Vaultara Entertainment

Privacy Policy

Vaultara is a ninety-second daily challenge in three stages, with a weekly leaderboard. This policy describes exactly what the app collects, why, where it goes, and how to get rid of it. It was written against the current build rather than adapted from a template. If you find a statement here that the app does not live up to, please tell us.

Who we are

Vaultara is published by Vaultara Entertainment LLC, the controller of the data described here. You can reach a human at vaultara.entertainment@gmail.com, which is the same address used for support, privacy requests and everything else.

The age gate, and the birth date we throw away

Vaultara is for adults: you must be 18 or over. Before the app does anything else, it asks for your date of birth on a screen you cannot get past without answering.

That date is never stored and never sent anywhere. It is used on your phone, in memory, to work out one thing: whether you are 18. Then it is gone. It does not reach our servers, it is not written to your phone's storage, it is not in a log, and there is no field for it in our database.

What the app keeps, on your phone only, is the answer: that this device confirmed an adult age, the date and time it was confirmed, which version of the gate asked, and which version of the Terms was current when you agreed. Four small values, none of which is your birth date and none of which identifies you. If we ever raise the age or materially change what is being agreed to, that version check means you are asked again rather than treated as having already agreed to a different question.

The same screen says that by continuing you agree to the Terms of Service and acknowledge this Privacy Policy, and both names are links. They open in Safari, outside the app, as do the legal links on the Account tab, and the app sends nothing with the request. Continuing is how you agree: there is no separate sign-off, and the version of the Terms recorded above is the one this build of the app was written against.

If a date under 18 is entered, the app records only that it happened on this device, and when (a yes-or-no flag and a timestamp), and stops. It deliberately does not keep the date, the age, or the day you would become eligible, because “blocked until a date in 2033” is a birth date written differently, and that is precisely the data this gate exists not to hold about a child. That flag stops an immediate retry with a different year. It does not survive deleting the app, and we do not pretend it does.

The gate runs before the anonymous session described below: before any identifier for you exists, before a run can be scored, before a leaderboard is shown, and before an email address can be added. Until it is answered, we have nothing about you at all.

How you are identified

This is the part most worth understanding, because everything else follows from it.

Once you are through the age gate, the first time you play a run or open a leaderboard the app quietly creates an anonymous session for your device, a guest. It asks you for nothing: no email, no name, no phone number. That session is a random identifier and a random display name in the form Competitor a1b2c3. It is not derived from your device, your hardware, your Apple Account or anything else about you, and nothing we store links it back to you. A great many players will never go further than this.

If you later want your progress to survive a lost phone, you can create an account. An account is an email address, a username and a password, and nothing more. This is important: it is a conversion of the identity you already have, not a second account. Your run history stays exactly where it is, and your username becomes the name other players see. The app has no other sign-in method, no social login, and no “sign in with” button of any kind, and it never asks for a phone number.

An account is optional, and the game is fully playable, including the leaderboards, without one.

What we collect

Three categories, and that is the whole list. It matches the privacy manifest shipped inside the app binary, which Apple publishes alongside the App Store listing.

Identifiers

A random player identifier, and your username. The username is public on the leaderboards. The identifier is never displayed, but it comes with each leaderboard row that other players’ phones receive (the app uses it to recognise your own row and to remember whom you have blocked), so treat it as visible to them. A guest has a generated username until they choose one.

Email address and password

Only if you create an account. The email address is used to sign you in and to recognise you if you write to us about the account. The password goes to our authentication service, which keeps only a salted hash of it; we never see it. Neither is displayed to other players, used for marketing, or shared.

Gameplay content

Your scores, and a record of what you did during a run. See below.

All three are marked in the app’s privacy manifest as linked to you and not used for tracking, and the purpose declared for each is app functionality. There is no fourth category, and the manifest’s tracking-domain list is empty because there are no tracking domains.

