Privacy Policy
Last updated: September 2026
Introduction
Crash Continuum LLC ("we," "our," or "us") is the data controller for the personal data described in this policy. This policy explains what we collect when you use Crash BASIC Arcade, why we are allowed to collect it, who else sees it, how long we keep it, and what you can require us to do about it.
It applies to the website, the JSON API used by our mobile and desktop apps, and the services attached to them. It is written to be accurate against the running system rather than aspirational — if you find something here that does not match what the service does, tell us and we will fix one or the other.
Information We Collect
Account information
- Username — your public display name
- Email address — verification, password recovery, account notices, and announcements if you opted in
- Password — stored only as a bcrypt hash; we never hold the password itself
- Date of birth — required at signup. It confirms you are old enough to hold an account, decides which content ratings you can be shown, and is part of how we keep a service that admits teenagers safe for them. We keep the date rather than a yes/no answer because you get older: the same field decides different things at 13, 16 and 18, and a box ticked once at signup would quietly be wrong within a year. We ask for a date, not for identity documents — a date answers the question without us holding far more sensitive information about a child than the question needs
- Display name, author name, bio and profile image — optional, and public where you choose to show them
- Email preference — whether you have opted in to announcements
Security and sign-in records
- Sign-in history — every credential check on every surface, whether it succeeded or failed: the IP address, the country reported by our CDN, the browser user agent, the username typed, the outcome, and the method used. You can read your own history at any time at Login Activity
- Two-factor settings — your chosen method, its secret, and your recovery codes, if you enable it
- Session cookie and, if you create them, API tokens and linked-device records — including the device identifier, a label you choose, the platform, and the IP each token was last seen from
Content you create
- Games — program code, images, audio and other assets, plus the title, author name and description you give them
- Crash Kits, preview images, reviews, votes, hearts and tags
- Saved games stored through CrashNet, including save data and playtime
- Your library — which games you own or have added
- Support tickets, their messages and any files you attach
- Game jam entries, team membership and votes
- Reports and blocks — content you report, and accounts you block
Payment information
Card details are handled entirely by Stripe and never reach our servers. We store your Stripe customer identifier, your subscription tier and status, and a record of purchases, tips and in-app purchases. If you take payments as a creator, we also store your Stripe Connect account identifier and whether onboarding and payouts are enabled.
Discord, if you link it
Linking is optional. If you link, we store your Discord user ID, username, discriminator and avatar hash, the OAuth tokens from the link, and the identifier of your developer log channel if you have one. Unlinking removes all of it.
Collected automatically
- IP address — for security, rate limiting and abuse prevention
- Server logs — the requests your browser makes, with your IP address, your account identifier if you are signed in, and the path requested
- Visitor analytics — described in its own section below
Why We Are Allowed To Use It
We hold ourselves to the GDPR's standard here, whoever you are and wherever you live: every use of personal data has a stated lawful basis. Ours are:
| What we do | Using | Lawful basis |
|---|---|---|
| Run your account; host, serve and let people play your games | Account details, your content | Performance of our contract with you — Art. 6(1)(b) |
| Take subscription payments; process purchases, tips and payouts | Payment and Stripe identifiers | Contract — Art. 6(1)(b); and legal obligation for tax and accounting records — Art. 6(1)(c) |
| Keep accounts secure: rate limiting, lockouts, abuse and fraud prevention | IP address, sign-in history, device records | Our legitimate interest in a service that is not overrun by abuse — Art. 6(1)(f) |
| Screen uploaded content before it is published | Game title, author name, description, images and program code | Our legitimate interest, and the interest of every other user, in an arcade that stays safe for a 13+ audience — Art. 6(1)(f) |
| Decide which content ratings you can be shown | Date of birth | Contract — Art. 6(1)(b) |
| Answer your support tickets | Ticket contents, account details | Contract — Art. 6(1)(b) |
| Understand how many people visit and what they look at | Cookieless analytics described below | Our legitimate interest in knowing whether the service is working — Art. 6(1)(f) |
| Send you announcements about new features | Email address, username | Your consent — Art. 6(1)(a). Withdraw it any time in Account Settings |
| Link your Discord account | Discord identity and tokens | Your consent — Art. 6(1)(a). Withdraw it by unlinking |
Where we rely on legitimate interests, you have the right to object — see Your Rights.
