Privacy Policy
Effective: 4 May 2026
Last updated: 4 May 2026
⚠️ This is a starter draft. It accurately describes what NightVault does today, but should be reviewed by an EU-licensed lawyer for full GDPR Article 13/14 compliance and DAC7 obligations before public release.
Who runs NightVault
NightVault is operated by Raivo Trepss, registered in Latvia.
Contact for privacy questions: baltinse@gmail.com
If you're an EU resident, you have the right to lodge a complaint with the
Latvian Data State Inspectorate
(Datu valsts inspekcija).
What we collect, and why
We only collect what NightVault genuinely needs to work. We don't sell your data. We don't run ads on your videos.
Information you give us when you sign up
- Email address — for your Firebase Authentication account.
- Display name — shown to other people inside your vault.
- Profile photo (optional) — uploaded to our media provider (Cloudinary) so other vault members can see who you are.
Information you create using the app
- Video clips you record during a vault session
- Group chat messages you send inside a vault
- Drink counter taps (number only — no biometric data)
- Party / vault membership — which sessions you're in and which roles you've been assigned
These are stored privately and visible only to people in the same vault as you.
Information we collect automatically
- Firebase UID — your unique identifier inside our database
- Push notification token (only if you allow notifications) — so we can tell you when a recording prompt is yours, when chat messages arrive, and when your vault unlocks
- Approximate session timestamps — when you create or join a vault
What we do not collect
- Your precise location
- Your contacts (other than friends you explicitly add)
- Browsing history outside the app
- Health, financial, or biometric data
- Advertising identifiers (IDFA)
We do not track you across other companies' apps or websites.
How we use your data
- Run the app — sign you in, deliver your vault, route messages, send notifications.
- Time-lock clips — your clips stay locked from playback until 12 hours after the vault was started, or until your group ends the night early.
- Process payments — handled entirely by Apple's App Store and our payment provider RevenueCat. We never see your card number, bank account, or full payment details.
- Customer support — if you email us, we use your email to reply.
Where your data lives
We use these third-party processors:
| Service | What they do | Where data lives |
|---|
| Google Firebase |
Account auth, real-time vault state, file storage |
Google Cloud (EU multi-region where available) |
| Cloudinary |
Video & image hosting, transcoding |
EU/US (depending on plan) |
| RevenueCat |
Subscription receipt validation |
US |
| Apple App Store |
Payment processing, push notification delivery |
Apple infrastructure |
| Expo / EAS |
App distribution and build pipeline |
US |
Each of these has its own privacy policy. We have signed Data Processing Agreements (or equivalents)
that allow EU/EEA data transfers.
How long we keep your data
- Free tier: Video clips and chat are kept for 7 days after the vault unlocks, then permanently deleted.
- Vault Pass subscribers: Video clips and chat are kept for 90 days after the vault unlocks, then permanently deleted.
- Account data (email, name, profile photo, UID): kept until you delete your account.
- Friend graph (people you've added): kept until you delete your account or remove friends.
- Authentication logs (last sign-in time): kept for up to 30 days for security.
Your rights
If you live in the EU/EEA, the UK, or California, you have the right to:
- Access the personal data we hold about you
- Correct inaccurate data
- Delete your data ("right to be forgotten")
- Export your data in a portable format
- Object to processing or withdraw consent
- Lodge a complaint with your local data protection authority
To exercise any of these, email baltinse@gmail.com. We aim to respond within 30 days.
You can delete your NightVault account from inside the app: Settings → Delete Account.
This will permanently remove your profile, clips, and vault membership. Clips inside vaults you don't own
will remain (because other people in the vault need them) but will be detached from your identity.
Children
NightVault is rated 17+. We do not knowingly collect data from anyone under 17.
If you believe a child under 17 has signed up, email us and we'll remove the account.
Security
We use HTTPS for all traffic, Firebase security rules to gate vault access to participants only,
and never expose API keys or credentials in client code. We do not allow clip playback
before the vault's unlock time at the database level — it's not just a UI lock.
That said, no system is perfectly secure. If you discover a vulnerability,
please email baltinse@gmail.com so we can fix it before it's exploited.
Changes
If we change this policy materially, we'll notify you in-app and update the "Last updated" date above.
Continued use after changes means you accept the new policy.
Contact
Privacy questions, data requests, or just want to say hi:
baltinse@gmail.com
Raivo Trepss
Latvia, EU
This policy was last reviewed on 4 May 2026. NightVault is built with care by a small team based in Latvia.