What a “run” records

Vaultara scores runs on the server, not on your phone. That is an anti-cheating measure (the app is not trusted to report its own score), and it means a run submits a short record of what happened rather than a number. That record contains:

• which questions you were served, which answer you picked for each, and how long each took;
• the timing of each tap in the second stage;
• one character per obstacle in the third stage, cleared or failed;
• how many seconds the app spent in the background mid-run, which the app declares so a long pause can be told apart from a suspiciously slow run;
• which version of the scoring rules you played under.

From that the server computes and stores your three stage scores, your total, a handful of derived counts (how many questions you got right, how many taps landed, how far you got), how long the run took overall, how much of that time the app says it was in the background, a flag for a run whose timing could not be accounted for, the week and day the run belongs to, and the time it happened. The record itself is not kept: once the server has scored it, only those results and counts are stored. The server also records which questions it has served you this week, so that it can avoid showing you the same one again that week.

There is no free-text field anywhere in a run. The only things you type into the app are, optionally, an email address, a username and a password, and the word DELETE if you delete your account; the one other thing you enter is your date of birth on the age screen, which is not kept.

What stays on your phone and is never sent

Four settings are stored in the app’s own preferences and are not transmitted anywhere: whether haptics are on, whether the daily reminder is on, the time you chose for it, and the date you last played. The six values the age gate leaves behind are kept in the same place, and are described above. The app declares its use of the iOS preferences API in its privacy manifest under the “access info to the app itself” reason, which is what that is. Like any app’s preferences, they can be included in a backup of your phone that you make yourself, with iCloud or a computer; the app does not send them anywhere.

One more list is kept on your phone: the players you have blocked, if you have blocked anyone. It holds the identifiers of those players, it is never sent to us or to anyone else, and so we do not know who you have blocked (if you also report a player, the report email names them, because that is what a report is). It is a setting of the phone rather than part of your account, so signing out and deleting your account do not clear it. Unblock all on the Account tab, under Names on the board, does, and so does deleting the app.

Your sign-in credentials, if you have an account, are held in the iOS Keychain: an access token, a refresh token, when the access token expires, the internal account id, the email address on the account, and a flag for whether you are still a guest. They are readable only after the phone has been unlocked once since it was powered on. Signing out clears them, and so does deleting your account.

Two details about that item we would rather state than let you assume. They are not synced to iCloud Keychain, so they do not travel to your other devices. But they are included in an encrypted device backup and can be restored from one onto a different phone, which for a player with no email on their account is the only way of moving their history to a new device and is why we chose it. An unencrypted backup does not contain them.

Your password is sent to the authentication service when you sign in or create an account and is stored nowhere on the device: not in preferences, not in the Keychain, not in a log.

One more thing is written to disk, and it is the one people do not expect, so we would rather say it than have it found. When you finish a run the app saves it (your answers, your timings, the deck you played and the account it was played as) into a file in its own private storage before it tries to send it. That is what stops ninety seconds of play disappearing because the network chose that moment to drop. The file holds at most eight runs, oldest discarded first. A run in it stops being usable about fourteen minutes after its questions were issued (the server’s own limit is fifteen minutes, and the app stops a minute early), and the app drops entries once they pass that point. It is excluded from iCloud and from encrypted device backups, and like the Keychain items it is unreadable until the phone has been unlocked once since it was powered on. Deleting your account deletes this file outright rather than waiting for its contents to age out.

What we do not collect

Stated plainly, because “we may collect” lists are how policies get written to cover things an app does not do:

