Privacy Policy

We take your privacy seriously and collect only the minimum information needed to run the Service.

1. Who is responsible

Operator	Team Push Crate
Data protection contact	Team Push Crate (operations)
Contact	pushcrate.game@gmail.com

2. What we collect

2.1 Playing as a Guest — we collect nothing. If you play Casual matches without signing in, we store no personal data about you at all. The temporary name shown to your opponent (for example Guest123456) is generated for that session and never saved.

2.2 If you create an account

Data	Required?	Purpose
Google account identifier	Required	Signing you in and recognising you on return
Email address	Received from Google	Identifying your account and contacting you about it
Internal handle	Generated by us	Kept so every account has a unique handle. Not shown to other players.
Nickname	Auto-generated, editable	Shown to other players

We never receive or store a password. Signing in happens at Google; we only receive the result.

2.3 Created automatically as you play: match records (result, reason, rating change, timestamp, opponent identifier); statistics (wins, losses, rating, streaks); replays (your five most recent matches only); session tokens.

2.4 IP addresses — for security only

Where	Why	Kept for
Failed sign-in log	Blocking brute-force attacks	7 days, then deleted automatically
Administrator sessions	Controlling admin access	Until session expiry (max 8 hours)
Administrator action log	Accountability	Cannot be deleted — see 5.4

2.5 What we do not collect: real names, national ID numbers, phone numbers, postal addresses, payment or financial data, location data, biometric data, advertising identifiers, behavioural tracking data.

3. Legal bases for processing (GDPR Art. 6)

Activity	Legal basis	Why
Accounts and sign-in	Contract 6(1)(b)	The Service cannot work without it
Gameplay, stats, rankings	Contract	This is the service you asked for
Replays	Contract	A feature you use
Email & reset emails	Consent 6(1)(a)	Optional; withdrawable at any time
Failed sign-in log (IP)	Legitimate interests 6(1)(f)	Preventing account takeover
Administrator action log	Legitimate interests	Accountability, dispute resolution
Anti-cheat and abuse handling	Legitimate interests	Keeping the game fair

Balancing test. We consider these uses not to override your rights: we collect only what security requires, delete failed sign-in records after 7 days, and never use any of it for marketing or profiling. You may object to processing based on legitimate interests at any time.

4. What we use it for

1. Identifying you and signing you in
2. Running matches and calculating rankings
3. Preventing cheating, hacking and brute-force attacks
4. Responding to incidents and enquiries
5. Delivering service announcements

We do not use your data for advertising or marketing, and we do not profile users or make automated decisions about them.

5. How long we keep it

Data	Kept for
Account details	Until you delete your account
Statistics and rating	Until you delete your account
Sign-in sessions	30 days
Failed sign-in records (incl. IP)	7 days
Replays	Your five most recent matches
Detailed match records	Older records removed during routine maintenance
Administrator action log	Indefinitely — see 5.4

5.2 When you delete your account

Data	What we do
Google account identifier, email, internal handle	Deleted permanently
Statistics and rating	Deleted permanently
Sessions	Deleted permanently
Replays	Deleted permanently
Match records	Anonymised and kept
Administrator action log	Kept

Why match records are anonymised rather than erased: every match involves two people. Deleting the record outright would destroy your opponent's history as well. Removing the link to your account means the record can no longer identify you, so we can honour your erasure request without harming someone else.

5.3 Backups. Data is backed up regularly. Deleted data may persist in backups briefly until those backups rotate out, after which it is permanently gone.

5.4 What remains after deletion. Records of administrative actions (suspensions, rating corrections and similar) are stored in a form that cannot technically be modified or deleted, to prevent tampering. We keep them on the basis of legitimate interests. They may include the numeric identifier of the account concerned, but directly identifying details such as username and email are deleted with your account.

