Security, privacy & handling.

Who maintains this page

This page is maintained by The Vow Awards team to answer common security and privacy questions about the platform. It reflects controls currently enabled in the app and is updated as our practices evolve. It is not an independent certification and does not create any contractual commitment.

Accounts & authentication

Every account — WPV, judge, and admin — signs in over HTTPS. Passwords are checked against known-breached password lists at sign-up and reset time, and admin accounts additionally support time-based two-factor authentication (TOTP).

• · TLS in transit for every request
• · Compromised-password screening on sign-up and reset
• · Optional two-factor authentication for admin accounts
• · Email confirmation required before entering

Payments

Payments for entry credits are processed by Stripe. Card details are entered directly into Stripe's PCI-compliant elements and never touch our servers. Purchase fulfillment is driven by verified Stripe webhooks, so credits are only granted after Stripe confirms the payment.

• · Stripe-hosted card fields; card data never stored on our side
• · Automatic tax where required
• · Webhook-verified fulfillment; no client-only credit grants
• · Full refunds on unused credits within 14 days on request

How your data is used

We collect only what we need to run the awards: your email and profile fields to identify your account, submission media links to run entries, and judging scores to compute results. Judge identities and scores are never shared with the studios they review.

• · Judge identities never revealed to studios
• · Submission ownership rights attested by every WPV
• · Row-level security in the database enforces per-user access

Emails you may receive

Confirmation, password reset, and results emails are transactional — you receive them because of something you did on the platform. Weekly and monthly digest emails to WPVs are optional and can be turned off at any time from your dashboard.

• · Sign-in, results, and payment emails are always sent
• · Marketing digests are opt-out from the notifications page
• · Every marketing email includes a one-click unsubscribe footer

Account deletion

You can delete your account from your dashboard at any time. Deletion removes your profile, submissions, credit balance, and authentication record. Anonymized aggregates required for the integrity of past contest cycles may be retained.

Reporting a vulnerability

If you believe you have found a security issue, please report it through the contact form on our About page with the word 'security' in the subject. We will acknowledge reports within two business days.