Privacy Policy
Last updated: August 22, 2026
This policy explains what Vaultifie collects, why, how long it is kept, and what you can do about it. It covers the Vaultifie mobile app and vaultifie.com.
Who is responsible
Vaultifie is operated by Semih Can Yavuz, an independent developer based in Türkiye, who is the data controller for the information described here.
Contact: vaultifie@gmail.com. Postal address: 5000 Evler Bahçelievler Mahallesi, 119. Sokak, No:2, İç Kapı No:8, Karabük 78020, Türkiye.
What we collect
Information you give us
| Data | Why we have it |
|---|---|
| Email address | Identifies the account, verifies sign-up, resets passwords, and confirms deletion requests |
| Username | Public identity on your profile and content |
| Password | Sign-in. Stored only as a salted hash, never in readable form |
| Profile picture and banner | Shown on your profile, if you upload them |
| Biography | Shown on your profile, if you write one |
| Your content | Logs, ratings, reviews, lists, favourites, comments, tags and minigame results - the point of the service |
| Privacy settings | Whether your profile is private, who may invite or message you |
| Terms acceptance | Date and version of the terms you agreed to, which we are required to be able to show |
Information from signing in with Google or Apple
If you use Google or Apple sign-in, we receive your email address, a provider account identifier, and - where you allow it - your name. We do not receive your password. For Apple, we also store a token that exists solely so we can tell Apple to revoke the connection when you delete your account.
If you choose Apple's “Hide My Email”, we only ever see the relay address Apple gives us.
Information collected automatically
| Data | Why we have it |
|---|---|
| IP address | Recorded against security events only - account creation, sign-in, sign-out, password, email and username changes, and account deletion |
| App version | Recorded with the same security events, so we can tell which build a problem came from |
| Push notification token | Only if you enable notifications. Delivered by Expo, and on Android by Firebase Cloud Messaging |
| Popularity counts | How many times a title, review or list was opened on a given day. Counted in totals only, never linked to you, and deleted after 90 days |
What we do not collect
- No location data
- No contacts, photos library, microphone or camera access beyond the picture you deliberately choose
- No advertising identifiers, and no advertising in the app today. If we ever introduce advertising, this policy will be updated before it appears, and you will be told what changes
- No third-party analytics or tracking SDKs of any kind
- Nothing is sold or shared for advertising, and nothing is used to track you across other apps or websites
How your information is used
- To run your account and show your content to the people you have chosen to show it to
- To send service email you have asked for: verification codes, password resets, deletion confirmations, and notices about sign-in methods added to your account
- To send push notifications, if you enabled them
- To rank and recommend titles, using aggregate popularity counts that are not linked to you
- To keep the service safe: reviewing reports, acting on content that breaks the rules, and investigating abuse
- To meet legal obligations
We do not use your content to train machine-learning models, and we do not profile you for advertising.
Legal bases
Vaultifie is available worldwide, so depending on where you live this policy is governed by the GDPR, the UK GDPR, Türkiye’s KVKK, or your local equivalent. We rely on these bases:
- Contract - running the account you asked us to create
- Legitimate interests - keeping the service secure, preventing abuse, and understanding what is popular
- Consent - push notifications, which you can withdraw at any time in your device settings
- Legal obligation - where the law requires us to keep or produce records
Who else sees your information
We do not sell your data. It reaches other parties only in these ways:
| Who | What they get, and why |
|---|---|
| Other Vaultifie users | Whatever you choose to make public: your profile, reviews, lists and comments. A private profile is visible only to followers you approve |
| Hetzner (hosting, Germany) | Stores the database and files that run the service |
| Google (Gmail) | Delivers our service email, so it processes your address and the message |
| Expo, and Firebase Cloud Messaging on Android | Deliver push notifications to your device, if enabled |
| Google and Apple | Only if you use their sign-in, and only to verify who you are |
| TMDB, IGDB, Open Library | Artwork is loaded straight from their servers rather than copied to ours, so your device connects to them directly and they receive your IP address and device type. They do not receive your account details or anything you have saved |
We may also disclose information where the law requires it, or where it is necessary to investigate abuse or protect someone's safety.
Payments
Vaultifie Premium is billed by Apple or Google, not by us. We never see or store your card details. We receive confirmation that a subscription is active, its status and renewal date, and an identifier linking it to your account, through RevenueCat, which processes this on our behalf.
How long we keep it
| What | Kept for |
|---|---|
| Your account and everything in it | Until you delete your account, then removed immediately |
| Verification, reset and deletion codes | 10 minutes, then deleted |
| Popularity counts | 90 days |
| Released usernames | Reserved for a short period after a change, so the name is not immediately taken |
| Security event log (including IP address) | As long as necessary to investigate abuse, prevent fraud, and establish or defend legal claims. Not deleted when an account is deleted |
The security event log is the one thing that outlives your account. It records when an account was created, signed in and out of, had its password, email or username changed, and when it was deleted, together with the IP address the request came from. We keep it so that abuse, fraud and impersonation can still be investigated afterwards, and so we can answer a lawful request from an authority. It holds no link back to your profile, and it is not used for any other purpose.
Deleting your account
You can delete your account at any time, in the app under Settings → Delete Account, or from vaultifie.com/delete-account without the app installed.
Deletion is immediate and permanent. Your profile, logs, ratings, reviews, lists, comments, tags, favourites and minigame history are erased, your username is released, and any Apple sign-in connection is revoked with Apple. It cannot be undone, and we cannot restore it afterwards. The one exception is the security event log described above, which is retained for fraud prevention and legal purposes.
Your rights
You can ask us to give you a copy of your information, correct it, delete it, or restrict how we use it. Much of this you can do yourself: your profile and content are editable in the app, and deletion is one screen away.
To request a copy of your data, email us and we will put it together for you by hand. We are building a self-service export, and this policy will be updated when it arrives. An export contains your own activity - what you logged, rated, reviewed and listed, with each title's name, year and identifier. It does not include the wider catalogue, which belongs to the services we license it from.
To exercise any of these, email vaultifie@gmail.com. We respond within 30 days.
If you think we have handled your information badly, tell us first and we will try to put it right. You can also complain to a regulator: in Türkiye that is the Personal Data Protection Authority (KVKK), in the EU or the UK your national data protection authority, and elsewhere your local equivalent. These terms are governed by Turkish law, which does not remove any protection you have under the law of the country you live in.
Children
Vaultifie is for people aged 13 and over, and we do not knowingly collect information from anyone younger. If you believe a child has created an account, email us and we will remove it.
Some countries set a higher age for consenting to data processing without a parent - 16 in parts of the EEA. Where that applies, a parent or guardian must agree on your behalf.
Security
Traffic between the app and our servers is encrypted in transit. Passwords are stored only as salted hashes. Access to production data is limited to the people who run the service. No system is perfectly secure, but we will tell you promptly if a breach affects your data.
Where your data is held
Our servers are in Germany. If you are outside the EU, including in Türkiye, your information is transferred there and processed under that jurisdiction's protections.
Changes to this policy
If we change this policy materially, we will update the date at the top and notify you in the app or by email before the change takes effect.
Contact
Questions, requests, or complaints: vaultifie@gmail.com. There is more help on our support page.