Privacy Policy

1. Overview & Commitment

CardVault Studios ("we", "our", or "us") operates CardVault ("the Service"). We respect your privacy and are committed to protecting your personal data.

We do not sell, rent, or trade your personal information to third parties. We collect only what is strictly necessary to maintain your game account, ensure security, and provide multiplayer features like the marketplace and leaderboards.

2. Information We Collect

• Account Information: When you register, we collect a username, an email address, and a cryptographically salted password hash (PBKDF2). We never store plaintext passwords.
• Gameplay Data: Your cards, showcase configurations, coin balance, marketplace listings, pack opening history, and upgrade levels.
• Contact Messages: If you submit our contact form, we collect your email address, name (optional), subject, and message.
• Technical & Security Logs: Salted IP hashes for rate limiting and bot mitigation, user-agent strings for active session management, and CSRF security headers.

3. Cookies & Local Storage

We use minimal cookies and local browser storage to keep the game working:

• cv_session: An HttpOnly, Secure, SameSite=Lax cookie used exclusively to keep you authenticated to your game account.
• cardvault_theme: Stored in browser LocalStorage to remember your preferred Light or Dark visual theme.
• cv_cookie_consent: Records your cookie preferences.

Manage your preferences anytime on our Cookie Preferences page.

4. Third-Party Service Providers

We utilize select infrastructure providers to securely serve the game:

• Cloudflare: Hosts our static web assets, Workers API, D1 database, and Turnstile bot protection to defend against automated abuse.
• Email Service: Transactional email delivery for account verification and password resets.

5. Your Rights (GDPR & CCPA)

Regardless of your location, you have full control over your personal data:

• Right to Access & Data Portability: You can download a complete JSON export of your profile, cards, transactions, and inventory at any time via "Download my data" in Account Settings.
• Right to Erasure ("Right to be Forgotten"): You can permanently delete your account and personal records at any time using "Delete my account" in Account Settings.
• Right to Rectification: You can update your password, email address, and leaderboard privacy settings directly in Account Settings.

6. Age Limitations

CardVault is not intended for children under 13 years of age. We do not knowingly collect personal data from anyone under 13. If we learn that a user is under this age threshold, their account will be terminated promptly.

7. Contact Us

For questions or privacy requests, please email our Data Protection officer at support@cardvault.game.