PRIVACY POLICY

Introduction

CrownForge LLC ("we," "us," or "our") operates CrownCade (crowncade.com) as part of the CrownForge family of products, which also includes Questwright (questwright.app) and other services. This Privacy Policy explains how we collect, use, and protect your personal information when you use CrownCade.

We believe in transparency. We collect only what we need to provide our Service, we don't sell your data, and we'll tell you exactly what happens with your information.

Information We Collect

Account Information

When you create a CrownCade account, we collect:

• Username: Your unique login identifier
• Display Name: How your name appears to others
• Email Address (optional): For account recovery, to warn you before an inactive account is deleted, and, only if you ask for it, to send you news (see Marketing email)
• Email preferences: Whether you asked for marketing email, and a record of when and how you turned each choice on or off
• Password: Stored securely using industry-standard hashing (bcrypt); never stored in plaintext
• Date of Birth: Used for age verification (COPPA compliance); stored securely and never displayed publicly

OAuth Login Data

If you sign in with Discord, Google, or Twitch, we receive:

• Discord: Your Discord ID, username, and avatar URL
• Google: Your Google ID, email, name, and profile picture
• Twitch: Your Twitch ID, username, and profile picture

We only request the minimum permissions needed. We do not access your friends lists, server memberships, messages, or any other data beyond basic profile information.

Profile and Gameplay Data

When you use CrownCade, we collect and store:

• Profile Data: Your public profile information including display name, level, XP, and achievement showcase settings
• Gameplay Data: Which games you play, play session duration, scores submitted, and achievements earned
• Ratings and Favorites: Games you rate or mark as favorites
• Comments and Reviews: Any comments, reviews, or other content you post about games

Uploaded Game Files

If you upload games to CrownCade as a developer or contributor, we store:

• Game Files: HTML, JavaScript, CSS, images, audio, and other assets that comprise your game
• Game Metadata: Title, description, genre, content rating, tags, and other information you provide about the game
• Upload History: Timestamps of submissions and updates

Developer applications

If you apply to publish games on CrownCade, we store your studio name, a contact email, your country (United States only), your confirmation that you are 18 or older and in the United States, which version of the Developer Agreement you accepted and when, whether we had a date of birth on file for you, and our decision with any note. We use it to review your application and to contact your studio. We keep it while your studio is active. If we decline your application or the studio is closed, we keep the record for 12 months, then remove the contact email and the decision note. If you delete your account and you're a studio's only owner, the studio is suspended. If the studio has another owner, it stays active without you, and if the studio's contact email was yours, we remove it.

Developer portal security log

We record security events on your developer account (sign-ins, setting up two-step sign-in, using or replacing recovery codes) with the time and a scrambled form of your IP address. We use it to protect your account and look into suspicious activity. We keep each entry for 12 months, then delete it. If a reviewer asks to reset your two-step sign-in after you lose your device, we also keep that request, with the note of how we checked who you are, for 12 months after it is done or canceled, then delete it. If you delete your account, a reset request about you or made by you is removed with it; if you had asked for someone else's reset and it was still waiting, they are told it was canceled. If you delete your account first, the entry stays until then without your account details.

Information Collected Automatically

• Session Data: We use a session cookie to keep you signed in. This contains a random token linked to your account and expires after 30 days of inactivity
• Log Data: Our servers log each request (the address requested, the result and the time) for security and debugging. These logs don't contain your IP address. We use your IP address only briefly, in memory, to limit repeated sign-in, sign-up and contact-form attempts, and then discard it. Our hosting provider, Cloudflare, sees your IP address when it passes your traffic to us, and the contact form sends it to Cloudflare Turnstile to check that you're not a bot.

Information We Do NOT Collect

How we learn from usage

To improve CrownCade, we record how the site is used: which pages you visit, which buttons and links you click, and roughly where on the page. We never record what you type, your passwords, or payment details.

These usage records are first party only. They are collected by our own code, stored on our own servers, and are not sent to any analytics company, advertiser or other third party. Our hosting provider, Cloudflare, counts anonymous page views for us, without cookies. Apart from that anonymous count, usage data never leaves our servers. We don't sell it, and we don't use it for advertising. We use it only to understand where people get stuck and to make CrownCade better. None of this uses tracking cookies.

Usage records are tied to your account while you're signed in, so we can follow one visit from start to finish. We keep them for 6 months, then delete them. When you delete your account, your usage records are deleted with it.

Contact form

If you write to us through the contact form, we keep the name, email address, subject and message you send, so we can read and answer it. We don't store your IP address with it. Only the CrownCade crew can see these messages. We keep them for 24 months after the last message, then delete them (see Data Retention).

