Privacy Policy
Last updated 25 August 2026
VaultRun is operated from Ontario, Canada and follows PIPEDA. This policy explains what we collect, why, and how you control it.
What we collect
Account: email address, handle, avatar, age confirmation, squad membership.
Gameplay: hunts you publish or solve, guesses, points ledger entries, streaks, rank history.
Photos: images you capture for hunts and verification, plus the automated analysis results.
Integrity signals: a device fingerprint, IP-derived country and timestamps, used only to detect multi-accounting and fraud.
Payments: handled by our payment provider. We never see or store your full card number.
Why we use it
To run the game and your account, verify finds, pay out prize pools, prevent cheating and fraud, respond to support requests, and meet legal obligations. We do not sell your personal information and we do not use your data for third-party advertising.
Who we share it with
Only service providers who help us operate: our hosting and database provider, our payment processor, and the AI vision provider that analyses verification photos. Each processes data on our instructions. We may disclose data where legally required.
What other players see
Public information is limited to your handle, avatar, rank, squad and the hunts you publish or verifiably solve. Your email, device signals, payment data and full points ledger are private to you and our staff.
Retention
Gameplay and ledger records are kept while your account is active and for up to 12 months afterwards for fraud and accounting purposes. Verification photos are kept for 90 days after the hunt settles. Integrity signals are kept for 12 months.
Your rights
You can access, correct, or export your data, and delete your account and personal data from the Vault screen — deletion completes within 30 days. Anonymised, aggregate records required for financial integrity may be retained. To make a request or complain, contact support@vaultrun.ca.
Children
VaultRun is not for anyone under 13. If we learn an under-13 account exists we delete it and any associated data. Parents or guardians can email us to request removal.
Security & changes
Data is encrypted in transit, access-controlled per row, and restricted to staff who need it. We will notify you in-app of material changes to this policy.