Privacy Policy

Data we collect

Vault creates an anonymous Firebase Authentication account so profiles, friends, multiplayer sessions, and reconnect can work without a separate sign-up form. The account still has a persistent Firebase user ID.

• Account and profile data: Firebase user ID, display name, public player ID, selected avatar, and profile creation date.
• Social and multiplayer data: friends, friend requests, lobby invitations, lobby membership, session players, game actions, votes, reactions, connection state, timestamps, saved game snapshots, and game-ending records.
• Optional AI data: game setup, scenario and card information, character traits, and conversation text used by the features described below.
• Purchase data: Apphud-generated device and profile identifiers, product, paywall and placement identifiers, purchase and subscription status, store transaction references, receipts or signed transaction data, and entitlement state. Vault does not receive your full payment-card details.
• Analytics and technical data: automatically collected app lifecycle events, selected product events, app version, device and operating-system information, interface language, time zone, approximate country or region derived from network information, SDK-generated installation identifiers, crash reports, and diagnostics.
• Support data: your email address and any information you voluntarily include when contacting us or submitting a form.

How we use data

• Create and maintain your Vault profile and public player ID.
• Provide friends, invitations, lobbies, multiplayer games, and reconnect.
• Generate optional AI game dialogue and endings after you consent.
• Process purchases, restore access, and prevent subscription or payment fraud.
• Operate, secure, troubleshoot, and improve Vault.
• Reply to support and account-deletion requests and comply with legal obligations.

Service providers

Vault uses the services below for app, measurement, purchase, website, and support features. Their processing is also governed by their own terms and privacy documentation.

• Google Firebase Authentication and Cloud Firestore for accounts, profiles, social data, and multiplayer data.
• Google Firebase Analytics for product measurement, Google BigQuery where analytics export is enabled, and Firebase Crashlytics for crash reports and technical diagnostics.
• Google Gemini through Firebase AI Logic using the Google AI backend for optional iOS AI features, including prompt token counting.
• Apphud and the applicable app store for purchases, subscriptions, paywalls, and entitlement checks.
• AppMetrica for Apple purchase and subscription notifications forwarded through the configured Apphud server notification route.
• Netlify for this public website and support forms.
• Google Forms where support is submitted through Google Forms.

Product analytics and diagnostics

Firebase Analytics records automatic lifecycle events such as first open and session start, together with a limited set of typed product events used to measure onboarding, multiplayer reliability, game completion, and the purchase funnel. The interface language is stored as an analytics user property. Vault sets the Firebase Authentication user ID in both Analytics and Crashlytics, linking events and crash diagnostics to the same Vault account.

Product events include game-session UUIDs and limited identifiers for event types, game outcomes, player roles, paywalls, and products. Vault does not manually send display names, invitation codes, free-form prompts, prices, or revenue as Firebase Analytics event parameters. Crash details and diagnostic context are handled by Firebase Crashlytics or the applicable platform diagnostic tools.

If analytics export is enabled, Firebase Analytics events may also be processed in Google BigQuery for reporting. Apphud processes subscription events such as renewals, cancellations, refunds, and revenue data.

Advertising and iOS measurement

We do not use your data for targeted advertising or configure advertising-network integrations.

The iOS app sends an Apple AdServices attribution token to Apphud for Apple Ads attribution. Apphud uses persistent device and profile identifiers generated for its service; the app does not pass its Firebase user ID to Apphud.

Apphud is configured to forward Apple server-to-server purchase and subscription notifications to AppMetrica for purchase and subscription measurement.

Optional AI features

Where available in the iOS app, AI game dialogue and endings use Google Gemini through Firebase AI Logic using the Google AI backend. Each feature requires purpose-specific consent, which you can withdraw in Settings. Prompt token counting also sends prompt content to Google before generation.

AI game content includes game setup, public cards, bunker and cataclysm facts, and a limited conversation history containing user text and AI replies. Within that content, Vault replaces roster display names with local tokens and omits app-defined Firebase account, session, and player UUID fields. Free text can still contain personal details.

AI ending content includes game facts and all character traits, including unrevealed traits. The app excludes player names, app-defined Firebase account, session, and player UUID fields, and chat from that content. Removing these fields from game content does not remove identifiers from Vault’s own stored game records.

With both token-counting and generation requests, Firebase receives app and SDK technical information, an App Check app-verification token when available, and an account authentication token when a Firebase user exists. Firebase’s AI service can therefore associate requests with the Vault account. Omitting identifiers from game content does not make the full request anonymous.

Voice input requires on-device speech recognition. The app does not upload microphone audio to Gemini; only the reviewed text you send enters the AI conversation. Spoken replies use system text-to-speech.

Vault keeps AI game conversation in app memory. Network games remain linked to Firebase accounts, and saved game endings use the storage described below. Withdrawing consent stops future AI requests; it does not recall content already processed by Google. Google’s processing, use, and retention of requests are governed by the applicable Firebase and Gemini terms and service configuration.

Retention and account deletion

You can delete your account inside Vault at Settings → Delete account and data, or submit a request through our public deletion page. The live Firebase account, profile, social records, invitations, and reconnect records are deleted. Player data in an active game is removed or anonymized so the remaining game can continue.

Vault caches saved game data locally. For network-game endings, Vault automatically creates a Cloud Firestore record containing session and invitation identifiers, participant Firebase user IDs, and a game snapshot before optional AI generation. Generated ending text is stored in the remote record and local cache. These records remain linked to participants even when provider requests omit certain identifiers.

An upcoming iOS release adds cleanup of saved endings to account deletion. In versions with this cleanup, the app removes local saved endings and their stored player names. For shared endings, it removes your account from the participant list and clears any ending-generation reservation held by your account; fictional game stories and character traits can remain for other participants. The last participant’s ending record is deleted. The updated flow confirms account deletion only after its required cleanup succeeds. If your installed version does not support this cleanup, contact us through the deletion page.

The app does not schedule automatic expiry for local saved endings or its Cloud Firestore ending records.

Transaction, security, fraud-prevention, accounting, legal, backup, analytics, and diagnostic records may also remain subject to provider retention rules and applicable obligations. Retention periods depend on the service and configuration.

Security and international processing

We use reasonable technical and organizational measures, including authenticated access controls and encrypted network transport. No system can guarantee absolute security. Providers may process data in countries other than your own; their terms and privacy documentation describe how they handle that processing.

Children

Vault is not directed to children under 13, and we do not knowingly collect personal data from a child under 13. If you believe a child provided data, contact us so we can investigate and delete it.

Changes and contact

We may update this policy when Vault or its providers change. The effective date above identifies the current version. Privacy questions can be sent to georgin2000155@gmail.com.