In force from 23 August 2026.
This policy describes what Koria Vault actually does with your data. Every claim in it is a description of code that exists, checked against the code, not a template filled in. Where something is not built yet, it says so.
It covers the website at koriavault.com and the game at play.koriavault.com. They are separate systems and the difference matters, so it is described rather than glossed over.
1. Who is responsible
Controller: Guilherme, sole operator of Koria Vault, Brazil. Contact: contact@koriavault.com — a monitored mailbox, read by a person.
There is no Data Protection Officer. One is not required at this scale, and claiming one would be a fiction; the contact address above reaches the only person who administers this service.
Both the Brazilian LGPD (Lei Geral de Proteção de Dados, Lei 13.709/2018) and the EU GDPR (Regulation 2016/679) apply. The service is operated from Brazil, and a browser game takes European traffic on its first day.
2. What we collect
2.1 When you register with an email address
| Data | Why we need it | Legal basis |
|---|---|---|
| Email address | Identifies the account; the only way to reach you about it | Performance of a contract |
| A hash of your password | So you can sign in | Performance of a contract |
| A display name you choose | Your public identity in the game | Performance of a contract |
| Language preference | So the account reads the same on every device | Performance of a contract |
We never store your password. What is stored is a scrypt hash with a per-account random salt. scrypt is memory-hard by design: each verification costs roughly 16 MB of memory and about 50 milliseconds, which is what makes guessing the original from the hash impractical at scale. The original password is not recoverable by us, by you, or by anyone who steals the database.
2.2 When you sign in with Google
If you use Continue with Google, Google sends us three things:
- your Google account identifier — a stable, opaque value Google calls
sub - your email address
- the name on your Google account
We store the identifier and the email address. We do not request or store your Google profile picture. The database column that would hold an avatar is a 64-character key rather than a URL, deliberately, so that it cannot quietly become one.
The name from Google is not used as your display name. You are asked to choose one, because a display name here is unique, 3–24 characters, and is something you pick rather than something you are assigned.
We request the scopes openid email profile and nothing else. We do not request offline access, so there is no long-lived Google token for us to hold or to lose.
We never receive your Google password, and Google never receives your game password.
2.3 While you play
| Data | Why |
|---|---|
| Account creation time, and time last used | Account administration; identifying dormant accounts |
| Your game state — colonies, structures, resources, messages, fleets | It is the game |
| IP addresses, in ordinary web-server logs | Security and abuse prevention — legitimate interest |
2.4 What we do not collect
Stated plainly, because absence is hard to verify from outside:
- No analytics of any kind. No Google Analytics, no Plausible, no self-hosted equivalent, no pixel, no tag manager.
- No advertising identifiers, and no advertising.
- No behavioural profiling, no cross-site tracking, no fingerprinting.
- No payment data. There are no purchases in this service today, so no card details exist anywhere in it.
- No date of birth, no address, no telephone number, no real name unless you choose to put one in a field meant for something else.
3. Cookies and similar technologies
One cookie. It is strictly necessary. There are no others.
| Name | koria_session |
| Purpose | Keeps you signed in |
| Contents | Your account identifier and an expiry, signed with a secret key |
| Lifetime | 30 days |
httpOnly | Yes — unreachable from JavaScript, so a script injection cannot read it |
sameSite | lax |
secure | Yes — sent only over HTTPS |
| Domain attribute | None. Host-only to play.koriavault.com |
That last row does more than it looks. Because no domain attribute is set, the cookie is never sent to koriavault.com — the website — which therefore cannot read your session even if the website itself were compromised.
This is why you are not being shown a cookie banner. A strictly necessary cookie requires no consent under either regime, and we chose to have no other kind. That was a design decision taken so this notice could stay short and true.
The website (koriavault.com) runs WordPress and sets no cookies for ordinary visitors who do not log in to it — and no player ever logs in to it, because it has no accounts.
We use no local storage, no session storage, no IndexedDB and no web beacons for tracking purposes.
One honest limitation. The session cookie is signed rather than stored, so we cannot revoke an individual session before it expires. Signing out clears the cookie in your browser, which is sufficient in normal use. If you believe your session has been stolen, change your password and write to us — we can close the account, which takes effect immediately.
4. What is published
Some of your data is deliberately public. It appears on web pages anyone can read and search engines will index. This is a design decision, not a side effect, and it is stated here so that you know before you register rather than discovering it on a leaderboard.
Published:
- your display name
- titles you have earned, and which Vault earned them
- your standing this season — colonies, systems settled, structures raised, as counts
- your Marks balance, the permanent achievement currency
- which Korian Fragments you are holding
Fragment custody is public on purpose. Holding Fragments is meant to make you findable by other players; that is the central balancing mechanism of the game, not an oversight.
