Privacy policy. | PlaydayVault

Information we collect

Orders and memberships store your email, chosen products or plan, price, payment references, status and dates. Printable unlock records store the selected game, membership, allowance period and date to enforce download access. Saved family sessions store team names, scores, selected cards, progress and treasure-hunt settings. Please use team nicknames rather than children’s names. Contact messages store the details you provide. Email sign-in creates a time-limited customer session that stores your email, verification time and expiry. A separate first-verification registry stores your email and date to distinguish new accounts from returning sign-ins; it does not grant purchase access. Newsletter records store your email, consent and confirmation status. Welcome-offer records prevent repeat redemptions. Playtest feedback stores the game edition, group size, youngest age, timings, hints, enjoyment score and the notes you choose to send; do not include names or contact details. Feedback is private and used to improve games. Game suggestions store an occasion, theme, youngest player age and the notes an adult chooses to send; please leave out names and contact details. We do not collect payment card numbers; those are handled by Stripe.

How we use it

We use order information to take payment, provide downloads, restore access, handle support and manage refunds. We use contact messages to respond to you. Marketing email requires a separate, confirmed subscription and is not a condition of purchase or free play.

Service providers

The production store runs on OVH infrastructure. Private previews may use OpenAI Sites and Cloudflare infrastructure. Stripe processes payments. When configured, Resend delivers transactional and subscription emails. These providers may process data in countries other than your own under their applicable terms and safeguards.

Cookies and local storage

The account cookie lasts up to 30 days and is revoked on account sign-out. Six-digit email sign-in codes expire after ten minutes and work once. The shopping bag, saved games and played marks are stored on your device. You can clear saved games and played marks from the library. A separate HttpOnly newsletter cookie lasts up to 30 days and connects a confirmed email to welcome-offer eligibility. An essential, HttpOnly access cookie opens a purchased order for up to 30 days. Private preview hosting may also require platform sign-in cookies. Escape-room progress stays in the open page. Family-game sessions are saved on our server so you can resume. An essential membership cookie lasts up to 30 days; free family sessions use a signed guest cookie for up to seven days. Temporary membership checkout details are kept in your browser session storage to prevent duplicate checkouts. No child account is required. We count product views, game-finder completions, bag additions, free-game starts, collection views, newsletter requests and confirmations, tagged campaign landing-page loads, playtest submissions, family sessions started and finished, game suggestions, catalogue searches and searches without a match, and checkout starts by day and product to understand store usage. Catalogue search text is processed to count matching games and is not stored. These first-party aggregate counters contain no visitor identifiers and set no analytics cookies. Preview and live counts are separate. On the live website, optional Google Analytics helps us understand page visits, product views, cart additions, checkout starts, verified account and newsletter signups, and paid purchases. Google code loads only after you allow analytics. We remember your choice for up to 180 days; use Privacy choices to change it. This choice is separate from newsletter consent. Advertising consent stays denied. If allowed, Google may collect browser, device and page-visit information and set analytics cookies under its privacy policy. Google page URLs and referrers configured by our tag omit query strings and fragments. Purchase events include the order or invoice reference, product identifiers, licence, USD currency and prices, but not your email, payment-card details or sign-in codes. When server delivery is configured, a signed HttpOnly consent cookie connects consented Google client and session identifiers to checkout and subsequent verified subscription payments. The server retries unsent events; submitted or discarded event payloads and identifiers are cleared. The scheduled cleanup removes event rows after 30 days and expired consent records after their retention period. Checkout context can remain during active consent to measure subscription renewals. Withdrawal suppresses unsent delivery and clears identifiers from checkout context, but cannot retract an event already sent to Google. Development and private preview environments skip the Google tag. Rejecting analytics does not prevent shopping, downloads or gameplay.

Retention and choices

We retain order records while needed to deliver purchases and meet applicable record-keeping obligations. Contact us to request access, correction or deletion of your personal information; some transaction records may need to be retained. Unsubscribe from marketing using the link in an email.

Children and contact

An adult should make purchases and manage email subscriptions. We do not ask children to create accounts or provide personal details to play. For privacy requests, use the contact form and identify the order email concerned.