Privacy policy

This page explains what personal data KeyVault (keyvault.theden.se) collects, why, who else sees it and how long we keep it. The site is run privately from Sweden, and we are responsible for this data. Contact: admin@theden.se.

What we collect

• Your account. If you sign in with Discord: your Discord user ID and username, and the date the Discord account was created (it is part of the ID). We never get your email address, password, messages or servers from Discord.
• What you do on the site. The keys you claim and when, your wishlist, key requests, support tickets and messages, keys you contribute, donation reports, achievements, your monthly limit and group, any pause or ban and its reason, and when you agreed to the site rules.
• Sign-ins, claims and tickets. The time, your IP address and your browser and device (the user agent) for each sign-in, key claim and support ticket.
• Page views. For every page someone opens, also without an account: the time, the page, the IP address, the browser and device, the website you came from (only its domain), your account if you are signed in, and the country and network (internet provider) that the IP address belongs to. We look these up in a database on our own server (DB-IP Lite), so nothing is sent anywhere. No cookies are used for this.
• Server logs. Our web server keeps a standard access log (IP address, time, the address requested and the browser).

Why we use it

• To run your account and give out keys. This is the service you sign up for (GDPR article 6(1)(b), contract). That includes the emails we send about your keys and tickets.
• To stop abuse and keep the giveaway fair. IP addresses, devices and the age of Discord accounts help us find one person with many accounts, bots and people getting around a ban. This is in our legitimate interest and in the interest of everyone else who wants a key (article 6(1)(f)).
• To warn you about region-locked keys. When you open or claim a game, the country of your IP address is compared with the key's region rules, so we can tell you when a key may not work where you are (part of the service, article 6(1)(b)).
• To see how the site is used. Visitor statistics show how many people visit, from where and on which pages, so we can improve the site (legitimate interest, article 6(1)(f)).

Automatic checks

Staff decide every pause, limit and ban themselves; no decision about you is made by automated means alone. Two simple checks run on their own: a Discord account younger than 60 days can't claim keys yet; and when a new account shows up on an IP address that other accounts already use, our staff get an alert so a person can take a look.

Who else sees it

• Our staff. Moderators and admins see accounts and what they have done. Only admins can see IP addresses.
• Discord. Signing in with Discord happens on Discord, under Discord's own privacy policy. Staff alerts are also posted in a private channel on our Discord server: for support tickets (username, game and message) and for shared-IP alerts (username and IP address). Discord is a US company, so this data is stored outside the EU.
• Steam. Game pictures on the site are loaded from Steam's servers, so Steam (Valve) sees your IP address when your browser fetches them. Buttons such as "Redeem on Steam" take you to Steam. If you import your Steam wishlist, we fetch the public wishlist from Steam for the profile you enter; we keep the matching games, not the profile address.
• Email. Emails from us go through our mail provider.
• We never sell your data or use it for advertising. The ads on the site are our own and only count views and clicks in total.

How long we keep it

• Your account and activity: as long as the account exists.
• IP addresses and devices from sign-ins, claims and tickets: as long as the account exists. We need them to see which accounts belong together.
• Page views: the IP address, browser details and account are removed after 12 months. What's left (time, page, country, network, browser type) can't be traced back to you and stays for the statistics.
• Attempts from a blocked network: 12 months. IP bans: until they are lifted.
• Server logs: about two weeks.
• Staying signed in: 30 days after the browser's last visit, or until you log out.
• When an account is deleted, we remove the account, its sign-in history, wishlist and achievements, and its page views lose their IP address and link to it. Records of which keys were given out, tickets and staff actions are kept without your name or email, so our key records stay complete.

Cookies and your browser

We use two cookies. A session cookie protects forms and is removed when you close your browser. When you sign in, a sign-in cookie keeps you signed in on that browser for 30 days after your last visit; logging out removes it. We keep only a scrambled (hashed) copy of it, with your account and dates. Your browser also remembers your light or dark theme, which announcements you closed and (for staff) how lists are sorted; these stay on your device. We use no tracking or advertising cookies.

Your rights

You can ask to see the data we have about you (My Keys has a Download my data button), to correct it, to delete it, to limit how we use it, or to take it with you. You can object to the uses based on legitimate interest; we will then stop unless we have strong reasons, such as an open abuse case. Email admin@theden.se and we'll answer within a month. If you're unhappy with how we handle your data, you can complain to the Swedish Authority for Privacy Protection (IMY), imy.se.

Children

The site is not meant for anyone under 13.

Security

The site only works over an encrypted connection (HTTPS), passwords are stored as secure hashes, and only our staff can reach the data.

Changes

When this policy changes, we update it here and change the date at the top. The site rules explain what's allowed on the site.