Privacy Policy
Crime City is a browser game. To run it we need an account for you, a record of what your character did, and enough technical detail to keep cheats and duplicate accounts out. We do not sell your data, we do not run advertising, and there is no third-party ad tracking on this site. This page says exactly what we hold and how to make us delete it.
Who runs Crime City
Crime City is an independent game operated by a small team under the name Crime City, at crimecity.fun. For anything in this policy — a question, a correction, a deletion request, or a complaint — write to support@crimecity.fun. That address is read by the people who run the game.
Age limit
You must be 18 or older to play Crime City. The game includes a casino, a market you can lose in-game money on, and a token that can be withdrawn and holds real-world value. It is not a game for children.
We do not knowingly collect anything from anyone under 18. If we find out an account belongs to someone under that age, we delete the account and everything attached to it. If you believe a minor has an account here, tell us at support@crimecity.fun and we will act on it.
What we collect
Grouped by why it exists, rather than by which system it happens to sit in.
| What | Detail | Where it comes from |
|---|---|---|
| Your account | Email address and a password, which is stored only as a cryptographic hash and is never readable by us or by anyone else. | You, when you register. |
| Social sign-in | If you sign in with Google, Discord or Facebook we receive the account identifier at that provider, your email address, and your name and avatar there. We keep the identifier and email; the name and avatar are overwritten with your in-game alias. | The provider, after you approve the sign-in. |
| Wallet | Your Solana wallet address, if you sign in with a wallet or connect one to Crime Bank. | You, by connecting the wallet. |
| Your character | Alias, avatar, and everything the character does: stats, money, crimes, fights, gang membership, property, and season history. | Generated as you play. |
| Optional profile fields | A short bio, gender, and country. All optional, all shown on your public profile, all free text you choose. | You, if you fill them in. |
| Messages | Chat messages in every channel, and the in-game inbox. Chat is screened automatically for scams before it is delivered. | You, when you send them. |
| Sign-in records | Your IP address and browser user-agent string, recorded when an account is created and each time it signs in. | Your browser, automatically. |
| Purchases | For each VIP purchase: the amount, the tier, your wallet address and the blockchain transaction identifier. Crime City takes no card or bank payments of any kind, so we never see and never store card numbers, bank details or billing addresses. | The blockchain, when payment confirms. |
| Analytics | Pages viewed, in-game actions, referring site, device, browser, approximate location from IP, and session recordings. | Your browser, automatically. |
| Error reports | Technical details of a crash and the page it happened on. Configured not to attach personal data. | Your browser or our server, on failure. |
Guest accounts hold less. Playing as a guest creates an anonymous account with no email and no password, and it is deleted automatically 48 hours later unless you claim it. Until you claim it we hold the character and the sign-in record, and nothing that identifies you personally.
Session replay
Our analytics provider, PostHog, records browser sessions on Crime City: what was on screen, where you clicked, and what you scrolled. We use these recordings to find broken screens and confusing flows.
Recordings capture text you type into the game — including chat messages and your email address on the sign-up form. Passwords are always hidden and are never captured, in any recording, under any setting. Recordings of the administration area are never made at all.
Recordings are stored by PostHog in the European Union and are deleted on PostHog's retention schedule. If you would rather not be recorded, most browsers' “Do Not Track” or tracker-blocking settings will stop the analytics script from loading, and the game works normally without it. You can also ask us to delete your recordings — see Deleting your data.
Why we hold it
Under the GDPR, every use of personal data needs a legal basis. Ours are:
- To provide the game you asked for (performance of a contract): your account, your character, your messages, your purchases. Without these there is no game to play.
- To keep the game fair (legitimate interests): the sign-in records above exist to detect players running several accounts to feed one character, and to detect banned players returning under a new name. This is the reason we keep IP addresses, and it is why those records outlive the seasonal wipe.
- To keep the game working and improve it (legitimate interests): analytics, session replay, error reports, rate limiting, and bot protection on the sign-up form.
- To meet legal obligations: keeping enough of a record of paid transactions to satisfy accounting and anti-fraud duties.
Where we rely on legitimate interests you have the right to object — see Your rights.
What is public
Crime City is a competitive game played in public. The following is visible to other players and to anyone on the internet, including search engines, without signing in:
- Your alias, avatar, level, rank, and the stats you have not hidden.
- Your gang, your position in it, and your place on the leaderboards.
- Your bio, gender and country, if you filled them in.
- Your season results, which stay published after the season ends.