Who Else Receives Your Data
We do not sell your personal information, and we do not share it for advertising. These are the only third parties that receive any of it, and only for the purpose listed.
| Who | What they receive | Why |
|---|---|---|
| Stripe | Your payment details, which you give them directly, and your email address | Payments and creator payouts |
| DigitalOcean | Everything, as our hosting and file storage provider | Running the service |
| OpenAI | The title, author name, description, images and program code of games at upload and on edit; questions you ask our Discord assistant | Automated content screening, and the assistant |
| Cloudflare | Your IP address, as our network edge and anti-bot check | Delivery and abuse prevention |
| Resend or our SMTP provider | Your email address and username | Sending account email |
| Discord | Only what is needed to link, and only if you choose to link | The optional Discord integration |
Stripe, DigitalOcean, OpenAI, Cloudflare and Resend act as our processors — they handle your data on our instructions and for no purpose of their own. Discord acts as its own controller for the data it holds about your Discord account; their privacy policy governs that, not ours.
Our server logs are not sent to any third-party logging service. They stay on the servers that run the site.
We may also disclose data where we are legally required to, or where it is necessary to establish or defend a legal claim.
International Data Transfers
We operate from the United States and our servers are hosted there. The providers listed above process data in the United States and, in some cases, elsewhere. If you use the service from outside the United States, your personal data is transferred there and to those providers.
If you would like to know more about the safeguards applying to a particular transfer, contact us at the address below and we will tell you.
Cookies and Analytics
Cookies
We set one cookie: a session cookie that keeps you signed in. It is HTTP-only, restricted to same-site navigation, and expires after 24 hours or when you sign out. We set no tracking, advertising or analytics cookies, and no third party sets a cookie through us.
How we count visitors
We do measure traffic, and it is fair that you know how. When you load a page we record the path, the site host, the referring page, your browser's user agent string, and the two-letter country our CDN reports. We do not store your IP address for this.
To count returning visits within a single day without identifying you, we take a one-way hash of your IP address and user agent combined with a secret that is regenerated every day. The same person on two different days produces two unrelated values, so we can count a day's visitors but cannot follow anyone across days, cannot connect the figure to your account, and cannot work backwards from it to your IP address.
This is first-party measurement with nothing stored on or read from your device, so it needs no cookie banner. If you would still rather not be counted, you have a right to object — see below.
Automated Screening of Uploads
When you upload or edit a game, its text and images are screened automatically before it appears in the arcade. If the screening finds nothing of concern the game is approved for an Everyone rating without a person seeing it. Nothing is ever rejected automatically. Anything the screening flags — including a false positive — goes to a human moderator, who makes the decision.
Because a person always makes the adverse decision, this is not the kind of solely automated decision-making that Article 22 restricts. If your upload is held or rejected you can ask us to explain why, and ask a moderator to look again.
How Long We Keep It
| What | How long |
|---|---|
| Account data and your content | Until you delete the item, or your account |
| Sign-in history, including IP addresses | 180 days, then deleted automatically |
| Page-view records | 90 days |
| Download records | 180 days |
| Signup and upgrade records | 2 years |
| IP blocks | Temporary blocks are deleted once they expire. A permanent block is kept until we lift it |
| Records of repeated abuse from an IP address | Kept for as long as abuse prevention requires — see below |
| Server logs | About 14 days, on our own servers |
| Payment records | As long as tax and accounting law requires |
Deleting your account removes your data ahead of these periods, except where we are legally required to keep a payment record. Server logs are an exception in the other direction: they stay on our own servers, roll over after about two weeks, and are not searched or purged per account, because doing so would defeat the security purpose they exist for.
