Email address — required for magic-link sign-in. Stored in Supabase Auth (project region: US-East). Used only to send sign-in links and to identify your account.
Request metadata — IP address, user agent, and timestamp on every page load. Collected and retained by Vercel (our hosting provider) per their privacy policy. We do not query or store these logs ourselves.
Account state — your subscription tier, founder status, admin flag, notification preferences, favorites, tips you submit, roadmap requests and votes, and your Supporters Wall visibility setting. Stored in the same Supabase project, subject to row-level security: only you can read or modify your own rows.
Purchase and entitlement records — what you bought, when, and what it unlocked. Includes subscription webhooks from Stripe and, for Kickstarter backers, the purchaser email imported from BackerKit. Download events are logged per file so we can honour re-download limits.
Operational records we keep about your account — the waitlist entry that preceded it, pending email-change requests, referral links you used or shared, paired RetroShark devices, enterprise API keys you were issued, and an audit log of administrative actions taken on your account. Some of these are kept for security and accounting reasons and survive account deletion in redacted form.
Third-party services we use
Vercel hosts the site and provides Web Analytics and Speed Insights. Both are cookieless and aggregate: they record page views and load performance, not individuals.
Supabase stores the database and runs authentication.
Sentry receives error reports when something breaks. Reports include the page URL, browser, and the email of the signed-in account so we can tell you what happened. Session replay is off.
Stripe processes payments. Card details go to Stripe directly and never touch our servers; we store only the subscription state Stripe reports back.
Resend sends transactional email.
PostHog receives cost and latency metrics from our content pipeline. It sees no end-user browsing activity.
What we don’t do
No advertising network identifiers, tag managers, or tracking pixels.
No social-network embeds that load tracking scripts.
No sale or sharing of personal data with advertisers.
No passwords — sign-in is magic-link only.
Cookies and local storage
Signing in sets first-party Supabase session cookies. They are HTTP-only, they are not used for advertising, and clearing them signs you out. Vercel Analytics and Speed Insights measure page views and load performance without cookies and without identifying you. Sentry stores a short-lived trace identifier so a single error report can be stitched together. Nothing on this site is shared with an advertising network.
If you arrive through a supporter’s referral link, we set one more first-party cookie, sv_ref, holding only that referral code so the supporter gets credit if you later subscribe. It is HTTP-only, expires after 30 days, is never overwritten by a later link, and is not used for advertising. Clear your cookies to remove it.
Email
Transactional email (magic-link sign-in) is sent through Resend from hello@gamesharklabs.com. We do not send marketing email without explicit opt-in.
How long we keep it
Account and account state for as long as your account exists, then deleted when you ask us to close it.
Purchase, entitlement and download records for at least seven years after the transaction, because tax and accounting rules require it. These survive account deletion, and where we can we keep them against a redacted account rather than your email. We do not delete them automatically once that period is up; ask us and we will remove whatever we are no longer required to hold.
Administrative audit-log entries for as long as they are useful for answering questions about who changed what on an account, which is normally a couple of years. They are not trimmed on a schedule today.
Email-change records (both addresses, the time, and the originating IP) for 90 days, so a disputed change can be investigated.
Error reports in Sentry for 90 days.
Server request logs for as long as Vercel keeps them on our behalf. We hold no separate copy.
Your rights
You can request a copy of your account data, correction of stored fields, or full deletion of your account at any time. Email privacy@gamesharklabs.com. We aim to respond within 7 days, and we will always answer within the 45 days the state privacy laws allow. We will not charge you or treat you differently for asking.
We do not sell personal information, and we do not share it for cross-context behavioural advertising, as those terms are defined under the Maryland Online Data Privacy Act, the California Consumer Privacy Act, and the other US state privacy laws. There is therefore nothing to opt out of. We do not use your data for profiling that produces legal or similarly significant effects. If we ever deny a request, we will tell you why and how to appeal it, and you can complain to your state attorney general.
If you are in the EU, the UK, or Switzerland
GameShark Labs LLC is the controller of the data described above, and you can reach us at the address in the Contact section. We rely on these legal bases:
Performance of a contract for your account, your subscription, and the files you are entitled to download.
Legitimate interests for keeping the service secure, diagnosing errors, preventing abuse, and measuring aggregate performance.
Legal obligation for the purchase and tax records we are required to retain.
Consent for anything you opt into, such as marketing email or appearing on the Supporters Wall. You can withdraw consent at any time without affecting what came before.
We are based in the United States, and every processor named above is a US company, so your data is transferred to the US. Those transfers rely on the Standard Contractual Clauses in our agreements with each processor. You can request a copy of the relevant terms.
You have the right to access your data, correct it, delete it, restrict or object to our processing, and receive it in a portable form. You also have the right to complain to your local supervisory authority. In the UK that is the Information Commissioner’s Office. We have not appointed a data protection officer, because we are not required to; write to privacy@gamesharklabs.com and it reaches the people who can act on it.
Children
SharkVault is intended for users 13 and older. We do not knowingly collect data from anyone under 13.
Changes
Material changes to this policy will update the date at the top and are announced in the SharkVault changelog. Continued use of SharkVault after a change constitutes acceptance.