Privacy Policy

1. Controller and contact

Miraç Doğan is responsible for the VaultPin service and the processing described in this policy. Questions or privacy requests can be sent to support@vaultpin.app.

VaultPin does not create a dedicated VaultPin email account or password for you.

2. Guest identity

If you continue as a guest, the app creates a high-entropy installation UUID and stores it in the iOS Keychain. The raw UUID is sent over an encrypted connection when needed to identify the guest installation, but is not stored in the backend database. The backend stores an HMAC-derived value instead.

This identity lets the service return the same Daily Vault session to the same installation. It is not an advertising identifier, Apple IDFV or hardware identifier.

3. Game Center identity and alias

If you use Game Center, Apple provides a signed authentication package. The raw teamPlayerID, signature and salt are processed temporarily to verify the request. VaultPin stores an HMAC-derived identity value rather than the raw teamPlayerID.

Your Game Center alias is stored as a display name. It may appear in the Daily Vault leaderboard together with your rank, attempt count, completion time and whether a hint was used. The alias is not used as authentication proof.

4. Daily Vault gameplay data

The backend associates Daily Vault guesses, attempt sequence, aggregate feedback, elapsed time, hint use, outcome and leaderboard performance with the VaultPin player record. This is necessary to run the shared daily challenge, restore its state across launches, prevent duplicate submissions and calculate rankings.

The encrypted Daily Vault secret is never returned before a terminal result. Secret cryptographic material is removed after its retention period while cycle metadata can remain for retained results.

5. Information that stays on your device

Practice game progress is not sent to the VaultPin backend. Sound and local notification preferences also remain on the device. The Daily Vault reminder is a local iOS notification, not a remote push notification.

6. Purchases and StoreKit

Apple handles the one-time StoreKit purchase, restoration and any refund process. VaultPin checks the verified StoreKit entitlement on the device. Receipts and transaction data are not sent to the VaultPin backend.

Deleting VaultPin gameplay data does not remove the Apple-managed purchase entitlement. A purchase can be restored through Apple when available.

7. Sharing

The system share sheet opens only when you choose to share a result. VaultPin does not automatically post content or disclose the secret code in the prepared share text. Your chosen destination may apply its own privacy terms.

8. Why information is used

VaultPin uses the information described above only for app functionality, including:

• verifying guest or Game Center identity;
• creating, restoring and securing Daily Vault sessions;
• processing guesses, hints, timing and results;
• showing eligible leaderboard entries;
• preventing duplicate or abusive requests; and
• responding to support and privacy requests.

9. Service providers and processing locations

The backend and PostgreSQL database run on Railway in the EU West — Amsterdam, Netherlands region. Apple provides Game Center, StoreKit and iOS platform services. This website is intended to be delivered through Cloudflare. Support email is routed through Cloudflare Email Routing to Gmail, which is used to answer the message.

These providers operate their own networks and may process technical connection information under their terms. Data may therefore be processed through service-provider infrastructure outside your country, subject to applicable protections.

10. No advertising or tracking

VaultPin does not include advertising, analytics, tracking or a third-party crash-reporting SDK. Personal data is not sold or shared for advertising. This website does not include contact forms or third-party scripts; support is provided by email.

11. Retention

VaultPin applies the following service retention periods:

• Daily guess and detailed session data: 30 days;
• Daily result and leaderboard data: 13 months;
• inactive player records with no retained dependent records: 24 months; and
• Daily Vault secret cryptographic material: 30 days after the vault ends.

12. Deleting your VaultPin data

You can request deletion in the app under Settings → Delete VaultPin Data. After the authenticated deletion succeeds, the player record and associated Daily Vault guesses, sessions, results, leaderboard performance and lifetime statistics are deleted. Shared Daily Vault definitions are not another player's personal data and are preserved.

Deletion does not affect StoreKit purchases, sign you out of the system Game Center account or necessarily cancel local reminder preferences. If you later play the Daily Vault again, a new VaultPin player record may be created.

13. Security

VaultPin uses measures such as encrypted network transport, Keychain storage on iOS, hashed identity matching and encrypted Daily Vault secrets. No technical system can promise absolute security. Please do not send passwords, tokens, signatures or other sensitive credentials in a support message.

14. Children

VaultPin is not designed specifically for children. It does not contain gambling, real-money play, cash prizes or games of chance. If you believe a child has provided information in a way that requires action, contact support@vaultpin.app.

15. Your rights

Depending on where you live, applicable law may give you rights to request access, correction, deletion, restriction, objection or information about processing. These rights can be subject to legal conditions and exceptions. Send a request to support@vaultpin.app so it can be evaluated and answered appropriately.

16. Changes to this policy

This policy may be updated when VaultPin features, providers or legal requirements change. The updated date will identify the current version. Material changes may also be communicated in the app where appropriate.