Privacy policy

1. Who is responsible

GameVault X is developed and published by Markus Wallgren, trading as Wallgrn Studios, Sweden. He is the data controller for the personal data described in this policy that we receive ourselves. You can reach us at support@wallgrn.com.

2. What stays on your device

Almost everything you do in GameVault X lives only on your iPhone or iPad. We have no server that receives your adventures, and we cannot see or access them.

Photos. Photos from the picker are redrawn and saved at a maximum of 2,048 pixels on the long side. This normally removes metadata such as location and camera details. Video, audio and PDF files are stored as they are, with any metadata they already contain.

Backups. The app's data is included in your regular device backup (iCloud or computer) if you have it turned on. Apple handles that backup according to your settings. The app does not sync through iCloud on its own.

3. Permissions

• Photos: The app uses Apple's photo picker and can only access the photos and videos you pick, not your whole library.
• Camera: Used to scan QR codes (in QR locks and when importing a game key) and to place a treasure in the room with augmented reality (AR). The camera feed is processed in real time on the device and is never recorded, saved or sent anywhere.
• The app does not use the microphone, location, contacts, Bluetooth or the local network.

You can change permissions at any time in the iOS Settings app.

4. When the app goes online

GameVault X works without an internet connection. The app only goes online in these cases:

• Purchases: Buying and restoring purchases goes through Apple's App Store.
• Treasure files: If you import a game key that contains a link to a treasure file, such as a key created in GameVault X Admin, the app downloads the file from that address and stores it locally. As with any download, the server sees your IP address.
• Links: If you tap a link, such as the one to this policy, it opens in your browser.

The app contains no analytics, crash reporting, advertising or tracking tools. The only third-party component is the ZIPFoundation library, which packs and unpacks game files locally on the device.

5. In-app purchases

Premium Escape Pack is a one-time purchase handled by Apple through the App Store. Apple processes your payment and account details under Apple's own privacy policy. We never receive your payment details, your name or your email address. The app verifies the purchase locally using Apple's StoreKit. From Apple we only receive aggregated sales statistics that don't identify you.

6. When you share a game

You decide whether and how a game is shared. Here's how the formats differ:

Sharing happens through the iOS share sheet, for example AirDrop, Messages, Mail or Files, and that service's terms apply. We don't receive anything you share. Only import games from people you trust.

7. The GameVault X Admin web tool

GameVault X Admin is a web tool for creating game keys and uploading treasure files in a browser. If you use it, data is processed by Google Firebase, which we use as a data processor:

• Anonymous sign-in: Firebase creates a random user ID with no name, email or password. The ID is stored in your browser's storage so you can get back to your projects. That storage is necessary for the tool to work.
• Projects: Name, intro text, themes, codes, stages, timer and hint settings, any links (manual, VR and treasure) and timestamps are stored in Cloud Firestore, linked to your anonymous ID.
• Treasure files: Photos and videos you upload are stored in Cloud Storage. The file is reached through a download link included in the game key, and anyone with the link can open the file. Don't upload anything sensitive.
• Technical data: As with any web service, Google receives your IP address and browser information. The page also loads fonts from Google Fonts and scripts from Tailwind CSS and cdnjs (Cloudflare), so your IP address reaches them too.
• No analytics: The tool does not use Google Analytics or any other analytics tool.

Google may process data outside the EU/EEA. Google is certified under the EU–US Data Privacy Framework and uses the European Commission's Standard Contractual Clauses.

Deletion: Deleting a project in the tool removes it from Firestore. Uploaded treasure files are not deleted automatically. Email support@wallgrn.com with the project name and we'll remove them. If you clear your browser's storage you lose access to your projects. Get in touch if you want them deleted.

8. Support and email

When you email us, for example through Contact us or Report a bug in the app, we receive your email address and what you write. A bug report is prefilled with the app version, device model and iOS version. You see everything before sending and can remove anything you don't want to share.

We use this only to reply and resolve your request. Emails are kept while the request is open and then for no more than 24 months, unless the law requires otherwise. Please don't send personal data about others or photos of children unless we explicitly ask for it.

9. Legal basis

• Support: our legitimate interest in answering and following up on your questions (Article 6(1)(f) of the General Data Protection Regulation, GDPR).
• GameVault X Admin: to provide the service you request (Article 6(1)(b)) and our legitimate interest in running it securely (Article 6(1)(f)).

Data in the app is processed only on your device and by you. We don't process it.

10. For schools, clubs and companies

GameVault X works well in teaching and at events. Because the app sends nothing to us, you as the game master decide what data goes into a game. A few tips:

• Don't use students' full names, ID numbers or photos of students in games that will be shared.
• Remember that game keys and .gvxproject files contain the answers in plain text.
• Delete adventures you no longer need and use Clear saved progress on shared devices.
• If you use GameVault X Admin, section 7 applies.

The organisation is responsible for its own processing of personal data in the material it adds to the app.

11. Children

GameVault X is rated 4+ and is often used by families and schools. The app has no accounts, no ads, no chat and no collection of personal data. Children don't need to provide any information to play. We don't knowingly collect personal data from children. If a child has emailed us and you want the email deleted, contact us.

12. How long data is kept and how to delete it

• Delete an adventure in the app to remove the project and its media.
• Use Clear saved progress under Data in the app's settings.
• Clear game reports from the Game reports view in the library.
• Uninstall the app to remove all local data. Copies may remain in your backups until they're replaced.
• The web tool: see section 7. Support: see section 8.

13. Your rights

Under the GDPR you have the right to request access to, correction or erasure of your personal data, to request restriction, to object to processing and to receive data you've provided in a machine-readable format. Data in the app exists only on your device, so you can view, change and delete it there yourself.

For support emails and the web tool, contact support@wallgrn.com. You also have the right to lodge a complaint with the Swedish Authority for Privacy Protection (IMY) or the supervisory authority where you live.

14. Changes to this policy

We update this policy when the app or the way we handle data changes. The date at the top shows the current version. For significant changes we'll also mention it in the app's release notes.

15. Contact

Markus Wallgren / Wallgrn Studios
Sweden
support@wallgrn.com