Privacy policy

In force since 7 September 2026 · updated 5 October 2026 · editorial change (wording only, rules unchanged) 17 October 2026 · gem seller's details corrected to match the Polish version, 17 October 2026 · completed to match actual practice (push services, transaction numbers after account deletion, supervisory authority in your country of residence) 27 October 2026 — applies immediately

Craterborn is a browser game. This page describes what data is collected, what for, and what you can do about it. It is short because there is little data — that is a deliberate design decision, not a shortcut.

Who is responsible for the data

The data controller is Michał Sikora, Aleja Reymonta 21 m. 255, 01-840 Warsaw, Poland (the “Administrator”). Contact: contact@craterborn.com.

What is collected and why

• Character name — you choose it yourself. Other players see it in the game — including in the rankings, next to your results (such as kills or loot value), and in notifications of who defeated whom. Legal basis: performance of the service contract (Art. 6(1)(b) GDPR).
• Chat messages — seen by the players you send them to: those in the same run, in town, or in your party. The server relays them live and does not write them to disk. It keeps each player's recent messages in memory only, for 15 minutes — so that a report can include only what the reported player actually wrote. Do not type personal data into the chat. Legal basis: performance of the contract (Art. 6(1)(b) GDPR).
• Reports, blocks and penalties — when you report a player, the Administrator stores your character name, the reported player's name, the reason you chose, the time, and their recent messages you saw (only those confirmed by the server). The reported player is not told who reported them. With the account the Administrator stores the list of players you blocked and any penalties applied to the account — type, duration and reason. Penalties are decided by a person acting for the Administrator, not by an automated system. Legal basis: legitimate interest (Art. 6(1)(f) GDPR), namely player safety and enforcing the terms; the block list — performance of the contract (Art. 6(1)(b) GDPR).
• Character code — a random string the game uses to recognise your account. It is not tied to any personal data of yours. The Administrator keeps it on the server and in your browser's storage.
• E-mail address — only if you link one yourself. It serves solely to recover access. The Administrator does not store the address itself — only an irreversible cryptographic digest of it, keyed with a server secret. The address cannot be reconstructed from that digest; it only makes it possible to recognise that it is you again. The address itself passes through the server at the moment the code is sent and is not written down. Legal basis: your consent (Art. 6(1)(a) GDPR), given by linking the address to the account. You may withdraw it at any time by removing the link or deleting the account — withdrawal does not affect what happened before it.
• Gameplay data — stash contents, in-game currency, run history, character level, statistics (such as kills, deaths and monsters defeated) and your friends list. Without them the game would have nothing to remember.
• Purchases — you give payment data (such as e-mail address, card details, country) directly to the seller of gems, Sold through Link (a Stripe company), which processes it as a separate controller under its own privacy policy (stripe.com/privacy). The Administrator passes it only a random order number. The payment notification the Administrator receives from them also contains buyer details — those are not stored; the account keeps the transaction number, the pack bought and the date, so that gems can be credited and any complaint handled. Legal basis: performance of the contract (Art. 6(1)(b) GDPR).
• Purchases in the app from Google Play — you give payment data in Google's dialog and it reaches only Google as the seller, which processes it as a separate controller under its own privacy policy (policies.google.com/privacy). The app sends the Administrator just the purchase identifier, and the Administrator asks Google whether it has been paid. In reply the Administrator receives the order number and the purchase state, with no buyer details and no card details. The account keeps the order number, the pack bought and the date. Every few hours the Administrator asks Google about refunds, so that gems can be taken back for purchases that were refunded. Legal basis: performance of the contract (Art. 6(1)(b) GDPR).
• Ads for gems — when ads are available, the Google script loads only after you open the Season Pass tab, and you start an ad yourself with the button. The ad is served by Google as a separate controller: it may store cookies or similar identifiers in your browser and asks for consent to personalised ads in its own message, where you can also refuse or withdraw it. That message is shown by a Google-certified consent management platform and offers three answers: consent, refusal, and detailed options — refusing is as easy as consenting and closes neither the game nor the ads for gems; it only means the ad is not selected for you. Your choice is stored in the browser, so it applies to that one device; to change it, clear this site's data in your browser and the message will appear again. Google's rules: policies.google.com/technologies/partner-sites. The Administrator stores on the account only the number of ads watched that day. Legal basis: your consent given in Google's message (Art. 6(1)(a) GDPR); the counter — performance of the contract (Art. 6(1)(b) GDPR).
• Correspondence — if you write to the contact address, the Administrator keeps the message for as long as handling the matter requires, and to be able to show that it was handled. Legal basis: legitimate interest (Art. 6(1)(f) GDPR).
• Push notifications — only if you switch them on in the game's settings. Your browser then gives the Administrator a subscription: an address at the push service of your browser vendor (Google, Mozilla, Microsoft or Apple) and two keys generated by the browser. The Administrator stores them with the account and uses them for one thing: a short message at 18:00 Polish time that the Gem Rush has started. The message itself carries no data — the game fetches the text from the game server when it arrives. You can switch notifications off in the same settings or in your browser; deleting the account removes the subscription. Legal basis: your consent (Art. 6(1)(a) GDPR).
• IP address — in server logs and for rate limiting (abuse protection). Legal basis: legitimate interest (Art. 6(1)(f) GDPR), namely keeping the service secure.
• First-visit statistics — the Administrator counts in aggregate how many people on a given day opened the game (and how many of them in a browser built into another app, such as TikTok), typed a name, clicked "Play", created a character, touched a character on the class screen, picked a class, went down into the crater and came back after a day or a week. On the first visit the Administrator also counts after how many seconds the game loaded and after how many someone left without "Play", whether the screen is a touch screen, whether the visit came from an ad link (only that fact — not the value of the tag), whether anyone touched the page, whether it opened in the background, whether the browser is able to run the game, and technical signs of automated traffic (a browser driven by a program, software-rendered graphics, the UTC time zone), and after clicking "Play" — on which game screen someone closed the page. When a game error happens in the browser, the game sends the Administrator its message, its place in the code, the type of system and browser with its version number, and the game screen — without the account name and without the page address. These are just daily numbers — no names, no identifiers and no cookies. The IP address is used here only so that reloading the page is not counted twice: as a digest, in server memory only, until the end of the day. With the account the Administrator stores the day it was created and whether it came back after a day and after a week. Legal basis: legitimate interest (Art. 6(1)(f) GDPR), namely checking whether the game is understandable to new players.

