Vaulted

Privacy Policy

Last updated: April 10, 2026

Vaulted is a read-only tool that lets you check your own VALORANT daily store, wallet, and inventory on your iPhone. This privacy policy explains exactly what data the app touches and where it goes.

Short version

• Nothing you do in Vaulted is ever sent to any third-party server.
• Your Riot login tokens are stored only on your device, in the iOS Keychain.
• The app has no backend. It makes requests directly from your phone to Riot's servers.
• We do not collect, analyze, track, profile, or sell any user data.
• We have no accounts, no sign-up, no cloud sync.

What data the app reads

When you sign in to Riot from inside Vaulted, you are redirected to Riot's official login page inside an embedded WebView. Your username and password are never seen by, handled by, or passed through the app's code — they go directly from Riot's login page to Riot's own servers.

After you sign in, Riot returns OAuth tokens (access_token, id_token, entitlements_token). The app uses these tokens, as the official Riot Client would, to fetch:

• Your daily store (/store/v3/storefront/{puuid})
• Your wallet balance in VP, RP, and Kingdom Credits
• Your owned skins
• Your display name and region

The app additionally fetches read-only public cosmetic metadata (skin names, icons, video previews, tier colors) from the community catalog at valorant-api.com, which does not require or receive any authentication.

Where data is stored

• Riot auth tokens: iOS Keychain on your device. Encrypted and protected by your device passcode, Face ID, or Touch ID. They never leave your device.
• Wishlist entries, settings, store history snapshots: Local SwiftData store on your device.
• Everything else: in-memory only, discarded when you close the app.

What data we collect

None. Vaulted has no analytics, no crash reporting service, no telemetry, no tracking pixels, no ad SDK, no attribution SDK. We do not operate any server. There is no cloud sync, no backup to us, no email list, no account system.

Third parties

• Riot Games: We send requests directly to Riot's servers (auth.riotgames.com, entitlements.auth.riotgames.com, pd.<region>.a.pvp.net) as your authenticated Riot Client. Riot's privacy notice applies to how they handle those requests.
• valorant-api.com: A community-maintained public CDN for cosmetic metadata. We fetch images, skin names, and bundle details from here. No user-identifying information is sent.
• Apple Push Notification Service: If you enable "Daily 9 AM Reminder" in Settings, the app schedules a local notification via iOS. These are local-only — no data is sent to Apple's push service about your account.

Your responsibilities

VALORANT and the Riot Games logo are trademarks of Riot Games, Inc. Vaulted is an independent project and is not affiliated with, endorsed by, or approved by Riot Games.

You are solely responsible for complying with Riot Games' Terms of Service when using this app. Vaulted uses the same internal API as the official Riot Client, which Riot has not publicly authorized for third-party use. The author of Vaulted makes no warranty that use of this app is permitted under any agreement you have with Riot Games.

Contact

If you have questions about this policy, file an issue on the project's GitHub repository.

Changes to this policy

If this policy ever changes, the "Last updated" date at the top will change. Because the app has no server and no user accounts, there is no way for us to notify you; please re-read this document from time to time.