Privacy notice

Draft for legal review. Not final until reviewed. Items in [square brackets] are still to be decided.

Who runs Crypt

Crypt is run by Pelleum. Contact for privacy questions: bailey@pelleum.com [interim contact, to confirm at legal review].

Who can create an account

For now, accounts can be created only from the United States, and only by people aged 13 or older. Log-ins are not limited by country.

What we collect

• Account details: the username you choose, and your password, stored only as a salted hash (we cannot read it back).
• Game data: your characters, decks, purchases in the game, and the games you play.
• Sign-in session: a cookie that keeps you logged in. It is needed for the game to work.
• Date of birth: asked once, when you create an account, only to check you are 13 or older. We do not store it.
• Sign-up counts: each day, we count how many sign-up attempts came from each country, and whether they were accepted or refused. These counts hold no name, address or birth date.

Why we use it

• To run your account and the game.
• To keep accounts and the game secure, including spotting misuse.
• To understand which countries sign-up attempts come from, so we can check our compliance.

Security records

To keep accounts secure and to detect misuse, we keep a record of each log-in and sign-up attempt: the account name, the time, the result, the country, and a keyed hash of the network the attempt came from. The network is cut down before it is hashed (IPv4 to its /24, IPv6 to its /48), so the record never holds a full address. The key is kept apart from the records, so the hash cannot be reversed by trying addresses.

Records are kept in full for 30 days. After that they are moved to a compressed archive, and your account name is replaced there by a random ID, so the archived records cannot be matched to you. The archive is kept [for a period to be confirmed, subject to legal review]. Deleting your account removes your records from the 30-day store; records already in the archive keep only the random ID.

Who helps us run Crypt

Crypt is hosted by Cloudflare, which processes data on our behalf.

How long we keep it

• Account and game data: until you ask us to delete your account. [Deletion process to be confirmed.]
• Sign-up counts by country: [period to be confirmed].

Your rights

You can ask us what we hold about you, ask us to correct it, or ask us to delete your account. Send requests to bailey@pelleum.com [interim contact, to confirm at legal review]. Depending on where you live, you may also have further rights, such as to complain to a data protection authority.

Changes

We will update this notice when what we collect or how we use it changes.