CRATEPrivacy Policy
Effective October 22, 2026
The short version: We collect only what we need to run the game: your account details, your game progress, and basic technical information like IP addresses to keep the servers safe. We don't sell your data, we don't show ads, and we don't use third-party tracking or analytics.
This Privacy Policy explains how kaosu, LLP ("we", "us") handles personal information when you use Crate Blitz at crateblitz.com and crateblitz.com/app (the "Service").
1. Information we collect
| What | When | Why |
|---|---|---|
| Email address | When you create an account, or sign in with Google or Discord | To identify your account, send confirmation and password-reset emails, and let you sign in |
| Username | When you create an account, or choose a guest name | Shown to other players in matches and on scoreboards |
| Password | If you sign up with email | To sign you in. We store only a salted, one-way hash (scrypt), never the password itself |
| Two-factor secret and backup codes | If you turn on two-factor authentication | To check your authenticator codes. Backup codes are stored hashed |
| Game data | While you play | Kills, deaths, wins, matches played, XP, level, coins, inventory, equipped items, upgrades, and daily reward streak. Used to save your progress and show stats |
| Chat messages | When you chat in a match | Shown to players in the same match. We don't store chat after it is delivered |
| IP address and device information | When you connect | Security, rate limiting, preventing abuse, and enforcing bans. Also includes your browser type and whether you're on the computer or touch version (shown as an icon on the scoreboard) |
| Error reports | If the game hits an error in your browser | Error details, browser version and username or guest name, sent to our server so we can fix bugs |
2. Google and Discord sign-in
If you choose "Continue with Google" or "Continue with Discord", we ask that service for your basic profile only:
- Google: your Google account ID, your email address and whether it is verified, and your name (scopes:
openid,email,profile). - Discord: your Discord user ID, username, your email address and whether it is verified (scopes:
identify,email).
We use this information only to:
- create or sign you into your Crate Blitz account;
- link the sign-in to an existing account with the same verified email;
- suggest a username.
We do not:
- store your Google or Discord access tokens after sign-in;
- post anything on your behalf;
- access your contacts, files, servers, messages or any other data;
- share this information with anyone.
Crate Blitz's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
3. Cookies and local storage
- cb_session: an essential cookie that keeps you signed in (HttpOnly, up to 30 days).
- cb_oauth / cb_from: short-lived essential cookies, up to 10 minutes, that protect Google/Discord sign-in from forgery and return you to the right page.
- Local storage: your game settings (sensitivity, field of view, volume, class, guest name) are saved in your browser only.
We don't use advertising, analytics or tracking cookies.
4. How we use information
We use the information above to run and secure the Service:
- providing matches and accounts;
- saving progress;
- sending account emails;
- preventing cheating, spam and abuse;
- moderating, including bans tied to usernames and IP addresses;
- fixing bugs;
- responding to you when you contact us.
We don't:
- sell or rent your personal information;
- use it for advertising;
- make automated decisions about you, apart from automatic security measures such as rate limits.
5. Who we share it with
We share data only with the service providers needed to run the Service, and only for that purpose:
- Cloudflare: network protection and delivery. Traffic passes through Cloudflare's network.
- Resend: sends account emails (your email address and the message).
- Google / Discord: only if you choose to sign in with them, as described above.
Other players can see your username, level, appearance, game stats in matches, chat messages, and whether you're on a computer or phone. Our admins can see account details, IP addresses and activity when moderating. We may disclose information if required by law, or to protect the safety of players, the public or the Service.
6. How long we keep it
- We keep account data for as long as your account exists.
- Guest sessions aren't saved.
- Server logs, which can include usernames and IP addresses, are kept for a limited time for security and moderation, then deleted.
- Ban records are kept while the ban is in effect.
7. Your choices and rights
- Access, correct or delete: email support@crateblitz.com from your account's email address and we'll respond within 30 days. Deleting your account removes your email, password hash, two-factor data, linked sign-ins, stats and items.
- Unlink Google or Discord: you can also remove Crate Blitz's access at any time from your Google Account (Security → Third-party connections) or Discord (Settings → Authorized Apps).
- Depending on where you live (for example the EU/UK under the GDPR, or California under the CCPA), you may have additional rights, such as data portability or objecting to processing. Contact us to use them. We process account data to provide the Service you asked for, and security data for our legitimate interest in keeping the Service safe.
8. Security
We use HTTPS everywhere and hash passwords and backup codes. We offer two-factor authentication, and rate limits and lockouts protect sign-in. No system is perfectly secure, though, so please use a unique password and turn on two-factor authentication.
9. Children
The Service is not directed to children under 13, and we do not knowingly collect personal information from children under 13. If you believe a child under 13 has created an account, contact us and we will delete it.
10. International users
The Service is operated from the United States. If you use it from elsewhere, your information will be processed in the United States.
11. Changes to this policy
We may update this policy from time to time. We'll change the effective date above, and for significant changes we'll give notice in the game or on the website.
12. Contact
Questions or requests about your privacy? Email support@crateblitz.com.
kaosu, LLP