6. Sharing and processors

We do not sell your personal information, and we do not share it with third parties for their own purposes. We use these providers to operate the Service:

Provider	Purpose	Data	Location
Cloudzy	Servers and storage	All stored data	United States
Google LLC (Sign-in)	Signing you in	Email, account identifier	United States

International transfers. Our servers and some providers may sit outside your country. Where personal data of EEA or UK residents is transferred outside those areas, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses (GDPR Art. 46).

7. Your rights

7.1 Everyone. See your data (profile screen shows account details, statistics and match history) · correct it (change your nickname) · delete it (profile → Delete Account; this cannot be undone) · ask us anything at pushcrate.game@gmail.com.

7.2 EEA and UK residents (GDPR)

1. Access — a copy of the personal data we hold about you
2. Rectification — have inaccurate data corrected
3. Erasure ("right to be forgotten") — exercised instantly by deleting your account
4. Restriction — ask us to pause certain processing
5. Data portability — receive your data in a machine-readable format
6. Object — to processing based on legitimate interests
7. Withdraw consent — e.g. remove your email address. Withdrawal does not affect the lawfulness of processing before it
8. Complain — to your national supervisory authority

We respond within one month. Complex requests may take up to two additional months; we will tell you if so.

7.3 California residents (CCPA / CPRA)

We are a small independent team and may fall below the thresholds that make the CCPA mandatory. We extend these rights to California residents regardless.

Category	Collected?	Specifics
Identifiers	Yes	Google account identifier, email, internal handle, IP address
Commercial information	No	—
Internet activity	Limited	Gameplay records, sign-in attempts
Geolocation data	No	—
Biometric information	No	—
Sensitive personal information	No	—
Inferences / profiles	No	We do not profile users

Sources: information you enter, and information generated automatically as you play. Business purpose: operating the Service, security and support.

1. Right to know what we collect, use and disclose
2. Right to delete — exercised by deleting your account
3. Right to correct inaccurate information
4. Right to opt out of sale or sharing — we do not sell or share personal information for behavioural advertising, so no "Do Not Sell or Share My Personal Information" mechanism is required
5. Right to limit use of sensitive information — not applicable; we collect none
6. Right to non-discrimination — we will never treat you worse for exercising these rights

Write to pushcrate.game@gmail.com. We respond within 45 days (extendable by a further 45 days, with notice).

8. Children

1. The Service is intended for people aged 13 and over.
2. We do not knowingly collect personal data from children under 13.
3. In the EEA the threshold may be as high as 16, depending on the country.
4. In the Republic of Korea, users under 14 require guardian consent.
5. If we discover we have collected data from a child below the applicable age, we delete it without delay. Guardians may contact pushcrate.game@gmail.com.

9. Cookies and tracking

1. We do not use advertising or analytics tracking cookies.
2. Your sign-in token is held in browser memory only and disappears as soon as you close the tab.
3. We do not use third-party advertising networks.

10. How we protect your data

1. We never receive or store a password. Signing in happens at Google.
2. Sign-in attempts are rate-limited per IP and per account.
3. Administrator access uses separate authentication and re-confirms the administrator's Google identity before any sensitive action.
4. Every administrative action is recorded in a tamper-proof log.
5. Data is backed up regularly and backup integrity is verified.
6. Traffic is encrypted using HTTPS.

11. Data breaches

If a breach occurs we will notify the relevant supervisory authority within 72 hours of becoming aware of it, and inform affected users without undue delay where the breach is likely to result in a high risk to their rights and freedoms (GDPR Arts. 33 and 34).

12. Changes to this policy

We announce changes in the Service at least 7 days before they take effect — 30 days for significant changes. Where you have given us an email address, we may also notify you by email.

13. Contact and complaints

Privacy questions and requests: pushcrate.game@gmail.com

Republic of Korea: you may report concerns to the Personal Information Protection Commission (privacy.go.kr) or the Privacy Infringement Report Centre (privacy.kisa.or.kr, dial 118).

EEA / UK: you may lodge a complaint with your national data protection authority.