How We Use Your Information

We use the information we collect to:

• Provide, operate, and maintain the Service
• Create and manage your account
• Track gameplay progress, scores, achievements, and XP
• Display public leaderboards and player profiles
• Host and serve games uploaded by developers
• Communicate with you about your account or the Service
• Email you news about CrownCade, or about other CrownForge products, only if you ask us to (see Marketing email)
• Detect and prevent fraud, cheating, abuse, and security incidents
• Improve the Service based on how it is used
• Comply with legal obligations

We do not sell your personal information. We do not pass your account data (email, name or date of birth) to advertisers or third-party marketers. We use your email address for our own marketing only if you opt in.

We keep a daily record of the minutes you spend in each game, linked to your account, for up to 24 months, then delete it. We use it to work out what we pay the developers who make the games and to check those payments. Developers see only monthly totals for their games, never which players played or for how long.

Marketing email

If you ask for it, we email you about new CrownCade features and events. Separately, if you ask for that too, we email you about other CrownForge products. Both are off unless you turn them on, when you sign up, when we first ask after you sign in, or in Settings. You don't need either to use CrownCade or to create an account.

We send this email only because you agreed to it (consent, under Article 6(1)(a) of the GDPR). You can withdraw at any time, for free: use the unsubscribe link in any marketing email, which needs no sign-in, or turn it off in Settings. Withdrawing takes effect immediately and doesn't affect emails about your account, such as password resets.

Resend, an email delivery provider, sends these emails for us (see Information Sharing). We don't share your email address with anyone else for marketing.

For each choice we record whether it was turned on or off, when, and how (when signing up, from the one-time question, in Settings, or through an unsubscribe link). See Data Retention for how long we keep it.

Information Sharing

We do not sell your personal information. We may share information only in these limited circumstances:

• Public Profiles: Your username, display name, level, achievements, high scores, season placements (a game's final rank for you in a season it ran), and a title a game gives you, such as your Riffkins Keeper title, are visible to other users on public leaderboards and profile pages
• Game Analytics (Developers): If you upload a game, other users can see public statistics about your game such as play counts, ratings, and favorites.
• Games with their own server: When you play a game that has its own server while signed in, we give that game a player ID made only for that game (so different games can't match you up by it), your public name and your level. We never give games your email, real name, username, date of birth, payment details or account number. If you delete your account, we tell each of those games, and they must delete what they hold about you within 30 days.
• Service Providers: A hosting provider runs our servers in the United States, a network provider carries traffic to them securely, and a backup provider in the United States stores an encrypted off-site copy of our backups. That copy is encrypted on our servers before it is sent, so the backup provider cannot read it. Resend, an email delivery provider in the United States, sends our emails: account emails such as password resets, and marketing email if you asked for it. Your email address and the message are passed to Resend to deliver it
• Advertising: When ads are shown, Google (through Google AdSense) receives what its ad code collects from your browser, such as your IP address, browser details and advertising cookies. We do not pass it your account data (see Advertising)
• Legal Requirements: We may disclose information if required by law, regulation, legal process, or governmental request
• Safety: We may share information when we believe in good faith that disclosure is necessary to protect the rights, safety, or property of CrownForge LLC, our users, or the public

Third-Party Games and Embedded Content

We take the following precautions:

• Games are served in sandboxed iframes where technically feasible
• Games are reviewed before publication
• Games that attempt to collect user data, set tracking cookies, or communicate with external servers without disclosure are prohibited and will be removed

If you believe a game on CrownCade is collecting data inappropriately, please report it to [email protected] immediately.

Third-Party OAuth Providers

When you sign in via Google, Discord, or Twitch, those services share limited profile information (name, email, user ID) with us per their own privacy policies. We only use this information to create and manage your CrownCade account. We do not access your contacts, messages, or other data from those services.

• Discord Privacy Policy
• Google Privacy Policy
• Twitch Privacy Notice

Advertising

CrownCade is supported in part by ads, and ads may be shown on the site. They come from Google AdSense. Google and its partners use cookies or similar technologies to serve ads, limit how often you see the same one, protect against fraud and measure how ads perform. Where personalized ads are allowed, they may also use cookies to personalize ads based on your visits to this and other sites.

• How Google uses this: Read How Google uses information from sites or apps that use our services.
• Opting out of personalized ads: Turn them off in Google's Ads Settings. You can also block or clear cookies in your browser settings. Ads can still be shown without personalization.
• EEA, UK and Switzerland: If you visit from the European Economic Area, the United Kingdom or Switzerland, when ads are shown you first see a consent message from Google's consent tool. You can say no to personalized ads there, and you can change your choice later.
• Signed-in users under 18: If the birthday on your account shows you are under 18, you see only non-personalized ads, and we ask Google to restrict how it processes data for the ad units we place. Google’s ad code can also request ads on its own from our pages. Those ads are non-personalized too, but we can’t ask Google to restrict them. Signed-out visitors are treated as a general audience aged 13 or older.
• US state privacy rights: Where state law gives you the right, you can opt out of the sale or sharing of your personal information for ads through the ‘Do Not Sell or Share’ link Google shows on our pages.
• Non-personalized ads still use cookies: They are used for frequency capping (not showing you the same ad too often), fraud prevention and measurement. They do not use your past visits to choose the ad.
• What we do not do: We do not sell your personal information. We do not pass your account data (email, name or date of birth) to Google or any advertiser.