Records of repeated abuse are the other exception, and we would rather explain it than bury it. When an IP address repeatedly trips our rate limits we keep a running count against that address, and a high enough count blocks it automatically. That count is the mechanism, not a byproduct of it: if we deleted the record after a fixed period, anyone willing to stay just under the limit and wait could reset themselves to zero and start again indefinitely. So we keep it for as long as it is doing that job. It holds an IP address, the endpoint, and how many times it happened — no account details, and nothing about what was requested.
Crash Kits you have published are kept after your account is deleted, with your account no longer attached to them, so that people who have built on them do not lose them.
Your Rights
These are the rights the GDPR gives people, and we honour every one of them for every user, wherever you live — not only for people in the UK, the EU or the EEA.
- Access — get a copy of the personal data we hold about you
- Rectification — correct anything inaccurate. Most of it you can edit yourself in Account Settings
- Erasure — have your account and data deleted. You can start this yourself at Delete My Account; there is a 7-day grace period during which you can change your mind
- Portability — receive your data in a machine-readable format, or have us send it to another service
- Restriction — require us to pause processing while a dispute about accuracy or legitimacy is resolved
- Objection — object to anything we do on the basis of legitimate interests, including the visitor analytics described above. We will stop unless we have compelling grounds that override your interests
- Withdraw consent — for announcements, in Account Settings; for Discord, by unlinking. Withdrawing does not affect anything done before you withdrew
To exercise any of these, email us at the address below. We will respond within one month. We will not charge you or make the service worse for asking.
If you are not satisfied
You have the right to complain to a data protection supervisory authority. In the EU that is the authority in the country where you live, work, or where you believe the problem occurred — the list is at edpb.europa.eu. In the UK it is the Information Commissioner's Office. We would rather you came to us first, but you do not have to.
Data Security
- HTTPS for every connection
- Passwords stored as bcrypt hashes, never in a recoverable form
- Password reset and email verification links stored only as hashes, so a copy of our database does not yield a working link
- Optional two-factor authentication
- Rate limiting, IP blocking, and account lockout after repeated failed sign-ins
- Credentials and tokens stripped from our logs before they are written
No service can promise perfect security. If a breach affects your personal data and puts you at risk, we will tell you and the relevant authority within the time the law requires.
Children
You must be at least 13 to create an account. We ask for your date of birth at signup and refuse accounts below that age. We do not knowingly collect personal data from children under 13; if you believe a child under 13 has an account, contact us and we will remove it.
That 13 is a child-protection floor, and it is not something we trade away for other reasons. It sits alongside obligations we have as a platform that hosts content and admits teenagers — including reporting child sexual abuse material to the authorities, which no privacy policy overrides and which we will always do. Where the law requires us to keep or hand over information for that purpose, we will, and your right to erasure does not extend to it.
We do not send announcement or marketing email to anyone under 16. Not by preference — by rule. Accounts under 16 are excluded from those sends regardless of what any checkbox said, the option does not appear in Account Settings, and the exclusion is applied when the mail is addressed rather than being left to a setting someone could flip. Essential email — password resets, email verification, notices about your account — is unaffected, because that is part of running the account you asked us for and not marketing.
We picked 16 because it is the highest age any European country sets for a person to consent on their own behalf to an online service, so one rule covers everyone without us having to guess at where you are. Everything else we do rests on our contract with you rather than on your consent, so it is unaffected by your age.
Changes to This Policy
We may update this policy. If a change materially affects how we handle your data, we will email registered users before it takes effect. The date at the top shows when it was last revised.
Contact Us
For any question about this policy, or to exercise any of the rights above:
Email: support@crashbasic.com
Crash Continuum LLC is the data controller. We have not appointed a data protection officer; questions go to the address above and reach the people who can answer them.