Privacy Policy

What we collect

• Your email — to create and secure your account.
• Your password — stored only as an irreversible bcrypt hash. We never see it. (If you sign in with Google or Apple, we don’t store a password at all.)
• Your date of birth — used once to set age-appropriate access (under-13 accounts have the social features turned off). We store only the date, not a copy of any ID.
• A username — only if you choose to use friends; it’s shown to people you connect with.
• Gameplay data — your cards, Essence, streaks, trades, and friends, so the game works.
• Notification details — only if you turn on phone notifications (a device “push subscription”) and your time zone, so reminders arrive at sensible times.

Children

VAULT is family-friendly. When an account indicates an age under 13, all social features (friends, trading, gifting, the activity feed) are automatically disabled — those accounts can still enjoy the full single-player game. We collect only the minimum needed to run the game. A parent or guardian can review or permanently delete a child’s account and data at any time by emailing vault@babygrug.com or using the in-app delete option.

How we use your information

Only to run VAULT: to sign you in, save your collection, deliver notifications you’ve asked for, keep the game fair and safe, and respond to reports. We do not sell your data, and we don’t show ads.

Who processes data for us

• Supabase — database, accounts, and sign-in.
• Cloudflare — hosting and delivery.
• Plausible — privacy-friendly, cookie-less usage analytics (no personal data, no cross-site tracking).
• Resend — sending account emails (e.g. password resets).
• fal.ai — generating card artwork (no personal data is sent).

Security

Passwords are hashed with bcrypt, all traffic uses HTTPS/TLS, and your data is protected by row-level security so only you can read your own account.

Your choices

You can edit your username, turn notifications on or off, and permanently delete your account and all its data from the Profile screen (or by emailing us). Deletion is immediate and can’t be undone.

Changes

If this policy changes in a meaningful way, we’ll update the date above and, where appropriate, let you know in the app.