Privacy Policy

Last updated: 2026-07-29

This policy explains what VAULTREAVE ("the game", "we") collects, why, how long we keep it, and what you can ask us to do about it. Plain language is intentional — if anything here is unclear, email us and we will explain it.

1. Who is responsible

Data controller: Ludomyth International Limited
Contact for privacy and data rights: gameoperationsdepartment@vaultreave.com

2. What we collect

Account data. There are two kinds of account. A "Start Now" light account requires no username and no password — we generate an internal identifier for it; you may later set a password so you can log in from another device. A registered account holds the username you choose and a password, stored salted and hashed (scrypt) so we never see the plaintext.
Game profile. Character level, gold, stash, gear, skill loadout, season and lifetime statistics — used for cloud saves and leaderboards.
Operational data. Gameplay events needed to keep the game stable and fair (login, run start, extraction, purchase clicks) and basic technical logs (errors, connecting IP address).
Trial progress. If you play before creating an account, we store your progress on our server against a random session key kept in your browser's localStorage, so you can refresh or come back and continue. It is migrated to your account if you create one. Interface preferences such as language stay only on your device.
Age confirmation. When you first open the game we ask for your birth month and year. We store only whether the result met our minimum age, plus a timestamp — we do not store your date of birth.
Payment data. Purchases are processed by Stripe. We never see or store your card number. We keep the order ID, amount, currency, status and completion time so we can deliver your purchase and reconcile accounts.

Note: even a light account with no name attached involves personal data — account identifiers and IP addresses are treated as personal data under the GDPR and as "personal information" under COPPA. This policy therefore applies to them too.

3. Why we use it, and on what legal basis

Purpose	Legal basis (GDPR Art. 6)
Running the game: cloud saves, parties, leaderboards, mail, seasons	Performance of our contract with you
Processing purchases, delivering them, and reconciling accounts	Performance of contract; legal obligation (tax and accounting)
Keeping the game fair and secure: detecting cheating, abuse and anomalies	Legitimate interests — protecting the game environment and other players' fair experience
Improving gameplay and balance from aggregated statistics	Legitimate interests — improving the service
Confirming you meet our minimum age	Legal obligation (children's privacy law)

We do not run targeted advertising, do not sell or share your personal data for advertising, and do not make automated decisions that produce legal or similarly significant effects on you.

4. Who we share it with, and where it goes

Stripe — payment processing (Stripe acts as an independent controller under its own privacy policy).
Infrastructure providers — server hosting and content delivery, only as needed to run the service.
Where required by law, or to protect legal rights.

Leaderboards publicly display your display name and related run statistics.

Location of processing. Our game servers are located in Singapore. When you play, your device sends data directly to that server. Under EDPB guidance, data you send us directly on your own initiative is not itself a "transfer" under Chapter V of the GDPR; where we do pass data to processors outside your region, we rely on appropriate safeguards.

5. How long we keep it

Account and game profile — for as long as the account exists; erased when you delete it. A light account that never set a password, has been inactive for 30 days and has never made a purchase is cleaned up automatically. Accounts that have made a purchase are never auto-deleted.
Trial progress — migrated when you create an account; otherwise cleared after prolonged inactivity.
Operational event data — automatically deleted after 90 days.
Age confirmation record — a boolean and timestamp, kept for as long as the account exists as evidence that the check was performed.
Transaction and order records — retained as required by tax and accounting law (typically several years). These must be kept even after account deletion, because the law requires it.

6. Your rights

You can ask us to access, correct, delete, restrict or object to the processing of your personal data, and to export your game profile (data portability). Where a processing activity relies on your consent, you can withdraw it at any time, without affecting the lawfulness of what we did before you withdrew it.

We respond within one month. If a request is complex we may extend that and will tell you why. Exercising these rights is free.

If you are in the EEA, the UK or Switzerland, you also have the right to lodge a complaint with your national data protection authority. We would appreciate the chance to resolve it with you first — it is usually faster.

7. Children

VAULTREAVE is not directed to children under 13, and we do not knowingly collect personal information from them. We ask for birth month and year before an account is created, and visitors under 13 are not permitted to play.

Some countries set a higher age for consenting to digital services on your own (for example, 16 in several EU member states). If you are under the applicable age where you live, please use the game only with your parent's or guardian's involvement.

Parents and guardians: if you believe a child has provided us with personal information, email the address in section 1. We will verify the request and delete the data and the account. You may also ask us to stop any further collection.

8. Cookies and local storage

We use your browser's local storage only for things that make the game work: your session/login state, your language and interface preferences, your saved trial progress key, and the age-confirmation result. We do not use analytics, advertising or tracking scripts, and therefore do not show a cookie consent banner. If that ever changes, we will ask for your consent before setting any non-essential storage.

9. Security

We use reasonable technical and organisational measures to protect your data, including hashed passwords, encrypted connections (HTTPS/WSS) and regular backups. No system is perfectly secure; if a breach ever affects your rights, we will notify you and the relevant authority as required by law.

10. Changes

We may update this policy. Material changes will be announced in the game or on the site, and the "last updated" date above will change.

11. Contact

Privacy questions, data-rights requests and parental requests: gameoperationsdepartment@vaultreave.com