Privacy Policy

1. Who we are

GuideVault is a game-guide site run by one person. This policy describes what the site actually stores, who else sees it, and how long it is kept. It is written from the code, not from a template: if you find something here that the site does not do, that is a bug and we want to hear about it.

2. If you only read the guides

Reading GuideVault needs no account and sets no tracking cookies. There is no analytics on this site: Google Analytics, Google Tag Manager and Disqus were all removed in September 2026 and nothing replaced them.

• A session cookie, and only once something needs one. It is HttpOnly, SameSite=Lax, sent only over HTTPS, and it expires when you close the browser. It is strictly necessary and carries no identifier of you.
• Your browser's local storage, which never leaves your device and which we cannot read from the server. It holds your theme, your spoiler setting, and — if you are not signed in — the guide progress you tick off.
• Server logs kept by our hosting provider, in the ordinary way, including your IP address.
• Searches that found nothing. When the site search returns no results and you give up, we record the words you searched for and the page language — so we know which guide is missing. We count how many times each term was searched; we do not record who searched it, when, from what address, or in what order. Two people searching the same thing are indistinguishable from one person searching it twice, and that is deliberate: it answers "what should we write next" without building a picture of you. Searches that do find something are not recorded at all, and neither are terms that look like an email address, a link or a long number.

3. If you create an account

Then we store, in our own database:

• Your username and a hash of your password. We never store the password itself and cannot recover it.
• An email address, if you give one. It is optional and we use it for one thing: letting you reset your password. Changing it asks for your password first.
• Your progress — what you have ticked off in each guide, your save slots and any custom tasks you add.
• Anything you publish: community routes and their steps, saved routes, and reports you send about content or about someone else's route.
• A profile visibility setting, which you control, and which decides whether anyone else can see your progress.
• Progress cards: if you generate one, the rendered image is stored on our server so it can be shared.

Password reset links are stored only as a hash and expire after one hour.

4. If you sign in with Google

We store the stable account identifier Google gives us and the email address on that Google account. We never receive your Google password. Signing in this way means Google knows you visited us, under their own privacy policy.

5. If you link Patreon

Linking is optional and only affects which supporter tier the site gives you. We store your Patreon account identifier, and we log the pledge events Patreon sends us — which includes the email address on your Patreon account and the event as Patreon sent it. That log exists so a payment that does not match any account can be sorted out by hand.

When your account is deleted, those log entries are stripped of the email, the raw event and the link to you; only the anonymous shape of the event survives for accounting.

6. Other people's services

Loading a page here also contacts:

• Google Fonts, which receives your IP address in order to serve the typefaces.
• Google reCAPTCHA, but only on the contact form, to tell people from bots.

Both are Google services and are governed by Google's privacy policy. Links out to game sites, stores or wikis are theirs, not ours, and we do not control what they collect.

7. The contact form

What you write is emailed to us and not stored in any database. We keep the email as long as we need it to answer you.

Guide announcements: If you tick the box on the sign-up form, we store your email address, which guide you asked about, and the date and IP address of that consent — the last two exist so we can show when and how you agreed. We use it for one thing only: telling you when that guide is ready. We never sell or share it. Every message carries an unsubscribe link, and unsubscribing marks the record as withdrawn rather than deleting it, so the record of your consent and its withdrawal survives. Ask us and we will delete it outright.

8. Crash and security reports

Your browser may send us a report when a script on the page is blocked by our security policy. Those reports describe the page and the blocked resource, not you, and the log is capped and then stops writing.

9. How long we keep things

• Your account: until you delete it. You can ask from your account settings; we then wait 30 days — during which you can cancel and get everything back — and after that it is deleted permanently, along with your progress, your progress cards, and your guide-announcement sign-ups. One thing outlives it on purpose: if an administrator acted on your account, the record that an action happened stays, with your ID removed. Deleting that too would erase the trace of your own deletion, which is the case the record exists for.
• Password reset links: one hour.
• Our own admin actions: when a site administrator changes or deletes an account, we record which administrator did it, what they did and when, and keep that for 24 months. We do this so that a change to your account is never anonymous, including a deletion. The record stores account IDs and the names of the fields that changed; it does not copy your email address or your password.
• Searches that found nothing: 12 months from the last time anyone searched that term. A word nobody has looked for in a year no longer tells us which guide to write, so we stop keeping it.
• Guide announcements: as described above — unsubscribing keeps the record of your consent and its withdrawal, and asking us deletes it outright.

10. Your rights

You can ask us for a copy of what we hold about you, ask us to correct it, or ask us to delete it. Deletion you can do yourself from your account settings; for a copy or a correction, email us and we will do it by hand — there is no self-service export yet, and we would rather say so than pretend otherwise.

You can withdraw consent for guide announcements at any time from the link in every message.

11. Contact

Questions about this policy, or about anything above: contact@guidevault.online.