Privacy policy

1. Who is responsible

GameVault X is developed and published by Markus Wallgren, trading as Wallgrn Studios, Sweden. He is the data controller for the personal data described in this policy that we receive ourselves. You can reach us at support@wallgrn.com.

2. What stays on your device

Almost everything you do in GameVault X lives only on your iPhone, iPad or Android device. We have no server that receives your adventures, and we cannot see or access them.

Photos. Photos from the picker are redrawn and saved at a maximum of 2,048 pixels on the long side. This normally removes metadata such as location and camera details. Video, audio and PDF files are stored as they are, with any metadata they already contain.

Backups. The app's data may be included in your device backup if enabled. Apple handles iOS backups (iCloud or computer); Android uses the operating system's backup according to your settings. The app has no own cloud sync. Android's local premium receipt is excluded from backup.

3. Permissions

• Photos: The app uses the operating system's photo picker and can only access the photos and videos you pick, not your whole library.
• Camera: Used to scan QR codes (in QR locks and when importing a game key) and to place a treasure in the room with augmented reality (AR). The camera feed is processed in real time on the device and is never recorded, saved or sent anywhere.
• The app does not use the microphone, location, contacts, Bluetooth or the local network.

You can change permissions at any time in your device settings.

4. When the app goes online

GameVault X works without an internet connection. The app only goes online in these cases:

• Purchases: Buying and restoring purchases goes through Apple's App Store on iOS and Google Play on Android.
• Treasure files: If you import a game key that contains a link to a treasure file, such as a key created in GameVault X Admin, the app downloads the file from that address and stores it locally. As with any download, the server sees your IP address.
• Links: If you tap a link, such as the one to this policy, it opens in your browser.

We have not added our own analytics, crash reporting, advertising or tracking tools. On iOS, ZIPFoundation handles game packages locally. Android uses libraries including Google Play Billing, CameraX, Media3 and ARCore. ARCore processes technical data as described below.

Android and ARCore. When you use AR on a compatible Android device, the app uses Google Play Services for AR (ARCore). Google collects account identifiers when signed in, otherwise device identifiers, plus performance, diagnostics and API usage/app activity for analytics and AR improvements. Google stores these data; transmission is encrypted with HTTPS. AR is optional; ordinary play and QR scanning do not require ARCore. The app does not use Cloud Anchors or the Geospatial API and does not send camera video or precise location to those cloud features. Google handles retention and data rights under Google Privacy Policy. See also how Google Play Services for AR handles data.

5. In-app purchases

iOS: Premium Escape Pack is a one-time purchase handled by Apple through the App Store. Apple processes your payment and account details under Apple's own privacy policy. We never receive your payment details, your name or your email address. The app verifies the purchase locally using Apple's StoreKit. From Apple we only receive aggregated sales statistics that don't identify you.

Android: Google Play handles Premium Escape Pack under Google Privacy Policy. Google processes payment and account details. The app receives a product ID, purchase status and signed receipt with a purchase token to verify and acknowledge the purchase through Google Play. The receipt is stored locally outside backups for offline access and cleared when a successful purchase query finds no entitlement. We have no server receiving the receipt and do not receive your card details.

6. When you share a game

You decide whether and how a game is shared. Here's how the formats differ:

Sharing happens through the device share sheet, for example AirDrop, Messages, Mail or Files, and that service's terms apply. We don't receive anything you share. Only import games from people you trust.

7. The GameVault X Admin web tool

GameVault X Admin is a web tool for creating game keys and uploading treasure files in a browser. If you use it, data is processed by Google Firebase, which we use as a data processor:

• Anonymous sign-in: Firebase creates a random user ID with no name, email or password. The ID is stored in your browser's storage so you can get back to your projects. That storage is necessary for the tool to work.
• Projects: Name, intro text, themes, codes, stages, timer and hint settings, any links (manual, VR and treasure) and timestamps are stored in Cloud Firestore, linked to your anonymous ID.
• Treasure files: Photos and videos you upload are stored in Cloud Storage. The file is reached through a download link included in the game key, and anyone with the link can open the file. Don't upload anything sensitive.
• Technical data: As with any web service, Google receives your IP address and browser information. The page also loads fonts from Google Fonts and scripts from Tailwind CSS and cdnjs (Cloudflare), so your IP address reaches them too.
• No analytics: The tool does not use Google Analytics or any other analytics tool.

Google may process data outside the EU/EEA. Google is certified under the EU–US Data Privacy Framework and uses the European Commission's Standard Contractual Clauses.

Deletion: Deleting a project in the tool removes it from Firestore. Uploaded treasure files are not deleted automatically. Email support@wallgrn.com with the project name and we'll remove them. If you clear your browser's storage you lose access to your projects. Get in touch if you want them deleted.

8. Support and email

When you email us, for example through Contact us or Report a bug in the app, we receive your email address and what you write. A bug report is prefilled with the app version, device model and operating system version. You see everything before sending and can remove anything you don't want to share.

We use this only to reply and resolve your request. Emails are kept while the request is open and then for no more than 24 months, unless the law requires otherwise. Please don't send personal data about others or photos of children unless we explicitly ask for it.

9. Legal basis

• Support: our legitimate interest in answering and following up on your questions (Article 6(1)(f) of the General Data Protection Regulation, GDPR).
• GameVault X Admin: to provide the service you request (Article 6(1)(b)) and our legitimate interest in running it securely (Article 6(1)(f)).

Your adventures and game content are processed locally. Google is responsible for its processing through Google Play and ARCore under its privacy policy.

10. For schools, clubs and companies

GameVault X works well in teaching and at events. Because the app sends nothing to us, you as the game master decide what data goes into a game. A few tips:

• Don't use students' full names, ID numbers or photos of students in games that will be shared.
• Remember that game keys and .gvxproject files contain the answers in plain text.
• Delete adventures you no longer need and use Clear saved progress on shared devices.
• If you use GameVault X Admin, section 7 applies.

The organisation is responsible for its own processing of personal data in the material it adds to the app.

11. Children

The iOS version is rated 4+. GameVault X is often used by families and schools. The app has no accounts, no ads, no chat. Android's ARCore processing is described in section 4. Children don't need to provide any information to play. We don't knowingly collect personal data from children. If a child has emailed us and you want the email deleted, contact us.

12. How long data is kept and how to delete it

• Delete an adventure in the app to remove the project and its media.
• Use Clear saved progress under Data in the app's settings.
• Clear game reports from the Game reports view in the library.
• Uninstall the app to remove all local data. Copies may remain in your backups until they're replaced.
• The web tool: see section 7. Support: see section 8.

13. Your rights

Under the GDPR you have the right to request access to, correction or erasure of your personal data, to request restriction, to object to processing and to receive data you've provided in a machine-readable format. Your adventures and game content exist on your device, so you can view, change and delete it there yourself.

For support emails and the web tool, contact support@wallgrn.com. You also have the right to lodge a complaint with the Swedish Authority for Privacy Protection (IMY) or the supervisory authority where you live.

14. Changes to this policy

We update this policy when the app or the way we handle data changes. The date at the top shows the current version. For significant changes we'll also mention it in the app's release notes.

15. Contact

Markus Wallgren / Wallgrn Studios
Sweden
support@wallgrn.com