Crypt Crawlers Privacy Policy

Last updated: October 31, 2026 · Applies to the Crypt Crawlers iPhone app and the web version.

The short version

There are no accounts. We never ask for your real name, email, phone number, contacts, photos or precise location.
Your game is saved on your device. To run the leaderboard, player profiles and cloud backups, the game sends a random player ID, the leaderboard name you choose, your game stats and (if backups are on) a copy of your save to our game server.
The iPhone app shows optional reward ads from Google AdMob. Ads only play when you tap a WATCH button. Google may collect device and advertising data to show and measure ads. You choose whether ads may use tracking.
We do not sell your personal information.
You can delete your data at any time with Settings > DELETE MY DATA in the app, or ask us by email: cryptcrawlerhq@gmail.com.

1. Who we are

Crypt Crawlers is an independent game. In this policy, "we" and "us" mean the developer of Crypt Crawlers, who decides how the data described here is used (the "controller" under data-protection laws such as the GDPR). For any privacy question or request, email cryptcrawlerhq@gmail.com.

2. What we collect, and why

2.1 Stored only on your device

Your save (heroes, items, progress, settings and mail inside the game) is kept in the app's local storage on your device. It is not sent anywhere unless a feature below sends it. Deleting the app, or Settings > ERASE SAVE, removes it from the device.

Players you hide on World Rankings are also remembered only on your device. On iPhone, if the law where you live requires it, the app asks Apple's Declared Age Range feature for your age range; you choose whether to share it. The answer (for example "18 or over") stays on your device, is only used to choose safer ad settings for younger players and to turn World Rankings off for players under 13 (section 6), and is never sent to our server.

2.2 Sent to our game server

Our game server runs on Cloudflare Workers. It receives only the following:

Data	What it is	Why we use it	Who can see it
Player ID	A random ID your device makes the first time you play, plus a secret token the server returns. It is not tied to your Apple ID, phone number or advertising ID.	So the leaderboard knows which row is yours and nobody else can overwrite it.	The ID is used to open your public profile card. The token is never shown.
Leaderboard name	The name you type in Settings (up to 14 characters). Please don't use your real name.	To show your rank on the leaderboard.	Public: every player.
Scores and game stats	Best wave, ascensions, play time, rank, current hero and its stars, hat, weekly best and Crypt Warden damage.	For the all-time and weekly leaderboards and for cheat checks (for example, a wave reached faster than play time allows).	Public: every player.
Profile card	Your hero, equipped gear, pet, cosmetics and lifetime stats (such as kills and gold earned). It is sent at most every 30 minutes.	So other players can tap your leaderboard row and see your build.	Public: every player.
Cloud backup	A copy of your save, a random 6-character backup ID and a one-way hash of your secret key (we can't read the key). Auto backup is on by default; you can turn it off in Settings.	So you can restore your progress on a new device with your Recovery Code.	Only someone with your full Recovery Code. It is never public.
Name reports	When you report a leaderboard name: the reported player's ID and name, the reason, the time, and a short one-way hash of your IP address (so one address counts once). Your own player ID is not sent.	To review reported names and remove ones that break the rules.	Only us.
App and save version	The game version and the newest save format it can read.	To send each version data it can use, and in-game messages such as "update required".	Only us.
IP address	Your internet address, which every web request carries.	To limit abuse and spam (for example, posts per hour from one address) and to deliver the request. We don't use it to locate you, and we don't link it to your player ID or profile.	Only us and our host, Cloudflare.

The game also asks the server for the current time, so daily rewards follow the real date. That request carries no game data.

We do not use analytics or crash-reporting services of our own.

In-app purchases (iPhone app only). Payments are handled entirely by Apple through the App Store; the game never sees your card or payment details. To make sure each purchase is given exactly once and can be restored, your save keeps a list of what you bought (the product and Apple's transaction number). It stays on your phone, and is included in your cloud backup only if you turn cloud backup on. DELETE MY DATA removes the backup; your purchases stay with your Apple ID and come back with RESTORE PURCHASES.

2.3 Advertising (iPhone app only)

The iPhone app offers optional rewarded ads through Google AdMob (Google LLC, or Google Ireland Limited for users in the EEA, UK and Switzerland). An ad only plays when you tap a WATCH button, and the game works fully without ads. To show and measure ads and prevent ad fraud, the Google Mobile Ads SDK in the app may collect:

your IP address, which may be used to estimate your general location;
device identifiers: the advertising identifier (IDFA), but only if you allow tracking, and app-scoped identifiers;
advertising data, such as which ads you saw or tapped;
product interaction data, such as taps and video views;
diagnostic data: crash logs and performance data (for example, app launch time).

Google and its partners may use cookies, SDK storage on your device, web beacons and IP addresses to collect this information as a result of ad serving. Google uses this data under its own policies:

Your choices for ads:

App Tracking Transparency: the first time you open the app, iPhone asks whether the app may track you. If you choose "Ask App Not to Track", the advertising identifier is not shared and ads are not personalized based on tracking across other companies' apps and websites. You can change this any time in iPhone Settings > Privacy & Security > Tracking.
Consent in the EEA, UK and Switzerland, and opt-out in some US states: where the law requires it, Google's consent message (the User Messaging Platform) asks for your choice before personalized ads are shown. You can change it later from Settings > AD PRIVACY CHOICES in the game. Without consent, Google may still show non-personalized or limited ads, as its policies describe.
Not watching ads: no ad loads unless you tap WATCH.

The web version shows no third-party ads.

