Privacy Policy

Who runs Crime City

Crime City is an independent game operated by a small team under the name Crime City, at crimecity.fun. For anything in this policy — a question, a correction, a deletion request, or a complaint — write to [email protected]. That address is read by the people who run the game.

Age limit

We do not knowingly collect anything from anyone under 18. If we find out an account belongs to someone under that age, we delete the account and everything attached to it. If you believe a minor has an account here, tell us at [email protected] and we will act on it.

What we collect

Grouped by why it exists, rather than by which system it happens to sit in.

Guest accounts hold less. Playing as a guest creates an anonymous account with no email and no password, and it is deleted automatically 48 hours later unless you claim it. Until you claim it we hold the character and the sign-in record, and nothing that identifies you personally.

Session replay

Our analytics provider, PostHog, records browser sessions on Crime City: what was on screen, where you clicked, and what you scrolled. We use these recordings to find broken screens and confusing flows.

Recordings are stored by PostHog in the European Union and are deleted on PostHog's retention schedule. If you would rather not be recorded, most browsers' “Do Not Track” or tracker-blocking settings will stop the analytics script from loading, and the game works normally without it. You can also ask us to delete your recordings — see Deleting your data.

Why we hold it

Under the GDPR, every use of personal data needs a legal basis. Ours are:

• To provide the game you asked for (performance of a contract): your account, your character, your messages, your purchases. Without these there is no game to play.
• To keep the game fair (legitimate interests): the sign-in records above exist to detect players running several accounts to feed one character, and to detect banned players returning under a new name. This is the reason we keep IP addresses, and it is why those records outlive the seasonal wipe.
• To keep the game working and improve it (legitimate interests): analytics, session replay, error reports, rate limiting, and bot protection on the sign-up form.
• To tell you a season has opened (legitimate interests): if you registered with an email address, we may email you when a new season starts. Every season announcement carries an unsubscribe link, and unsubscribing stops those without touching the emails the game has to send you — sign-in confirmations, password resets, and receipts for anything you pay for.
• To meet legal obligations: keeping enough of a record of paid transactions to satisfy accounting and anti-fraud duties.

Where we rely on legitimate interests you have the right to object — see Your rights.

What is public

Crime City is a competitive game played in public. The following is visible to other players and to anyone on the internet, including search engines, without signing in:

• Your alias, avatar, level, rank, and the stats you have not hidden.
• Your gang, your position in it, and your place on the leaderboards.
• Your bio, gender and country, if you filled them in.
• Your season results, which stay published after the season ends.

Your email address, your password, your balances and your purchase history are never public and are never sent to a browser other than your own.

Search engines may keep copies of public pages after we delete them. We can remove a page from our site; we cannot remove it from someone else's cache or archive.

The blockchain is permanent

If you would rather not have your play linked to a wallet you use elsewhere, use a separate wallet for Crime City.

Who else sees it

We use the services below to run the game. Most of them process data on our instructions and are not permitted to use it for their own purposes. We do not sell personal data and we do not share it with data brokers. The three advertising platforms in this table are the exception to the “on our instructions” rule: Meta, TikTok and X receive a limited measurement signal and handle it under their own terms as well as ours. What that signal contains is set out in Advertising and measurement.

Signing in is a separate matter. When you sign in with Google or Discord, that company is acting for itself under its own privacy policy and we simply receive the result. You cannot sign in to Crime City with Facebook or Instagram — Meta appears in the table above for advertising only. We may also disclose data where the law requires it, or to investigate fraud, abuse or a threat to someone's safety.

Advertising and measurement

We buy ads for Crime City on Meta (Facebook and Instagram), on TikTok and on X. To know whether that money brings in players rather than empty clicks, those platforms are told when a browser that clicked one of our ads goes on to create a character. Without it we can see that a click happened and nothing at all after it.

We do not send either platform your username, your in-game activity, your balances, your wallet address or anything you type in chat. Nothing you do inside the game after you sign up is reported to an advertiser, and neither platform is allowed to use what it receives to build a profile for anyone else's advertising.

If you would rather not be measured this way, any tracker-blocking extension or browser — uBlock Origin, Brave, Firefox with strict tracking protection, Safari — stops all three tags, and the game works exactly the same without them. You can also turn off ad personalisation in your Meta account settings, your TikTok ad settings and your X privacy settings.

Cookies and local storage

Crime City sets no cookies to profile you or to follow you around other sites for advertising. It does set a small number of advertising measurement cookies, listed below and explained in Advertising and measurement. The full set:

How long we keep it

Your rights

If you are in the UK or the European Economic Area, you have the right to:

• ask what we hold about you, and get a copy of it;
• have inaccurate details corrected;
• have your data deleted — see Deleting your data;
• ask us to restrict how we use it, or object to uses based on legitimate interests;
• receive your data in a portable form;
• complain to your national data protection authority.

Exercise any of these by writing to [email protected] from the address on your account, or by opening a ticket in our Discord if your account has no email. We answer within 30 days. We may ask you to prove the account is yours — an account takeover dressed as a data request is a real risk, and checking is how we protect you from it.

Security

Passwords are hashed by our authentication provider and are never stored in readable form. The whole site is served over HTTPS. Database access is restricted at the row level so one player's browser cannot read another player's data, and administrative tooling is limited to the people who run the game and is excluded from analytics and session recording.

No system is perfectly secure. If you find a vulnerability, tell us at [email protected] before telling anyone else, and we will work with you.

Where data is processed

Analytics and session recordings are held in the European Union. Other services in the list above may process data outside the European Economic Area, including in the United States. Where that happens, transfers rely on the European Commission's standard contractual clauses or an equivalent safeguard offered by the provider.

Changes to this policy

When this policy changes in substance we update the date at the top of the page, and we announce it in our Discord. Continuing to play after a change means you accept the updated policy. If a change would materially widen what we collect, we will say so plainly rather than quietly editing a sentence.