• No phone number. The app never asks for one, and there is nowhere in it to enter one.
• No marketing, and no automatic email or text messages. This version sends none: not marketing, not account mail, not receipts. If you write to us, we reply to the address you wrote from, and that reply is the only email we send.
• No analytics. No Firebase, no Amplitude, no Mixpanel, no Google Analytics, no in-house event pipeline. We cannot see which screens you visit or how long you spend on them.
• No crash or performance reporting. No Crashlytics, no Sentry, no Bugsnag. If the app crashes we find out because somebody emails us, or because Apple’s own opt-in diagnostics show it to us in aggregate.
• No advertising identifier. The app never requests the IDFA, never shows the App Tracking Transparency prompt, and contains no ads and no ad network.
• No tracking. Nothing about you is combined with data from other companies’ apps or websites, for advertising or for measurement. The app’s privacy manifest formally declares this.
• No third-party SDKs at all. The app links no external frameworks and depends on no third-party packages. There is no vendor code in the binary that could collect anything without our knowledge.
• No location, contacts, photos, calendar, microphone, camera, health or motion data. The app never asks for any of these, and iOS would require it to ask.
• No device fingerprinting. No reading of boot time, disk space, file timestamps or the active keyboard list. The app does not use any of them, which is why its privacy manifest lists only one required-reason API, the app’s own preferences.
• No sale or sharing of personal information, and no cross-context behavioural advertising, as those terms are used in California and comparable laws. There is nobody to sell it to.

What is public

The leaderboards in the app show a rank, a username and a total score, and nothing else. Your email address is never shown to other players. The boards live inside the app and are readable only by a signed-in player; there is no public web leaderboard for a search engine to index. Behind the screen the server data is wider than what the screen draws: any signed-in player’s app can read other players’ usernames and run records (stage scores, the counts and timings stored with a run, and when it was played), but not email addresses or passwords.

You choose your username and you can change it at any time, from the Change name button on the Account tab or by tapping your name (the one with the pencil) in the bar at the bottom of the Board tab. Usernames are screened against a list of slurs and profanity. We may reset a username that gets past that screen. See the Terms of Service.

Any player can report a name to us by email, and we review every report within 24 hours. The email is one you send from your own mail app, so it carries your address, the reported name and a reference to that player. You can also block a player, which replaces their name with “Blocked player” on your phone (their rank and score stay in place). Blocking on its own never leaves the phone; see “What stays on your phone and is never sent” above.

One consequence worth stating: the app sends every finished run to our server automatically, and a run’s score and your username are then visible to other players. If you would rather not appear, delete your account (see Deleting everything).

Prizes

This version of Vaultara offers no prize, and collects nothing for one: there is no entry form and no extra field. The Terms of Service say what a prize would and would not be if a later version announced one, and the Official Rules for that week would be in the app. If that happens and it needs anything this policy does not already describe, we will update this policy before the week opens.

Two commitments about that, so they are on the record now. If you ever finish a prize week as the leading eligible entrant, we will email you at the address on your account, and we will ask for the least that will do and tell you exactly what we are asking for and why. And we do not want your identity documents: the app has no facility to upload one, we have no secure place to keep one, and a document sitting in an inbox is a worse risk to you than the thing it was meant to settle.

Notifications

The app can remind you once a day, at a time you pick, to play. This is worth being precise about because “notifications” usually implies a server.

The reminder is entirely local to your phone. It is scheduled by iOS on the device using the standard local-notification API, it fires whether or not you have a network connection, and it is cancelled automatically once you have finished a run that can reach the board that day. There is no push notification service, no device token is ever created or transmitted, and no Apple Push Notification key exists. We could not send you a message if we wanted to.

The reminder is off until you turn it on, iOS will ask your permission the first time, and you can withdraw that permission at any point in Settings → Notifications → Vaultara.

Where your data lives, and who can see it

The backend is Supabase, a managed PostgreSQL platform, running in the US East (Ohio) region of Amazon Web Services in the United States. Supabase and AWS process this data on our behalf, under their agreements with us. If you are outside the United States, using the app means your data is transferred there.

Supabase is the only server the app connects to, and the only service that receives anything from it. As with any online service, the servers receive your device’s IP address with each request and keep ordinary server logs. We do not use them to track you, and the app adds no device identifier of its own.

Everything between the app and the backend travels over HTTPS. Inside the database, row-level rules apply: a signed-in player can change only their own profile, can read their own private records (such as which questions they have been served) and, because the leaderboards are built from them, can read other players’ usernames and run records. The moderation word list, the operator audit log and the question answer keys are readable by no player at all, and the server strips the answer from each question before it sends it. The app does carry its own copy of the question bank, answers included, which it uses to show you the right answer after you pick; the score that ranks you is always the server’s.