3. Legal bases (EEA, UK and Switzerland)

Performance of our service (giving you the game features you use): the leaderboard, profile cards and cloud backups.
Legitimate interests: keeping the leaderboard fair and the service safe (cheat checks and IP-based rate limits). You can object at any time; see section 7.
Consent: personalized advertising and the device storage it needs, collected through Google's consent message. You can withdraw consent at any time from Settings > AD PRIVACY CHOICES.

4. Who we share data with

Other players: your leaderboard name, scores, game stats and profile card are public inside the game.
Cloudflare, Inc. hosts our game server and processes the data in section 2.2 on our behalf (Cloudflare Privacy Policy).
Google receives the advertising data in section 2.3 directly from the Google Mobile Ads SDK in the app, and uses it under its own policies. We only work with service providers that protect your data at least as well as this policy describes and as the law and Apple's App Store rules require.
Expo (650 Industries, Inc.): the iPhone app asks Expo's update service whether a fix for the game is available. That request carries the app version, the platform and update IDs, plus your IP address like any web request; no player ID, name or game data (Expo Privacy Policy).
When the law requires it: we may disclose data if a valid legal request requires it, or to protect players and the service from fraud or abuse.

We do not sell your personal information for money, and we never share the data in section 2.2 for advertising. In some US states, the way ad networks use device identifiers for personalized ads can count as "selling" or "sharing" personal information, even with no money involved. To opt out, choose "Ask App Not to Track" or use Settings > AD PRIVACY CHOICES (where shown), or email us.

Cloudflare, Google and Expo may process data in the United States and in other countries. Where data from the EEA, UK or Switzerland is transferred, they rely on safeguards recognized by those laws, such as the EU-US Data Privacy Framework or Standard Contractual Clauses.

5. How long we keep data

Data	How long
Save on your device	Until you erase it (Settings > ERASE SAVE) or delete the app.
Leaderboard row, profile card	While the leaderboard runs, or until you delete them (Settings > DELETE MY DATA) or ask us to. A major reset of the game may also clear them.
Weekly results	When a week ends, its results (names and scores) are saved in a server archive and its top 3 are shown as last week's champions. The archive is kept while the leaderboard runs.
Cloud backup	Deleted automatically 30 days after your last backup that added new play time. Once a backup ID has more than 2 hours of play, the limit becomes 1 year. You can also ask us to delete it sooner.
Name reports	Until we have handled them; at most the newest 300 reported players are kept.
IP-based rate-limit counters	Most last 1 hour; daily ones up to 2 days. Expired counters are deleted automatically every day.
Advertising data	Kept by Google under its own policies (links in section 2.3).

6. Children

Crypt Crawlers is rated 13+ on the App Store and is not directed at children under 13 (or under the minimum age for consent in their country, up to 16 in parts of the EEA). We do not ask for anyone's age, name or contact details. Where the law requires it, Apple's Declared Age Range feature may tell the app, on the device only, that a player is under 13. When it does:

World Rankings are turned off on that device. The app sends no scores, leaderboard name or profile card to our server and does not load the leaderboard. Anything posted from the device before then stops being updated.
Only General-rated ads marked as directed to children are requested, the app never asks to track, and the age answer is never sent to us.
The rest of the game works the same, including the automatic cloud backup of the save (stored under a random backup ID, with no name or contact details). It can be turned off in Settings > Cloud backup.

If the player declines to share an age range, or the check is not available, the app treats the answer as unknown: World Rankings stay on, with the safer ad settings for younger players.

A parent or player can remove that data at any time with Settings > DELETE MY DATA in the app, or by emailing us (section 7). If you believe a child under 13 has used the leaderboard, profiles or cloud backup, tell us and we will delete that data.

7. Your rights

Wherever you live, you can:

Change your leaderboard name at any time in Settings.
Turn off cloud backup with the Auto backup switch in Settings.
Erase the save on your device with Settings > ERASE SAVE, or by deleting the app.
Ask for a copy of the data we hold about you, or ask us to correct or delete it.

Depending on where you live, data-protection laws may give you more rights. For example, under the GDPR and UK GDPR you can ask to access, correct, delete, restrict or move (port) your data, object to processing based on legitimate interests, and withdraw consent at any time. Under California and other US state privacy laws, you can ask to know, access, correct and delete personal information, and opt out of the "sale" or "sharing" of personal information or of targeted advertising. We won't treat you differently for using any of these rights. You may also complain to your local data-protection authority.

How to delete your data

In the app: Settings > DELETE MY DATA removes your leaderboard rows, name, profile card, name reports about you and your cloud backup from our server, then erases the save on your device. It needs an internet connection; if our server cannot be reached, nothing on your device is erased.

By email:

Email cryptcrawlerhq@gmail.com with the subject "Crypt Crawlers data deletion". Include:

your leaderboard name;
if you use cloud backup, the first 6 characters of your Recovery Code (Settings > Cloud backup). Never send your full Recovery Code: anyone who has it can restore your save.

We use these details only to find and confirm your data. We will remove your leaderboard rows (all-time, this week and last week's champions), your profile card and your cloud backup, and reply within 30 days. Your device keeps its local save until you erase it. Data that Google collected for ads is managed by Google; you can make requests to Google through its privacy policy.

8. Security

All traffic between the game and our server uses HTTPS. The server stores only a one-way hash of your backup key, leaderboard rows can only be updated with your device's token, and access to the server's admin tools is restricted. No system is perfectly secure, but we keep the data we hold to the minimum the game needs.

9. Changes to this policy

If we change this policy, we will update the "Last updated" date above. For significant changes, we will also tell players in the game's patch notes before the change takes effect.

10. Contact

Privacy questions and requests: cryptcrawlerhq@gmail.com