Privacy Policy

Last updated: 12 October 2026

Vault is a free desktop app that brings your game libraries, achievements and playtime into one place. This policy explains what data Vault handles and where it goes. The short version: almost everything stays on your computer, Vault has no analytics or ad tracking, and the only thing stored on our servers is a public profile you choose to create.

1. Data that stays on your device

Vault stores these in your user data folder (%APPDATA%\vault on Windows). We never receive them.

• Sign-in tokens for the platforms you connect (Steam, PlayStation, Xbox, Epic Games, Twitch, YouTube, Spotify). They are encrypted with your operating system's secure storage.
• Your game library, achievements, playtime and play sessions, including which games you launch and for how long.
• Your settings, backlog, and local emulator data (RPCS3, shadPS4) read from folders you point Vault at.
• System information (CPU, GPU, memory use) shown on the System page. It is read live and not sent anywhere.

Uninstalling Vault and deleting that folder removes all of it.

2. Data sent to platforms you connect

When you connect an account, Vault talks to that platform on your behalf to fetch your library, achievements, playtime or channel data. Those requests go to the platform directly or through our proxy (section 3). Each platform handles your data under its own privacy policy:

• Valve / Steam — privacy policy
• Sony / PlayStation Network — privacy policy
• Microsoft / Xbox — privacy statement
• Epic Games — privacy policy
• Twitch — privacy notice
• Spotify — privacy policy
• Discord (Rich Presence, which runs through the Discord app on your PC) — privacy policy

YouTube / Google

Vault uses YouTube API Services with read-only access (youtube.readonly) to show your channel's statistics and videos. That data is shown in the app and cached on your device only. It is never sold or shared. The one exception: if you publish a public profile, it includes a link to your channel (section 4). By connecting YouTube you also agree to the YouTube Terms of Service, and Google handles your data under the Google Privacy Policy. You can revoke Vault's access at any time from Google security settings, or disconnect YouTube in Vault. Vault's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

3. Our API proxy

Some lookups (game metadata from RAWG and IGDB, Steam store data, Xbox store data) go through a small proxy we run on Cloudflare, so shared API keys never ship inside the app. The proxy forwards the request and returns the answer. It does not store your requests or link them to you. Like any web server, Cloudflare processes your IP address to deliver the request and protect against abuse (Cloudflare privacy policy).

4. Public profiles (optional)

Public profiles are off by default. If you claim a handle, Vault publishes the following to our server so anyone with the link can see it at /u/<handle>:

• your handle, display name, avatar image link and member-since date;
• links to your Twitch, YouTube and Spotify profiles, if connected;
• a snapshot of your library: game titles, cover art links, playtime and achievement progress;
• recent activity, such as achievements unlocked and completion milestones;
• the handles you follow, and who follows you.

You choose which sections (library, trophy case, activity) are shown. It never includes sign-in tokens, email addresses, Steam/PlayStation/Xbox/Epic account IDs or install paths. Only the latest snapshot is kept; each publish overwrites the last. Your profile key is stored only as a one-way hash. To limit abuse we briefly count requests per IP address; the IP itself is not stored with your profile.

Deleting: open Profile in Vault and choose Delete profile. That removes your profile, snapshot, activity and follows from our database straight away.

5. Updates

Vault checks GitHub for new versions and downloads them from GitHub Releases. GitHub sees your IP address for that request (GitHub privacy statement).

6. What we don't do

• No analytics, telemetry, crash reporting or advertising SDKs.
• No tracking cookies. This website sets no cookies; it loads its font from Google Fonts, which sees your IP address.
• We don't sell or rent data, and we don't use it to train models or build ad profiles.

Because Vault does no tracking, there is nothing to consent to beyond the choices you make in the app: which accounts to connect, and whether to publish a profile.

7. Legal basis and your rights

We process public-profile data because you asked us to publish it (consent, which you can withdraw by deleting the profile), and proxy traffic to provide the service you requested (legitimate interest). Depending on where you live (for example under the GDPR or CCPA), you can ask to access, correct, export or delete your data, or object to processing. Most of this you can do yourself in the app; for anything else, contact us below. You can also complain to your local data protection authority.

8. Children

Vault is not directed at children under 13 (or the minimum age in your country). Don't create a public profile if you are under that age. If you believe a child has published a profile, contact us and we will remove it.

9. Changes

If this policy changes, we update the date at the top. Significant changes will also be noted in the release notes.

10. Contact

Questions or data requests: nathan.lombard.dev@gmail.com