Privacy Policy
Draft for review. These pages were written from how the app works and are not legal advice. Have them reviewed, then set legalDraft to false in src/site.mjs.
Vault ("we", "the app") is a trading card game community app. This policy explains what information the app and this website collect, why, and the choices you have.
- Information we collect in the app
- This website
- Who processes your data
- Content you share
- Retention and deletion
- Your choices and rights
- Security
- Children
- Changes
- Contact
Information we collect in the app
| Information | Why |
|---|---|
| Username, email address, phone number | Create and secure your account, verify your phone with a one-time code, sign you in and reset your password. |
| Profile details and photos (avatar, gallery, images you send or attach to listings) | Show your profile and let you share content. |
| Messages in community chats, direct messages and support | Deliver them to the people you send them to. |
| Tournament entries, match results, rank, achievements, marketplace listings and bids | Run the competitive and marketplace features. |
| Reports and blocks you make | Moderation and safety. |
| Push notification token and notification preferences | Send the notifications you allow. |
| Crash reports and basic diagnostic data | Find and fix bugs. |
We do not collect your location, contacts or advertising ID, and the app shows no ads.
This website
This website does not use cookies, advertising or analytics trackers. To show upcoming tournaments, events and news, your browser requests public information directly from our database provider (Supabase). Like any web request, this exposes your IP address and browser type to Supabase and to our hosting and network provider (Cloudflare) in their server logs. We do not use this to identify you. The language you choose is not stored.
Who processes your data
- Supabase hosts our database, authentication and file storage.
- Google Firebase delivers push notifications (Cloud Messaging) and collects crash reports (Crashlytics).
- An SMS provider (configured in Supabase) sends your one-time verification code to your phone number.
- OpenAI receives the text of community chat messages through its Moderation API, to detect abusive content.
- Cloudflare hosts and delivers this website.
We do not sell your personal information.
Content you share
Messages in community chats, your public profile, gallery and marketplace listings can be seen by other users. Direct messages are visible to the participants, and to moderators when a report is filed.
Retention and deletion
We keep your information while your account exists. You can delete your account at any time in the app under Settings → Delete account, which removes your account and associated data. You can also request deletion from the web: see how to delete your account. Backups and legal or safety records may persist for a limited period.
Your choices and rights
You can edit your profile, choose which notifications you receive, block users, and deny the notification permission. To ask for a copy of your data, a correction or deletion, email Tcg@vaultbahrain.com.
Security
Data is transmitted over HTTPS and protected by access rules in our database. No system is perfectly secure.
Children
Vault is not intended for children under 13 and we do not knowingly collect their information. If you believe a child has given us data, contact us and we will delete it.
Changes
We may update this policy. The date at the top shows the latest version.