Never published:
- your email address
- your IP address
- when you were last online
- your Credits balance — a live season balance would tell a raider who can afford to rebuild
- your inventory, your messages, and anything in your inbox
- your profile biography — the field exists and nothing is published from it
The public feed is read-only, unauthenticated and served from database views that cannot reach the account table at all.
5. Who else sees your data
Two processors, and no others.
| Processor | What for | Where |
|---|---|---|
| Hostinger International Ltd | Hosting, database, email | EU (Lithuania) and its network |
| Google Ireland Ltd / Google LLC | Sign-in only, and only if you choose it | EU and United States |
We do not sell your data. We do not share it for advertising. We do not disclose it to anyone else except where we are legally obliged to, or where it is strictly necessary to investigate abuse of the service.
There are no analytics providers, no tag managers, no embedded third-party content, no fonts loaded from a third party, and no content delivery network in front of your requests. Typefaces are served from our own domain precisely so that visiting a page does not disclose your IP address to anyone else.
International transfers. Data may be processed outside Brazil and outside the European Economic Area. Where it leaves the EEA it relies on the processor’s own Standard Contractual Clauses. Under LGPD Article 33, transfers rely on contractual guarantees offered by those processors.
6. How long we keep it
| Account and game state | While the account is open |
| Closed accounts | Removed from every public page immediately. The account row is retained for up to 90 days so that closing cannot be used to escape a suspension and re-register at once, then deleted |
| Archived Vaults | When a Vault ends, colonies, fleets, research and resources are destroyed. Your display name, titles and the Vault ordinal that earned them survive — that is the point of the Archive, and it is permanent unless you close the account |
| Server logs, including IP addresses | A short rolling window, then discarded |
| Support correspondence | Kept while it is useful to the conversation, then deleted |
7. Your rights
Under LGPD Article 18 and GDPR Articles 15–22 you may ask us to:
- confirm whether we process data about you, and access it
- correct anything incomplete, inaccurate or out of date
- delete it, subject to what we must keep by law
- export it in a structured, machine-readable form (portability)
- restrict or object to processing
- withdraw consent, where consent is the basis — and withdrawing it does not affect anything already done lawfully before you did
- be told which public and private bodies we have shared data with (LGPD)
- be informed of the consequences of refusing consent (LGPD)
Automated decision-making. There is none. Nothing in this service profiles you, scores you, or makes a decision about you without a person involved. Game outcomes are calculated by game rules, which is not what Article 22 means.
How to exercise any of this: write to contact@koriavault.com. We answer within 15 days (LGPD) or one month (GDPR), whichever is shorter for you. We may ask you to confirm you control the account’s email address — that check exists to stop somebody else exercising your rights, not to slow you down.
Complaints. You may complain to a supervisory authority at any time: the ANPD in Brazil, or your national data protection authority in the EU.
8. Children
You must be at least 16 to use this service in the European Economic Area without the consent of a parent or guardian, and at least 13 elsewhere.
We do not knowingly collect data from anyone below those ages. If you believe a child has registered, write to us and we will close the account and delete the data.
9. Security, stated honestly
What we do:
- Passwords are hashed with scrypt and are not recoverable.
- The session cookie is signed,
httpOnly,secure, and host-only to the game. - The website and the game use separate databases with separate credentials, and the website cannot read accounts at all — it reads a public, read-only feed and nothing else.
- All traffic is HTTPS. Plain HTTP is redirected.
- Administrative access is limited to the operator.
What we do not claim:
This is a small service run by one person. No system is impossible to breach. If your data is exposed in a way that presents a risk to you, we will tell you and the relevant authority — under GDPR that is within 72 hours of becoming aware, and under LGPD within a reasonable period.
One structural limitation, stated because it is real: the website and the game run under the same operating-system user on shared hosting. Separate databases and separate database users protect against a leaked database password and against SQL injection. They do not protect against arbitrary code execution inside the website software itself. We keep the website deliberately boring — core plus a handful of well-known plugins, automatic updates on — because that is most of the defence available at this size.
10. Features not yet built
Stated because leaving them out would misrepresent the service.
- Email verification and password reset are not live yet. Both are being built. Until they are, an account whose password is lost cannot be recovered by you or by us. Use a password manager.
- Google sign-in is not live yet. Section 2.2 describes how it will behave when it ships. This policy will be dated again when it does.
- The public feed described in section 4 is not live yet. The fields listed are what will be published when it is.
11. Changes to this policy
Material changes are announced in the game before they take effect, and the date at the top of this page changes. Every version is recorded below.
| Date | Change |
|---|---|
| 23 August 2026 | First version. |