Privacy Policy | fnvault

1. Overview

fnvault (“we”, “us”, “our”) is a Fortnite companion application that provides stats, item shop information, cosmetics browsing, and locker import tools. This policy is intentionally short because we intentionally collect very little: fnvault is built around minimal-PII, self-serve deletion, and never storing more than we need to run the product.

2. Information We Collect

fnvault accounts are our own — we never require you to hand over your Epic Games password.

Account data: your email address and a display name. That is the entire set of personal information an fnvault account requires.
Password: stored only as an argon2id hash. We never store, log, or have access to your plaintext password.
Session data: a random session token in an httpOnly cookie, backed by a session row in our database. The token itself cannot be read by scripts on the page and is not shared with third parties.
Epic Games connection (optional): connecting your Epic account is opt-in. If you connect, your Epic access and refresh tokens are encrypted at rest with AES-256-GCM before storage. Disconnecting your Epic account permanently deletes those encrypted tokens.
Locker snapshots: if you import your locker, we store a snapshot of your owned cosmetics so the Locker page can render without re-fetching from Epic every visit. Snapshots are retained until you delete your account.
Analytics: we use a self-hosted, cookieless Umami instance and Google Analytics 4 for usage analytics — pageviews plus a closed set of in-app interaction events (for example votes cast, wishlist changes, sign-in/out), never anything containing your email, user ID, or display name. Umami does not use cookies or track you across sites; Google Analytics does use cookies, and Google’s own privacy policy governs the data it receives.
Cosmetic images: item, shop, and cosmetic images are hotlinked directly from Epic Games’ and fortnite-api.com’s CDNs. We do not proxy, cache, or store image bytes ourselves.
Support button: the “Buy Me a Coffee” button in the site footer loads a small image directly from Buy Me a Coffee’s servers. Like the cosmetic images above, this is a direct third-party image request — visiting any page shares your IP address and browser information with Buy Me a Coffee the same way any embedded image does.
Advertising: we use Google AdSense to show ads. AdSense uses cookies to personalize ads and measure performance. If you're in the UK or EU, a consent banner lets you choose whether to allow personalized advertising before any ad-related cookies are set. You can review or opt out of personalized ads at Google Ads Settings.

3. How We Use Your Information

Your email and display name are used solely to operate your fnvault account (authentication, session management, and communicating with you about your account). Locker snapshots and your optional Epic connection power the Locker, and nothing more — we do not sell your data, and we do not share it with third parties beyond the infrastructure required to run the site (our database and hosting provider).

4. Data Retention & Deletion

You can permanently delete your fnvault account and all associated data — your account record, sessions, Epic connection (including encrypted tokens), and locker snapshots — at any time from Settings. If you are unable to access your account, email [email protected] and we will process the deletion manually.

5. Your Rights (GDPR / UK-GDPR)

If you are located in the UK or EU, you have the right to access, rectify, or erase your personal data, and to request a copy of the data we hold about you. Because we collect so little (your email, display name, and optional locker data), most of these requests are satisfied instantly through self-serve deletion at Settings. For any other request, contact us at [email protected].

6. Children’s Privacy

fnvault is intended for users aged 13 and over. We do not knowingly collect personal information from children under 13. If you believe a child under 13 has created an account, contact us and we will delete it.

7. Epic Games Disclaimer

8. Contact

Questions about this policy? Reach us at [email protected].