Privacy policy
Last updated October 2026
Crack the Vault is a puzzle game. We collect only what the game needs to save your progress and keep it fair. We don't sell your data and we don't show ads.
What we store
- A player ID. Every visitor gets an anonymous guest ID so progress can be saved without an account.
- Your email address, if you create an account, and a password hash (we never see your password). If you sign in with Google, we receive your email address and name from Google.
- Age confirmation. When you create an account we ask for your birth month and year, check that you are 13 or older, and store only the date you confirmed it. We never store your birth date. If you are under 13, nothing is stored and no account is created.
- Game records: vaults you've cracked, your runs, the answers you typed, hints used, times and ranks, early-access claims, and any question reports you send.
- Technical data: error reports (without your email) and anonymous page analytics that don't use cookies.
How we use it
- To run the game: save progress, check answers, apply the timer and fair-play limits.
- To send account emails you ask for, such as confirming your email or resetting a password.
- To fix bugs and improve questions.
Who processes it for us
- Supabase (database and sign-in), hosted in the United States.
- Vercel (website hosting and cookieless analytics).
- Resend (account emails).
- Cloudflare Turnstile (bot protection).
- Sentry (error reports).
- Google, only if you choose to sign in with Google.
Storage on your device
We keep your sign-in session and your sound setting in your browser's local storage. We don't use advertising or tracking cookies.
Children
Accounts are for people aged 13 and older. Players under 13 can play the guest vaults without giving us any personal information. If you believe a child under 13 has created an account, contact us and we will delete it.
Your choices
- Delete your account and all its game records any time from the Account page.
- Contact us to ask for a copy of your data or to correct it.
- Guest data is tied to your browser; clearing site data starts a new guest.
Retention
We keep account data until you delete your account. Inactive guest data may be removed after 12 months.
Changes
If we change this policy in a meaningful way, we'll update the date above and say so on the site.
Contact
Contact details will be published here before launch.