Privacy Policy

Last updated 5 November 2026

This policy explains what personal data Crates ("we", "us"), operated by Crate Software Solutions, collects when you use cratess.com, why, and your rights. We are the data controller for this data. For UK data protection law, our contact point is j.creasy@redfoxss.co.uk.

What we collect

• Account data — your email address, username, password (stored hashed, never in plain text) and any profile details or messages you choose to add.
• Gameplay data — your in-game activity, holdings, progress and purchases, so the game can work.
• Technical data — your IP address, browser and basic log data, used to keep the Service secure and running.
• Account monitoring — while you are signed in we record the IP address and browser (user agent) you use, when each was first and last seen, and how often. We also work out your approximate location (town or city and country) from your IP address, using a database kept on our own server, so your IP is not sent to anyone else to do this. Our staff can view this alongside your account details, gameplay history and progress in an internal dashboard, and compare it across accounts (for example, accounts sharing an IP address). We use it only to spot cheating, exploits, multiple accounts and fraud, and to understand how players use the game. It is never shown to other players.
• Robot check — the sign-up and password-reset forms ask your browser to solve a short puzzle and check how quickly the form was filled in, to stop automated sign-ups. This runs on our own server; no third-party captcha service is used.
• Payment data — if you buy CrateCoin, our payment provider Stripe handles your card details. We do not see or store your full card number; we only receive confirmation that a payment succeeded.

Why we use it (lawful basis)

We use your data to provide the game and your account (performance of a contract), to keep the Service secure, prevent abuse and monitor accounts as described above (our legitimate interests in running a fair game), to process payments (contract), and to comply with our legal obligations. We do not sell your data, and we do not use it for third-party advertising.

Cookies

We use a small number of cookies: an essential session cookie to keep you logged in, and a referral cookie (about 30 days) that remembers if a friend invited you so they can be credited. We do not use advertising or cross-site tracking cookies.

Who we share it with

We share data only with the providers that make the Service work — our payment processor (Stripe) and our email/hosting providers — and where required by law. These providers only process data on our instructions.

How long we keep it

IP address and browser records are deleted automatically 90 days after they were last seen, unless we need them for an open investigation into abuse of the Service.

We keep your account data for as long as your account is active. If you ask us to close your account, we delete or anonymise your personal data except where we must keep some of it for legal or fraud-prevention reasons.

Your rights

Under UK GDPR you have the right to access the personal data we hold about you, to have it corrected or deleted, to object to or restrict certain processing, and to data portability. To exercise any of these, email j.creasy@redfoxss.co.uk. You also have the right to complain to the UK Information Commissioner's Office (ico.org.uk).

Children

The Service is not intended for children under 13, and we do not knowingly collect their data. If you believe a child under 13 has given us data, contact us and we will remove it.

Changes

We may update this policy; the "last updated" date above shows when. See also our Terms of Service.