Privacy policy

Monster Vault is a game, and we collect only what the game needs to work, to stay fair and to keep your progress safe. We do not show ads, we do not track you across other apps or websites, and we never sell your information.

Monster Vault is made by LH Studio in New Zealand ("we", "us"). If you have any question about this policy or your information, email hello@leonardharvey.com.

What we collect

Your account

The first time you open the game we create an account for you with a random ID. You do not give us a name, email address or phone number to play.

If you choose Sign in with Apple, Apple gives us an identifier for your Apple Account so you can get your progress back on another device. We do not ask Apple for your name or email address.

Your birth year

We ask for the year you were born, and only the year. We use it to keep the game to players aged 13 and over and to turn off purchases for players under 16. If the year shows a player is under 13, the game deletes the account it made on first launch straight away and does not set the game up on that device.

Your game

Your progress: the cards you own and their serial numbers, your decks, coins, gems and packs, missions, ranked results and the moves you make in battles (so our servers can check every result). We also keep a dated history of each change to your coins, gems, packs and shards, and of your battles and matches, so we can sort out problems and spot cheating. If you use the market, we keep your listings and trades. The game also gives you a made up player name, such as "Mossfang 4821". You cannot type your own name, and there is no chat.

Your purchases

When you buy something, Apple handles the payment. The game gives Apple your account ID with the purchase, so Apple's confirmation can be matched to your account. We receive the details of the purchase from Apple (what was bought, when, and Apple's transaction number) so we can deliver it and handle refunds. We never see your card or bank details. For a Vault Pass subscription, Apple also tells us when it renews, is cancelled, fails to renew, expires or is refunded, so the pass in your account stays up to date.

Technical information

Like most online services, our hosting provider keeps short-lived server logs, which include your IP address and basic details of each request. We use these only to keep the service secure and to fix problems. They are deleted automatically, usually within a week. Our sign-in system also stores your IP address and device type with your sign-in session for as long as the session lasts, and keeps a security log of sign-ins.

On your device

The game stores a copy of your progress and a few settings (such as sound and battle speed) on your device so it starts quickly and can resume a battle if the app closes.

How we use it

• To run the game and save your progress.
• To check battles, packs, trades and purchases on our servers, and to stop cheating, bots and fraud.
• To deliver purchases and to reverse them if Apple refunds them.
• To answer you when you contact support.

We do not use your information for advertising, and we do not build profiles of you.

Who can see it

• Other players can see your made up player name, your ranked rating and record, the rarest monster in your battle deck (shown as your portrait in ranked battles), the cards you put up for sale on the market (including their serial numbers), and the emotes you send in a ranked battle. They cannot see your account ID.
• Supabase hosts our servers and database. Your information is stored and processed in Sydney, Australia.
• Apple processes payments and Sign in with Apple, under Apple's own privacy policy.

We do not share your information with anyone else unless the law requires it.

How long we keep it

We keep your account for as long as you have it. You can delete it at any time in the game: open Settings and choose Delete account. Your account, progress, cards, listings and history are deleted straight away and cannot be recovered. Copies in our hosting provider's backups are overwritten within 7 days.

After an account is deleted we keep a record of each past purchase (what was bought, when, and Apple's transaction number), with nothing from your game account, because we need it for accounting, tax and refunds.

If you play as a guest and delete the app without signing in with Apple, we cannot reconnect you to your old account. Guest accounts that were never signed in with Apple and have not been played for 12 months are deleted automatically.

Children

Monster Vault is not for children under 13. The game asks for a birth year before anything else, and if the player is under 13 it deletes the account it made straight away. If you believe a child under 13 has an account, email us and we will delete it.

Your rights

You can ask us for a copy of the information we hold about you, ask us to correct it, or ask us to delete it (you can also delete your account yourself in Settings). Email hello@leonardharvey.com and include the account code shown in the game's Settings, so we can find your account. Before we act, we may ask you to confirm details that only someone playing on that account could see. We will reply within 20 working days.

We follow the New Zealand Privacy Act 2020. If you are not happy with how we handle your information, you can contact the Office of the Privacy Commissioner. If you live in the European Union or the United Kingdom, you also have the rights given by the GDPR, including the right to complain to your local data protection authority.

Security

Information travels between the game and our servers over encrypted connections. Players can only read their own progress, and every change goes through our servers, which check it first.

Changes

If we change this policy we will update the date at the top. If a change matters, we will post it on this page at least 14 days before it takes effect.