Privacy Policy

ESOTECH LTD operates NEBULA VAULT. This notice describes the current beta service and this information website. It is not a promise of availability in every country. Updated: 26 October 2026.

The app creates a signing key in iOS Keychain. The private key stays on your device; our service stores its public identity, virtual coin ledger, balances, progress, collection and reward claims. Reinstallation recovery depends on the Keychain identity remaining available. We do not use a permanent hardware device number and cannot guarantee recovery after a device reset or loss of that identity.

Apple processes payments and RevenueCat helps verify transactions. We receive purchase identifiers, products and relevant transaction status to deliver content once, reconcile pending purchases and process refunds. We do not receive your payment card number. Consumable coin delivery is reconciled by our service; reinstalling the app does not itself create another purchase grant.

First-party analytics include game interactions, session activity, app version, device model, selected language, time zone and device-locale country. Device locale is not proof of your current location. Network providers process IP addresses to deliver and protect the service. Region-access checks use coarse country or state information; we do not request GPS, contacts, microphone or camera access. Product interaction records are not used to track you across other companies’ apps or websites.

AWS CloudFront supplies the network’s coarse country and, for United States connections, state. It is an estimate based on the network exit IP and may be inaccurate for mobile networks, proxies or VPNs. You may voluntarily declare your residence country and US state for eligibility review; a mismatch can temporarily pause game access. We store the declaration and review status with your guest identity. Coarse location-change risk records expire after seven days; we do not store precise coordinates or a location history based on GPS. The system does not use your Apple Account region or language as proof of location.

Marketing reminders require an explicit choice and the iOS permission flow. If enabled, the service stores your consent, notification permission, installation identifier, APNs device token, preferred language, quiet hours and time zone. Turn marketing reminders off in the app settings at any time. An offline opt-out is retained locally and retried when connected. Marketing delivery remains globally paused during the current beta.

Sharing is optional and uses the iOS share sheet. A card contains its date, NEBULA VAULT artwork and, for a winning card, the settled virtual reward. It excludes your guest identifier, wallet balance, purchase identifiers and location. The daily card-creation gift does not require a public post. The destination you choose processes the shared content under its own policy.

Our game backend runs on AWS, Apple and RevenueCat provide purchase services, and Cloudflare hosts this information website and its network services. Data may be processed outside your country. Applicable transfer safeguards and country-specific notices must be reviewed before opening a new market. We do not sell personal information or integrate third-party advertising in this beta.

Raw product analytics are configured to expire after 90 days. Guest progress and verified transaction records are retained to preserve balances, prevent duplicate grants, handle refunds and meet applicable obligations. A deletion request does not remove records that must lawfully be retained. Access uses signed requests and server-side authorization. No network service can promise absolute security.

Depending on applicable law, you may request access, correction, deletion, restriction or portability of relevant personal data, withdraw optional consent, object where applicable, or raise a concern with your local privacy authority. During the beta, use TestFlight → NEBULA VAULT → Send Beta Feedback and identify the request as a privacy request. We may require in-app proof of the guest identity before disclosing account records or making changes. Never send your private signing key, Apple password or payment card details.

The game is intended for people aged 18 and over, subject to applicable local requirements. This static website includes no advertising pixels, analytics scripts or non-essential cookies. Cloudflare may process essential security and delivery data. The final commercial privacy contact and country-specific review remain release requirements.