Privacy Policy

The Krypt connects horror fans, creators, and businesses while respecting the privacy of its members and visitors. This Policy explains what information may be collected, why it is used, and how members can manage their information.

Depending on how someone uses The Krypt, information may include:

• Account email and sign-in information, or the identity Apple or Google shares if you use them
• Your confirmation that you are 18+ and the policy version you agreed to, with the date and time (we do not collect your date of birth)
• Account capabilities (Crow, Keeper, Business Owner), onboarding progress and profile settings
• Public Keeper profiles and portfolios
• Business claims and verification evidence
• Saved places, events, media, retailers and Trails; followed Trails and selected interests
• Private messages and reports
• Event participation choices (such as marking that you're going)
• Trail stops, notes and planning details
• Scythe Lists and gift reservations
• Game progress and virtual coin balances
• Notification preferences and push endpoints
• Waitlist registrations and marketing preferences
• Browser, session, referral and visit-count information
• Information you voluntarily submit through forms

Anyone can browse public pages without registering. Some preferences — sounds, the welcome screen, map filters, Nightmare Radar settings, Krypt Alerts device settings — are kept in your browser's own storage.

• Public: published Keeper profiles (display name, photo, banner, bio, specialties, published projects, and your location only if you choose to show it); published listings and events, including business website, phone, hours and social links; public Trails.
• Private: your email, drafts and hidden profiles and their images, verification evidence, ownership claims, submissions under review, notification settings, coins, messages, saved items, and Trails or Scythe Lists you haven't shared.
• Photos and banners are kept in private storage and shown through temporary links only when the related profile, listing or photo is approved and public.
• Content you share publicly may be copied or saved by others.

• Saved Trails may contain locations, dates, schedules, custom stops, and notes. They stay in your account until you share or publish them.
• When you share or publish a Trail, your starting point is never included, and custom stops are shown only by approximate area unless you choose to share their exact spot.
• Public and unlisted sharing exposes the information you select for publication. Unlisted links may be accessible to anyone who receives the link.
• Public Trails are reviewed before they first appear in discovery.

• "Near Me" uses your device's location only after you allow it in the browser. Those coordinates stay in your browser session and are not added to links or stored in your account.
• You can instead set a Discovery Location by ZIP code or city. It is saved only on your device as an approximate area, and Reset clears it.
• When you search for a place or ZIP code, the search text is sent to OpenStreetMap's Nominatim service to find it on the map. Map images come from OpenStreetMap.
• If you choose Apple Maps, Google Maps or Waze for directions, that service receives the destination you selected.
• Some private and restricted locations are displayed approximately to protect property owners and visitors. Keeper locations that are set to hidden are never shown or searchable publicly.
• We do not track your location in the background.

• Inbox messages are stored on our servers so both people can read them. They are protected by access rules but are not end-to-end encrypted.
• Reports and submissions may include contact information and supporting evidence. Information supplied only to clarify a submission is not used for unrelated marketing.
• When a message is reported, our admins can read that conversation to review it. Admin access to private information is limited to operating, securing, moderating and legally protecting the service.

• We use browser and service information to operate accounts, remember preferences, understand usage, improve discovery, and protect the platform.
• Our own visit counts use a random ID stored in your browser, the page you arrived on, the site or campaign tag that sent you, and a rough state or country. Listing actions (such as views or taps) are counted with a coded, once-per-day visitor value. These are pseudonymous, not anonymous. Campaign tags are removed from the address bar after your first page.
• Browsers with Global Privacy Control or Do Not Track turned on are not counted.
• Our hosting and security systems process IP addresses to deliver the site, estimate a rough region and limit abuse.
• We do not sell your personal information and do not use advertising trackers. Embedded players (see section 10) may set their own cookies when they load.

• Members may choose eligible notifications and alert preferences. Email notices (such as new messages or decisions) can be turned off in your notification settings, except a small set of required account and business notices.
• Device push is off until you tap to enable it and your browser asks for permission. We store the subscription your browser creates and remove it if it expires.
• Signed-out Krypt Alerts subscriptions are tied to the device, not a name.

• External retailers handle information you provide directly to their websites under their own privacy policies. The Krypt does not receive your payment or shipping information when you follow an external shopping link.

Scythe Lists

• Ownership and visibility: lists belong to the member who creates them and are private when created.
• Shared links: anyone with a list's share link can see its items and how many of each are still available. Creating a new link makes the old one stop working; revoking the link or making the list private stops sharing.
• Reservations: to reserve, a gift-giver enters an email address and confirms from their inbox within 30 minutes. The email is stored only as a coded value and is used to send the confirmation and a link to manage the reservation.
• Who sees reservations: the list owner does not see who reserved or bought items. The owner only sees their own requested items.
• Notifications: the gift-giver receives the confirmation email.
• Cancellation and retention: unconfirmed reservations are released after 30 minutes; confirmed reservations are held for 14 days and can be cancelled from the manage link. Members can delete a list at any time.
• [Before publication: confirm what happens to Scythe Lists and reservations when the owner's account is deleted.]

• Lovable Cloud hosts our website, database, sign-in, file storage and email delivery.
• Apple and Google sign-in, if you choose them.
• OpenStreetMap (map images and place search).
• Apple Maps, Google Maps or Waze, only when you choose one for directions.
• Embedded YouTube, Vimeo or Spotify players, which may set their own cookies when they load.
• Some listing photos are open-licensed images from Wikimedia Commons, copied to our storage.
• Your browser's push service (from Apple, Google, Mozilla or Microsoft) delivers device notifications.

• The Krypt retains information as reasonably necessary for service delivery, account management, security, disputes, and applicable legal obligations.
• You can delete your account from My Account. This removes your profile, Keeper profile, uploads, messages, verification evidence, notification settings and push subscriptions, and coins.
• To prevent repeat rewards after deletion, we keep a one-way coded marker that cannot be read back into your email. Records of policy agreement may be kept as proof of consent.
• Public content already obtained by others and independently maintained factual business listings may not disappear when an account is deleted. Listings and events you submitted or managed stay on The Krypt.
• [Before publication: confirm removal of saved items, saved Trails, interests and Scythe Lists on account deletion, and set retention periods.]

• You may contact The Krypt to request access, correction, deletion, or other privacy assistance at [Contact email to be provided by The Krypt's owner].
• Additional rights may apply depending on where you live and applicable privacy law.
• [Before publication: legal counsel to confirm applicable state privacy laws and the response and appeal procedures.]

• Accounts are intended for adults 18 or older. Guests may encounter mature horror content.
• The Krypt is not designed as a service directed toward children under 13.
• If we learn an account belongs to someone under 18, we will remove it. Suspected children's personal information will be addressed according to applicable law.

• Data is protected by sign-in, database access rules and private file storage. No online service can guarantee absolute security.
• Material Privacy Policy changes will be identified through updated version and effective-date information, with additional notice or consent where required.
• Operator: Jonas Valle, operating The Krypt individually.
• Privacy contact: [Contact email to be provided by The Krypt's owner]