A small number of people working on Vaultara have administrative access to the database, as is unavoidable for anyone operating a service. We do not look at individual accounts except when investigating a specific problem (usually one you have written to us about) or a credible case of cheating.

We will disclose data if we are legally required to. Given what is stored, that would be a score history and possibly an email address.

How long we keep it

Until you delete it. We run no automatic purge and no data-retention timer (our hosting provider rotates its own server logs on its own schedule): your runs are the leaderboard’s history, and an account that sits idle is not treated differently from one that does not.

Some things stop being usable along the way. A question deck issued for a run expires fifteen minutes after it is issued and cannot be scored after that (the record of it is not deleted until your account is), and a run still waiting on your phone to be sent is dropped on a slightly shorter clock. Weekly leaderboards roll over on Sunday at 11:00 pm, US Eastern time; past weeks stop being ranked but the runs themselves remain until you remove them.

What we will not do is put a number here that we do not enforce. There is no ninety-day window and no annual purge, because there is no code that would carry one out, and a retention period a policy states and a database ignores is worse than none at all.

Deleting everything

In the app: Account tab → Delete account. You confirm by typing the word DELETE, which is deliberately harder than tapping a red button.

It is immediate and irreversible. There is no grace period, and nothing in the app or on our side brings an account back. It needs a connection, because the deletion happens on our server; if the server cannot be reached the app says so and nothing is deleted, and if your saved sign-in has expired it asks you to sign in again first. Copies in the hosting provider’s routine backups, if it keeps any, age out on the provider’s own schedule. It removes:

• your account and the identity behind it, email included;
• your profile and your username;
• every run you have played, and every score;
• the record of which questions you have been served;
• any unused question deck issued to you;
• the sign-in credentials in this phone’s Keychain;
• any run still waiting to be sent, file and all; it is deleted rather than sent.

It does not remove quite everything, and the heading above should not be read as promising that. Four things can outlive it, and your phone’s ordinary settings stay too; all of them are set out below rather than left for you to discover.

This is offered to players who never created an account as well. If you are playing as a guest, there is no email to sign back in with, which makes deletion more final rather than less, so please be sure.

What is kept, and why

Four things can outlive a deletion. The first applies to anyone who was ranking. The second applies only if we ever had to reset your username. The last two are on your phone rather than on our server.

A nameless standing on the board. If one of your runs was ranking on a leaderboard, a standing with your name taken off it is left in its place, one for each week you ranked in under the current scoring rules. It holds the week, the scoring-rules version, the total, the time of the original run and the time of the deletion, under a freshly generated random identifier, minted at the moment of deletion and stored nowhere else. It is not derived from your account id in any way: not hashed, not truncated, not seeded from it. It carries no username, no email, and no reference to your deleted account, and there is no join in our database that leads from it back to you.

It appears on the board as “Former competitor”.

We are calling it nameless rather than anonymous on purpose. It keeps the exact score and the exact time of the original run, and the board it sits on was visible to other players while your username was still on it. Anyone who had seen the board before, or screenshotted it, could put the two together. That is the same risk any archived leaderboard carries, and it is small, but it is not zero, and a row you could still be recognised in is not one we should be describing with a word that means you cannot be.

The reason it is kept at all is honesty about the board rather than reluctance to delete. If a ranking run simply vanished mid-week, every player below it would silently move up a place with nothing anywhere explaining why. Keeping a placeholder means the ranking stays true and the change is visible. If you would prefer even this removed, write to us and we will remove it.

A moderation record, if your username was reset. If we ever reset a username of yours for breaching the rules on names, that action is written to an internal moderation log, and that log is not erased when you delete your account. It holds the username we removed, the username we replaced it with, the reason, the time, what we did about barring the old name, and the player identifier it applied to. It is visible only to us: no player can read it, and it appears nowhere in the app.

