Privacy Policy

Project Vaal (“Project Vaal,” “we,” “us,” or “our”) is a free, unofficial companion web application for Path of Exile 2 (PoE2) players — offering currency and item price checks, an interactive passive skill tree viewer/planner, a campaign checkpoint tracker, and a build planner/saver. Project Vaal is not affiliated with, endorsed by, or sponsored by Grinding Gear Games (GGG).

This Privacy Policy explains what information we collect, how we use it, who we share it with, and what rights you have regarding it. By using Project Vaal, you agree to the collection and use of information as described here. See also our Terms of Service.

Information We Collect

Account data

If you create an account, we use Supabase Auth to manage sign-in. Depending on how you sign up, we (via Supabase) store either:

• your email address and a hashed password (for email/password sign-in), or
• your Google account identity (for “Sign in with Google”) — Project Vaal never sees or stores your Google password itself, only the identity information Google shares as part of the standard OAuth sign-in exchange.

Optional GGG account connection

If you choose to connect your Grinding Gear Games (GGG) account, we store your linked GGG account name and the GGG OAuth access and refresh tokens issued to us. These tokens are stored encrypted at rest in our database — not in plaintext.

User-generated content

If you use Project Vaal’s features, we store:

• saved “builds” — character class, passive skill tree selections, gear/gem loadout data, and any name, description, or notes text you write;
• your campaign checkpoint completion progress; and
• your preferred trade-league selection.

Automatically collected data

We use Vercel Web Analytics (@vercel/analytics) to collect anonymized, aggregate usage data — such as page views and general traffic patterns. This does not involve cross-site ad tracking, third-party ad networks, or ad-targeting cookies.

Cookies

We use only first-party session cookies required for authentication (your Supabase auth session). We do not use third-party advertising or tracking cookies.

Payment information

Project Vaal is entirely free. There are no purchases anywhere in the app, and we do not collect any payment information.

How We Use Your Information

We use the information described above to:

• authenticate you and maintain your account and sign-in session;
• save and display your builds, campaign progress, and league preference across sessions and devices;
• retrieve your data from GGG’s services on your behalf, if you’ve connected a GGG account; and
• understand aggregate usage of the app so we can maintain and improve it (via anonymized analytics).

Who We Share Data With

We do not sell your data to any third party, ever. We do not use advertising networks or data brokers. We share data only with the service providers necessary to run Project Vaal:

• Supabase — our database hosting and authentication provider. Supabase stores all account data and user-generated content described above.
• Vercel — our application hosting provider, and the provider of the anonymous analytics described above.
• Google— only if you choose “Sign in with Google,” for the standard OAuth identity exchange. No other data is shared with Google.
• poe2scout.com — a third-party source of public PoE2 market-price data that Project Vaal reads from. No user data is ever sent to poe2scout.com; this is one-way ingestion of public price data, not a data-sharing relationship.

Your Rights

You can request a copy of your account data, or request that it be deleted, by contacting us at contact.projectvaal@gmail.com. You can also ask us to correct inaccurate account data the same way.

Note: Project Vaal does not currently have a self-serve “delete my account” or “download my data” button in the app. Access, correction, and deletion requests are handled manually today, by contacting us directly.

Data Retention

We retain your account data until you request deletion, or until your account is removed for a Terms of Service violation.

Children’s Privacy

Project Vaal is not directed at children under 13, and we do not knowingly collect information from children under 13. If you believe a child under 13 has provided us information, please contact us at contact.projectvaal@gmail.com so we can address it.

Security

We use reasonable technical measures to protect your data, including encrypting sensitive tokens (such as GGG OAuth tokens) at rest and using row-level security on our database. That said, no method of storing or transmitting data is 100% secure, and we cannot guarantee absolute security.

International Users & Governing Law

Project Vaal is operated from, and this policy is written for, an operator based in the State of Texas, USA. Your data is processed and stored on infrastructure located in the United States (via Supabase and Vercel). This Privacy Policy is governed by the laws of the State of Texas.

As a general matter, Texas residents may have additional statutory rights regarding their personal data under the Texas Data Privacy and Security Act (TDPSA, effective July 2024), which addresses rights such as access, correction, and deletion of personal data. The TDPSA has revenue and data-volume thresholds that determine which businesses it applies to; Jaycee McCullough should confirm with counsel whether the TDPSA applies to this specific operation.

This template does not specifically address the General Data Protection Regulation (GDPR) or the rights of users in the European Union or United Kingdom. If Project Vaal expects EU or UK users, Jaycee McCullough should work with counsel to add appropriate GDPR-related disclosures before relying on this policy.

Changes to This Policy

We may update this Privacy Policy from time to time. If we make changes, we will update the effective date at the top of this page. We encourage you to review this page periodically.

Contact Us

If you have questions about this Privacy Policy or want to exercise any of the rights described above, contact us at contact.projectvaal@gmail.com.