. You can delete any project, paper, note, task or file inside the Application at any time. Deleting your vault folder permanently removes your research from that machine; take a backup first if you want to keep it. We hold no copy, so nothing survives on our side after you delete.
Keeping your research off the internet removes an entire class of risk, but it also means its security depends on your own machine. We recommend using a Windows account password or Windows Hello, enabling full-disk encryption such as BitLocker, keeping Windows updated, and storing backups somewhere protected — particularly where your work is unpublished, commercially sensitive, or contains participant information. ResearchVault does not itself encrypt your vault beyond whatever your disk encryption provides. No method of electronic storage is completely secure, and we cannot guarantee absolute security.
ResearchVault is a professional and academic tool and is not directed to children. We do not knowingly collect personal information from children — and in fact collect no personal information from any user.
Because your content never leaves your machine, you already exercise direct control over it: you can access, correct, export and permanently delete anything in the Application yourself, without needing to ask us. There is no profile of you held on our systems to request, correct or erase.
We hold no personal information about you other than any support correspondence you voluntarily send us. In respect of that correspondence, and to the extent applicable law such as the EU/UK GDPR, the UAE Personal Data Protection Law or the California Consumer Privacy Act applies, you may ask us to provide a copy of it, correct it, or delete it, and you may complain to your local data protection authority. We do not sell or share personal information for advertising or any other purpose. Email [email protected] to exercise any right; we aim to respond within 30 days.
We operate no servers and receive no data, so using ResearchVault involves no international transfer of your research by us. It stays on your machine, in your country, under your control. The single exception is a DOI lookup you choose to perform, which sends the identifier you typed to the CrossRef service.
We may update this Privacy Policy from time to time. The "Last Updated" date at the top of this page always reflects the current version, and any significant change — particularly the introduction of a feature that requires network access — will be announced on this page and in the application's release notes before or when it takes effect.
This website is static informational content. We set no advertising or tracking cookies of our own and run no third-party analytics on it. The pages do load web fonts from Google Fonts and an icon stylesheet from Cloudflare's CDN, and those providers may log your IP address as part of serving those files. Your hosting provider's standard server access logs may be retained for security and diagnostics.
For any privacy-related question or request:
Research