Privacy policy
Last updated 6 November 2026
- No ads, no tracking cookies, and we never sell your data.
- We store what it takes to run accounts, friends, clans, chat, the shop and the leaderboard.
- Making an account asks for your name, country and city. Only you and we can see them, and we never ask players under 13.
- Party, battle and voice chat are never stored.
- Players you play with connect directly to you, so they can see your IP address.
- Players under 13 can play, but their chat stays off until a parent says yes.
- In the game you can download all your data, or delete your account, at any time (Account in the lobby).
Who we are
The Crate Game is made by Pontus Höglund, Sweden ("we", "us"). We are responsible for the personal data described here (the "controller" under the EU General Data Protection Regulation, GDPR).
Questions, requests and parental consent: contact@thecrategame.com.
What we store, and why
You can play against bots without going online. As soon as you use anything online (friends, parties, clans, chat, the shop, matchmaking or the leaderboard), the game makes a guest account for you. This is what we keep:
| What | Why | Legal basis | How long |
|---|---|---|---|
| A random account id and a sign-in token (on your device) | To know it is you when you come back | Contract | Until you delete your account |
| Email address and password, if you make an account (the password is stored scrambled, never readable); or your name and email from Google, Facebook or Discord if you sign in with them | Signing in on any device, password resets | Contract | Until you delete your account |
| Your first and last name, country and city, when you make an account (never asked from players under 13) | To know who our players are and where they play from, and to contact you about your account | Contract (contacting you about your account); legitimate interest (knowing who plays) | Until you delete your account |
| Player name, gamertag, friend code, level, XP, squad colour and stats | Your profile, friends, name cards and the leaderboard | Contract | Until you delete your account |
| Battle results (mode, squads, win or loss, knock-outs, crates, time played) | Progress, badges, the leaderboard, and spotting cheated results | Contract; legitimate interest in fair play | Until you delete your account (refused results: 90 days) |
| Coins, items and what you wear | The shop and the Locker | Contract | Until you delete your account (beta progress may be reset) |
| Friends, clan membership, invites and join requests | Playing together | Contract | Until you remove them or delete your account; party invites expire after 1 hour, clan invites after 7 days |
| Friend chat and clan chat | So friends can read your messages later | Contract | The latest 200 lines of each chat; yours go when you delete your account |
| Your age group: whether you are under 13, and if so the day you turn 13 (never your birthday) | Keeping chat off for children until a parent agrees | Legal obligation; legitimate interest in protecting children | Until you delete your account; the day is removed once you are 13 |
| Players you block, and reports you send or that are sent about you (with up to 10 recent friend or clan chat lines between the two players) | Keeping players safe and handling rule breaking | Legitimate interest in a safe game | Blocks: until you remove them. Reports: up to 1 year after they are handled |
| Bans (reason and end date) | Enforcing the terms | Legitimate interest in a safe game | While the ban lasts, or until the account is deleted |
| Feedback you send from the game (your message, what kind it is, the game version, your browser type and screen size) | Making the game better | Legitimate interest | 1 year |
| Crash reports (the error, the game version, your browser type and account id) | Finding and fixing bugs | Legitimate interest | 90 days after the error last happened |
| Daily player numbers (counts only), who played today, and how often you used the relay | Knowing how busy the game is, and preventing abuse of the relay | Legitimate interest | Counts are kept; the list of who played is cleared the next day, relay use after 2 days |
| Link tags: when you open the game through a link with a tag (such as ?ref=tiktok), that tag and whether a battle was started, counted per day (counts only, nothing about you, nothing stored on your device) | Knowing which posts and videos bring players | Legitimate interest | 1 year |
| Technical logs at our hosting providers (IP address, browser, time of the request) | Running the service and keeping it secure | Legitimate interest | As set by the provider, usually days to a few weeks |
Your player name, gamertag, level, clan, what you wear, your name badge stats and your leaderboard results are visible to other players. Friend codes, email addresses, age groups, and your real name, country and city are not.
Playing with other players
Parties, shared battles and voice chat connect the players' games directly (peer to peer). That means the other players in your party or battle can see your IP address, as in most online games. When a direct connection is not possible, the traffic goes through a relay run by Cloudflare. Battle and voice traffic is encrypted, and we never record it.
Some battles run on a game server that we operate instead of on a player's computer. It receives the same battle traffic (and so your IP address) and saves each player's battle result to our database at the end, as your own game would otherwise. It keeps nothing else.
Party chat, battle chat and voice chat are sent live to the other players and are not stored by us.
On your device
The game keeps your settings, a copy of your progress and your sign-in token in your browser's local storage. These are needed for the game to work, so we don't ask for consent, and there are no advertising or tracking cookies. Clearing your browser data removes them (a guest account without email or social sign-in cannot be recovered after that).
Who helps us
These companies process data on our behalf, under data processing agreements:
- Supabase: database, accounts, sign-in emails and live updates.
- Vercel: hosting the website.
- Cloudflare: the relay for connections between players.
If you sign in with Google, Facebook or Discord, that company handles the sign-in under its own privacy policy. Some of these companies are based in the United States; where data leaves the EU/EEA, it is protected by the EU-U.S. Data Privacy Framework or the EU Standard Contractual Clauses.
Children
The Crate Game asks every player when they were born, once. Players under 13 can play everything, but text and voice chat stay off for them until a parent or guardian agrees, or until they turn 13. We never ask players under 13 for their name, country or city when they make an account, and if we learn that a player is under 13 we delete them. Parents can email contact@thecrategame.com with their child's player name and friend code to switch chat on, or to see, download or delete their child's data.
Your rights
Under the GDPR you can ask to see your data, get a copy of it, have it corrected or deleted, restrict or object to how we use it. Most of this you can do yourself in the game, under Account in the lobby:
- Download my data gives you a file with everything we keep about your account.
- Your details lets you correct your name, country and city.
- Delete account removes your account and its data right away. Reports that were already sent stay for moderation (with the player names in them, but no longer linked to your account).
For anything else, email us and we will answer within a month. If you think we handle your data wrongly, you can complain to the Swedish Authority for Privacy Protection (IMY) or the data protection authority where you live.
Security
All connections are encrypted (HTTPS). Every table in the database is locked down so players can only reach their own data through checked functions, and only a few people can open the admin tools.
Changes
When this policy changes, the date at the top changes too. For big changes we will also tell players in the game.