What the Administrator does NOT do

• Shows no ads you have not started yourself — the only ads in the game are optional ads for gems. Does not itself track you across sites.
• Does not profile you and makes no automated decisions.
• Does not sell or share data for marketing purposes.
• Does not collect your name, surname, age or location.

Cookies and browser storage

The Administrator does not itself use cookies. Google may set cookies — only with ads for gems, under the rules described above. The game keeps your character code and name, your settings — sound, fullscreen, language — and the number of the last game version you saw (to show the list of changes) in your browser's storage (localStorage). This data is strictly necessary for the service to work, is not used for tracking, and therefore requires no consent. You can remove it by clearing site data in your browser — you will then lose access to the account unless you linked an e-mail address first.

Who the Administrator passes data to

• Hosting provider — OVHcloud (OVH SAS, France), where the game runs.
• Mail provider — OVHcloud (Zimbra), for sending sign-in codes and handling mail sent to the contact address.
• Sold through Link, LLC (USA, a Stripe company) — when you buy gems on the website, as the seller and a separate controller. The Administrator passes it only a random order number, as described above. You can ask it directly to delete your purchase data, via link.com — it will then inform the Administrator of the request.
• Google Ireland Limited (Ireland) — with ads for gems, as a separate controller; Google may also process data outside the EEA under its own rules.
• Google Commerce Limited (Ireland) — when you buy gems in the app from Google Play, as the seller and a separate controller. The Administrator passes it only the purchase identifier, to check whether it has been paid.
• Your browser vendor's push service (Google, Mozilla, Microsoft or Apple) — only once you switch notifications on. The Administrator sends a message with no content to the subscription address.

Nobody else. The only things the Administrator sends outside the European Economic Area are the order number passed to the seller of gems for a purchase you ask for and — once you switch notifications on — a message with no content sent to the subscription address at the push service, which may operate outside the EEA (e.g. in the USA). Should any provider change where it processes data, the Administrator will update this page.

How long the Administrator keeps data

• Account and gameplay data, including the purchase record — as long as the account exists.
• Transaction numbers after the account is deleted — without the character name, indefinitely, solely so that the same purchase cannot be assigned to another account.
• Chat messages — they are not written to disk; each player's recent messages stay in server memory for 15 minutes.
• Reports — until reviewed, and reviewed ones for 6 months. They disappear sooner when the reporting or the reported player deletes their account.
• An account unused for 24 months may be deleted along with its data.
• Server logs — no longer than 30 days.
• Backups of the game database — no longer than 30 days; a deleted account disappears from them with the oldest copy.

Your rights

You have the right to access your data, to rectify it, to erase it, to restrict processing, to data portability, and to object to processing based on legitimate interest. Write to the contact address above — the Administrator will answer within 30 days.

You can delete the account yourself in the game settings or on the account deletion page — also without the game, with your character code. Deletion is irreversible and covers the stash contents and in-game currency; the page lists exactly what is deleted and what stays and for how long.

If you believe the Administrator processes your data unlawfully, you have the right to lodge a complaint with the President of the Personal Data Protection Office (ul. Stawki 2, 00-193 Warsaw, Poland), or with the supervisory authority in your own country of residence.

Children

The game is not directed at children under 16 and the Administrator does not knowingly collect their data.

Changes

The Administrator will announce material changes in the game before they take effect. The date at the top of this page always indicates the version in force.

Terms  ·  Polska wersja  ·  Back to the game