WinVault

Privacy Policy

Last updated: October 13, 2026

WinVault ("we", "us", or "our") operates the Win Vault mobile app and related website (the "Service"). On Google Play the app is listed as Win Vault. WinVault helps you track board-game sessions, scores, wins, and friends. This Privacy Policy describes the personal data we actually collect and how we use it.

Delete your Win Vault account

You can ask Win Vault to delete your account and the personal data tied to it. Use the app, or email us if you cannot sign in.

In the Win Vault app

  1. Open Win Vault and sign in.
  2. Open Settings.
  3. Tap Delete account.
  4. Confirm Delete permanently.

If you cannot sign in, email [email protected] with the subject "Delete my Win Vault account" and the email address on the account. That email is a deletion request. We complete it within 30 days.

Data we delete

  • Your profile: email, username, display name, character, password, and sign-in identity (email, Apple, or Discord)
  • Friend requests and friendships
  • Push notification tokens
  • Board games you created, and the sessions on those games
  • Your membership on games you only joined

Data we keep

  • On a game someone else created, your scores stay so their history remains. Those rows are kept under your display name as a guest. They are no longer linked to your account, email, or sign-in.
  • Subscription and payment records held by Google Play, the Apple App Store, and RevenueCat. Deleting your Win Vault account does not cancel a store subscription. Cancel that in the store.
  • A copy in secure backups for up to 30 days, then removed, unless the law requires us to keep it longer.
  • Data stored only on your device, such as a session token and settings, until you uninstall Win Vault or clear the app data.

1. Information we collect

Account information. When you sign up with email, we collect your email address, username, password (stored only as a one-way hash), optional display name, and chosen character avatar. When you sign in with Apple or Discord, we receive the identifiers and profile details Apple/Discord and our authentication provider (Supabase) share with us — typically a unique auth user ID, email (if provided; Apple may share a private relay address), and display name. We store a linked authentication ID and provider name on your account.

Game and session data. We store board games you create (name, description, player limits, scoring mode), who is on each game board, session dates, scores, winners, guest player display names you add to sessions, and statistics derived from that gameplay (for example wins, averages, and streaks).

Social features. If you use friends, we store friend requests and accepted friendships (who requested whom and status). Friends and players on shared game boards can see username, display name, character, and game stats/history relevant to those features. We do not offer granular per-field "privacy settings" beyond the social actions in the app (for example accepting or declining friend requests).

Subscriptions. If you subscribe, we store whether your WinVault entitlement is active so we can enforce free-tier limits. Payment card details are not collected by us; billing is handled by Apple, Google, and/or RevenueCat.

Push notifications. If you enable notifications on a supported device, we store a device push token and platform (iOS/Android/web) so we can deliver alerts such as friend activity.

Local device data. The app may keep session tokens, your user id, UI preferences (for example language and list settings), and temporary onboarding drafts on your device (for example in browser/app storage). This stays on your device unless needed to operate the Service.

What we do not collect. We do not run third-party advertising or product analytics SDKs in the app today. We do not sell personal data. Sign-in options include email/ password, Sign in with Apple, and Discord.

2. How we use your information

3. Legal bases (EEA/UK users)

We process personal data to perform our contract with you (providing the Service), based on legitimate interests (security and operating the product), and based on consent where required (for example optional push notifications).

4. Sharing of information

We do not sell your personal information. We share data only as needed with:

5. Cookies and similar technologies

The Service primarily uses local app/browser storage for authentication and preferences, not advertising cookies. Our marketing website may use only what is needed to serve pages. We do not use third-party advertising trackers.

6. Data retention

We retain your account and game data while your account is active. To delete it, follow Delete your Win Vault account above. After a request we remove the account data listed there within 30 days. Secure backups may keep a copy for that same period, unless the law requires longer. Subscription records held by Apple, Google, or RevenueCat follow those providers' retention rules.

7. Security

We use industry-standard measures including encryption in transit (TLS), hashed passwords for email accounts, and access controls. No method of transmission or storage is 100% secure; we cannot guarantee absolute security.

8. Your rights

Depending on your location, you may have the right to access, correct, delete, or export your personal data, object to or restrict processing, and withdraw consent. You can update profile fields in the app and delete your account in settings. For other requests, email us. EEA/UK users may lodge a complaint with their local data protection authority (in Denmark, Datatilsynet).

9. Children's privacy

WinVault is not directed at children under 13 (or 16 in the EEA where applicable). We do not knowingly collect data from children. Contact us if you believe a child has provided personal information.

10. International transfers

Your data may be processed in countries other than your own (including by Supabase, Discord, RevenueCat, Apple, Google, or push providers). Where required, we rely on appropriate safeguards such as Standard Contractual Clauses.

11. Changes to this policy

We may update this Privacy Policy from time to time. We will update the "Last updated" date and, for material changes, notify you via the app or email when practical. Continued use after changes constitutes acceptance.

12. Contact us

Questions about this Privacy Policy? Email [email protected].

Terms of Service← Back to home

Privacy Policy — WinVault