It is kept because a record that vanishes with the account cannot answer the question it exists for. "The username was removed, and there is now no record it was ever moderated" is precisely the dispute nobody can settle afterwards, including in your favour if the reset was ours to justify. If your username has never been reset by us, which is the overwhelming majority of players, there is no such record and nothing is kept.

There is a second place the removed username can sit, and we would rather name it than let you find it. If we judged the username bad enough to stop anyone taking it again, a simplified form of it (lower-case, stripped of punctuation and spacing) goes onto the word list that screens every new username. That entry also survives deleting your account, because a block that expired the moment its account did would not be a block. The list holds words, not people: there is no identifier on it and nothing in it says whose username a word once was. No player can read it.

If you want this removed too, write to us. We will weigh it against why the entry was made, and we will tell you the answer either way.

The age-gate answer on this phone. The handful of values described at the top of this policy (that this device confirmed an adult age, when, and which versions of the gate and the Terms were current) are not cleared by deleting your account, and are not cleared by signing out either. They never left the phone, so there is nothing on our server to delete; what this means is that the app does not ask you again.

The reason is the case that runs the other way. If deleting an account reset the gate, then a person the gate had turned away could clear it and try a different date, and a gate that can be retried until it lets you in is not a gate. The record therefore outlives the account on purpose. Deleting the app removes it, along with the settings and any held run described above.

Your list of blocked players, on this phone. If you have blocked anyone, the list of their identifiers is not cleared by deleting your account, and not by signing out either. It never left the phone, so there is nothing on our server to delete, and it holds nothing about you: it is the phone remembering whom you asked it to hide. Clear it with Unblock all on the Account tab, or by deleting the app.

Your ordinary settings, on this phone. The haptics switch, the daily reminder and its time, and the date you last played are not account data and are not cleared by deleting your account or by signing out either. None of it ever left the phone. A daily reminder that is switched on keeps firing until you switch it off, under Daily reminder on the Account tab, or delete the app.

Your rights

Depending on where you live you may have rights to access, correct, export or erase your personal data, to object to or restrict how it is processed, and to complain to a data-protection authority. We extend the substance of these to everyone regardless of location.

• Erasure is built into the app, as above, and needs no request.
• Correction of your username is built in too: rename yourself from the Account tab, or by tapping your name in the bar at the bottom of the Board tab.
• Access and export: email us from the address on your account, or quoting your username if you are a guest, and we will send you everything we hold, in a machine-readable form.
• Anything else, including objection or restriction: email us.

We do not charge for any of this and we will not ask you to create an account in order to exercise a right. We aim to respond within 5 business days and in any case within the time the applicable law allows. Requests can be sent by post as well as by email; the controller’s name and postal address are in Contact, at the foot of this page.

Where we need a legal basis under the UK or EU GDPR: we process your identifier and gameplay content to perform the contract of providing the game, your email to authenticate you under that same contract, and a minimal amount of the run record for our legitimate interest in preventing cheating. We do not rely on consent for anything except notifications, which iOS asks you for directly and which you can withdraw at any time.

Children

Vaultara is not directed at children. You must be at least 18 years old to use the app. We do not knowingly collect personal information from anyone younger, and the app asks for no information that would identify a child. If you believe a child has created an account, write to us and we will delete it.

Security

Passwords are handled by our authentication provider and are stored as salted hashes; we never see them. Session tokens on your phone are kept in the iOS Keychain. All network traffic is encrypted in transit. Database access is restricted by row-level rules so that one player’s credentials cannot change another player’s data or read private records such as email addresses (usernames and run records are readable by other signed-in players, as described above).

No system is perfect. If you find a security problem in Vaultara, please tell us at vaultara.entertainment@gmail.com rather than disclosing it publicly, and we will work with you on it.

Changes

If this policy changes in a way that affects what we collect or what we do with it, we will update the effective date at the top and say so in the app’s release notes. Material changes will be announced before they take effect. Older versions are available on request.

Contact

Questions, requests, or anything in this document you think is wrong:

vaultara.entertainment@gmail.com
Vaultara Entertainment LLC
852 E Taurus Pl
Chandler, AZ 85249-3655
United States