Your email address, your password, your balances and your purchase history are never public and are never sent to a browser other than your own.
Search engines may keep copies of public pages after we delete them. We can remove a page from our site; we cannot remove it from someone else's cache or archive.
The blockchain is permanent
$CRIME withdrawals and crypto payments happen on the public Solana blockchain. Those transactions — the wallet addresses and the amounts — are public, permanent and outside our control. We cannot delete them, edit them or hide them, and neither can anyone else. That is a property of the blockchain, not a choice we made, and it does not change if you delete your Crime City account.
If you would rather not have your play linked to a wallet you use elsewhere, use a separate wallet for Crime City.
Who else sees it
We use the services below to run the game. They process data on our instructions and are not permitted to use it for their own purposes. We do not sell personal data, and we do not share it with advertisers or data brokers.
| Service | What it does for us | What it receives |
|---|---|---|
| Supabase | Accounts, sign-in, and the game database | Email address, password (hashed — never stored or visible in readable form), social account identifiers, wallet address, and every character record |
| Vercel | Hosting and delivery of the site | IP address and request details, in standard server logs |
| PostHog (EU region) | Product analytics and session replay | Pages viewed, in-game actions, device and browser details, and session recordings — see “Session replay” below |
| Sentry | Crash and error reporting | Error details and the page the error happened on. Configured not to attach personal data to reports |
| Resend | Transactional email | Email address and the contents of the message we send you |
| Upstash | Rate limiting and short-lived caching | Account identifier or IP address, held briefly to count requests |
| Cloudflare | Bot protection on the sign-up and sign-in forms | IP address and browser signals, assessed to tell a person from a script |
| Discord | Community server, support tickets, and role sync for linked accounts | Your Discord user ID and username, only if you connect a Discord account |
| Telegram | Community group | Nothing from your game account — the group is separate and you join it as yourself |
Google, Discord and Meta are not on this list as processors: when you sign in with one of them, that company is acting for itself under its own privacy policy, and we simply receive the result. We may also disclose data where the law requires it, or to investigate fraud, abuse or a threat to someone's safety.
How long we keep it
| What | How long |
|---|---|
| Your account and character | Until you ask us to delete it, or we close the account. |
| Unclaimed guest accounts | Deleted automatically 48 hours after creation, along with the anonymous account behind them. |
| Most in-game data | Wiped at the end of each season, when the world resets. This is a game mechanic, not a privacy measure — but the effect is the same. |
| Season results | Kept permanently, as the historical record of who won what. Published under your alias. |
| Chat messages | Deleted with the season they were sent in. |
| Sign-in records (IP, user-agent) | Kept across seasons, because multi-account abuse and ban evasion only become visible over time. Deleted with your account. |
| Purchase records | Kept as long as accounting and anti-fraud rules require, even after account deletion. The on-chain transaction is permanent regardless. |
| Analytics and session recordings | On the provider’s retention schedule, or until you ask us to delete them. |
| $CRIME balance | Survives the seasonal wipe by design — it is real value, and a new season does not take it from you. |
Your rights
If you are in the UK or the European Economic Area, you have the right to:
- ask what we hold about you, and get a copy of it;
- have inaccurate details corrected;
- have your data deleted — see Deleting your data;
- ask us to restrict how we use it, or object to uses based on legitimate interests;
- receive your data in a portable form;
- complain to your national data protection authority.
Exercise any of these by writing to support@crimecity.fun from the address on your account, or by opening a ticket in our Discord if your account has no email. We answer within 30 days. We may ask you to prove the account is yours — an account takeover dressed as a data request is a real risk, and checking is how we protect you from it.
Security
Passwords are hashed by our authentication provider and are never stored in readable form. The whole site is served over HTTPS. Database access is restricted at the row level so one player's browser cannot read another player's data, and administrative tooling is limited to the people who run the game and is excluded from analytics and session recording.
No system is perfectly secure. If you find a vulnerability, tell us at support@crimecity.fun before telling anyone else, and we will work with you.
Where data is processed
Analytics and session recordings are held in the European Union. Other services in the list above may process data outside the European Economic Area, including in the United States. Where that happens, transfers rely on the European Commission's standard contractual clauses or an equivalent safeguard offered by the provider.
Changes to this policy
When this policy changes in substance we update the date at the top of the page, and we announce it in our Discord. Continuing to play after a change means you accept the updated policy. If a change would materially widen what we collect, we will say so plainly rather than quietly editing a sentence.