Legal

Privacy Policy

Last updated: October 10, 2026. This explains what Valotrace collects, why, and the choices you have.

1. Who we are

Valotrace ("Valotrace", "we", "us") provides messaging and measurement software for mobile game studios. This policy covers two groups of people: customers (studios and their staff who use Valotrace) and players (the end users of a customer's game whose devices receive messages sent through Valotrace).

2. Our role

For player data, the studio that uses Valotrace decides what is collected and why. We act as its processor (or "service provider") and handle that data only to provide the service. For customer account data, website visitors and our own operations, we act as the controller.

If you are a player and have a question about your data, contact the studio that makes the game first. We will help the studio respond.

3. What we collect

Customer account data

• Name, work email, organization, and the apps your account can access.
• Login credentials. Passwords are stored only as argon2id hashes. Sessions use an HttpOnly cookie.
• Provider credentials you save to connect a channel (for example Apple Push keys). These are encrypted at rest.
• Messages you write or approve, experiment settings, and actions you take in the dashboard.
• Anything you send us directly, such as a contact form submission or an email.

Player data processed for studios

• Push device tokens and the player or device identifiers the studio supplies.
• Message events: sent, delivered, opened, and dismissed, with timestamps.
• Experiment records: which arm (treatment or holdout) a player was assigned to, and the assignment probability. These are required for honest lift measurement.
• Any player attributes the studio chooses to send for targeting.

We do not ask studios to send names, email addresses, or other directly identifying details about players, and we do not sell player data.

Website and usage data

• Standard request data such as IP address, browser type, pages viewed, and referrer.
• Analytics from PostHog on public marketing and documentation pages only, which may set cookies or similar identifiers. Signed-in pages (the portal, connections, and dashboard) never load analytics. See "Cookies and analytics" below.

4. How we use it

• To deliver, assign, and measure messages, and to report lift to the studio.
• To generate suggested message variants. Studio-supplied briefs and message text may be sent to our AI provider (see section 6) for this purpose.
• To authenticate users, secure the service, prevent abuse, and debug problems.
• To respond to you, and to improve and operate the product.
• To meet legal obligations.

We do not use player data to build advertising profiles, and we do not use one studio's player data to send messages for another studio.

5. Legal bases (EEA, UK)

Where those laws apply, we rely on: performance of a contract (providing the service), legitimate interests (security, product improvement, B2B communication), consent (non-essential analytics cookies, where required), and legal obligation. Studios are responsible for having a lawful basis, including any consent needed to send messages to players.

6. Who we share it with

We share data only with service providers that help us run Valotrace, under confidentiality and data protection terms:

• Hetzner: hosting for our API and databases.
• Vercel: hosting for this website.
• Apple (APNs): delivery of push notifications, using credentials the studio provides.
• Google (Gemini): generation of suggested message variants.
• Microsoft Clarity and Umami: website analytics.
• Formspree: handling contact form submissions.

We may also disclose data if required by law, to protect rights and safety, or in connection with a merger or sale of the business. We will update this list when providers change.

7. Cookies and analytics

We use an essential session cookie to keep you logged in. PostHog helps us understand how public pages are used. It is not loaded on authenticated routes, so workspace and player data is never sent to a session-replay provider. Form inputs on public pages are masked before they reach PostHog. You can block analytics with your browser settings or a content blocker without affecting the core service.

8. Retention

We keep customer account data while your account is active and for a reasonable period afterwards for legal, security, and accounting needs. Player event data is kept for as long as the studio uses the service, then deleted or returned within a reasonable period after the studio asks us to or ends its account. Backups and logs age out on a rolling schedule.

9. Security

We use TLS in transit, encrypt stored provider credentials, hash passwords, and scope API keys to specific apps. No system is perfectly secure. If we learn of a breach affecting your data, we will notify affected customers as required by law.

10. Your rights

Depending on where you live (for example under GDPR, UK GDPR, or the CCPA/CPRA), you may have the right to access, correct, delete, or export your data, to object to or restrict certain processing, and to withdraw consent. We will not discriminate against you for exercising these rights. To make a request, email us at the address below. Players should contact the game studio first.

You may also lodge a complaint with your local data protection authority.

11. International transfers

We are based in the United States and our providers may process data in other countries. Where required, we use appropriate safeguards such as Standard Contractual Clauses, which are built into our Data Processing Agreement.

12. Children

Valotrace is a business service and is not directed to children. Studios are responsible for complying with children's privacy laws (such as COPPA) in their games and must not use Valotrace to message children without any required parental consent. If you believe we hold a child's data in error, contact us and we will delete it.

13. Changes

We may update this policy. For material changes we will update the date above and, for customers, notify you by email or in the product.

14. Contact

Questions or requests: ishaan.verma@valotrace.com. Valotrace, San Francisco, California, USA.