Privacy Policy | fnvault

1. Overview

fnvault ("we", "us", "our") is a Fortnite companion application that provides stats, item shop information, cosmetics browsing, and locker import tools. This policy is intentionally short because we intentionally collect very little: fnvault is built around minimal-PII, self-serve deletion, and never storing more than we need to run the product.

2. Information We Collect

fnvault accounts are our own — we never require you to hand over your Epic Games password.

Account data: your email address and a display name. That is the entire set of personal information an fnvault account requires.
Password: stored only as an argon2id hash. We never store, log, or have access to your plaintext password.
Session data: a random session token in an httpOnly cookie, backed by a session row in our database. The token itself cannot be read by scripts on the page and is not shared with third parties.
Epic Games connection (optional): connecting your Epic account is opt-in. If you connect, your Epic access and refresh tokens are encrypted at rest with AES-256-GCM before storage. Disconnecting your Epic account permanently deletes those encrypted tokens.
Locker snapshots: if you import your locker, we store a snapshot of your owned cosmetics so the Locker page can render without re-fetching from Epic every visit. Snapshots are retained until you delete your account.
Analytics: we use a self-hosted Umami instance for aggregate, cookieless usage analytics (pages viewed, general traffic patterns). Umami does not use cookies or track you individually across sites.
Cosmetic images:item, shop, and cosmetic images are hotlinked directly from Epic Games' and fortnite-api.com's CDNs. We do not proxy, cache, or store image bytes ourselves.

3. How We Use Your Information

Your email and display name are used solely to operate your fnvault account (authentication, session management, and communicating with you about your account). Locker snapshots and your optional Epic connection power the Locker, and nothing more — we do not sell your data, and we do not share it with third parties beyond the infrastructure required to run the site (our database and hosting provider).

4. Data Retention & Deletion

You can permanently delete your fnvault account and all associated data — your account record, sessions, Epic connection (including encrypted tokens), and locker snapshots — at any time from Settings. If you are unable to access your account, email [email protected] and we will process the deletion manually.

5. Your Rights (GDPR / UK-GDPR)

If you are located in the UK or EU, you have the right to access, rectify, or erase your personal data, and to request a copy of the data we hold about you. Because we collect so little (your email, display name, and optional locker data), most of these requests are satisfied instantly through self-serve deletion at Settings. For any other request, contact us at [email protected].

6. Children's Privacy

fnvault is intended for users aged 13 and over. We do not knowingly collect personal information from children under 13. If you believe a child under 13 has created an account, contact us and we will delete it.

7. Epic Games Disclaimer

8. Contact

Questions about this policy? Reach us at [email protected].