Cookies

CrownCade uses the following cookies, plus advertising cookies when ads are shown:

• Session cookie (__Host-crowncade_session): Maintains your login state. Contains a cryptographically random token and expires after 30 days of inactivity
• OAuth state cookies: Temporary cookies used during the login process for security (CSRF protection). Deleted immediately after login completes
• Age check cookie (crowncade_age_check): Set for one day when the sign-up age check turns someone away
• Visitor cookie (crowncade_anon): A random visitor ID set for one year on game pages for signed-out visitors. It holds no personal information and is not used for tracking or advertising
• Advertising cookies: Set by Google AdSense and its partners when ads are shown, to serve, limit, protect and measure ads and, where allowed, to personalize them. They are not needed to sign in or play. See Advertising for how to opt out

Apart from these advertising cookies, we do not use tracking cookies, and we do not use third-party analytics cookies.

Data Security

We implement appropriate technical and organizational measures to protect your personal information:

• Passwords are hashed using bcrypt and never stored in plaintext
• Session tokens are cryptographically random
• CSRF protection on all form submissions
• HTTPS encryption for all communications
• OAuth tokens are securely managed and not stored long-term
• Database access restricted to essential services only
• Uploaded games are scanned and reviewed before publication

No system is 100% secure. While we take reasonable precautions, we cannot guarantee absolute security. If we become aware of a data breach affecting your personal information, we will notify affected users promptly.

Data Retention

We retain your data for the following periods:

Data Type	Retention Period
Account information	Until you delete your CrownCade account, or 6 months of inactivity (we email you at least 30 days before; accounts without an email address are kept)
Gameplay data (scores, achievements, XP)	Until you delete your account
Per-game player IDs	While your account exists. After you delete it, until the game confirms the deletion notice (at most 30 days), then 7 more days.
Uploaded game files	Until you remove the game or your account is deleted
Comments and reviews	Until you delete them or your account
Minutes played per game	up to 24 months, then deleted; also deleted with your account
Usage records (pages visited, buttons and links clicked; see "How we learn from usage")	6 months (automatically deleted); also deleted with your account
Marketing email choices and their history (when and how you turned each on or off)	While you have an account, so we can show that you agreed; deleted with your account
Support tickets and any bug report we made from one, contact form messages and help-bot answers	24 months after the last message, then deleted. A bug report we made from your ticket is also deleted when you delete your account. If the bug was published on our public Bug Board, or a newer ticket still refers to it, we keep only its public title, which our team writes and which contains nothing personal.
Developer application (studio name, contact email, country, attestation, decision)	While the studio is active. Declined or closed: 12 months, then the contact email and decision note are removed
Developer portal security log	12 months, then deleted
Server logs (address requested, result, time; no IP address)	Up to 45 days
Backups	Hourly backups for 48 hours, daily backups for 30 days, and weekly backups, with no backup kept for more than 6 months, kept on secured servers we operate, with an encrypted off-site copy stored with a backup provider in the United States. Data you delete stays in a backup only until that backup expires
Anonymized aggregate statistics	Indefinitely (cannot identify you)

Account Management and Deletion

Your CrownCade account is separate from your accounts on other CrownForge products, such as Questwright. Deleting one does not delete the others. When you delete your CrownCade account:

• Your CrownCade account, including your login details and any linked Google, Discord or Twitch sign-in, is permanently deleted and you are signed out
• Your CrownCade profile, XP, scores, achievements, favorites, ratings, and gameplay history are permanently deleted
• Games you uploaded will be removed from the platform
• Your comments, reviews, and other user-generated content are deleted
• Your marketing email choices and their history are deleted
• If you delete your account, we keep your support tickets and our replies, but we remove your name, email address, username and the link to your account wherever they appear, including in tickets you sent while signed out. Anything else you wrote in a ticket stays as you wrote it, so please don't include personal details, such as phone numbers or other people's names, that you don't want us to keep.
• Deletion from your profile page takes effect immediately; we complete deletion requests sent by email within 30 days
• A copy can stay in our backups for up to 6 months. We use backups only to recover from a technical failure, never to bring a deleted account back, and they are then erased.
• We keep a record of the deleted account's number and the time it was deleted, and nothing else about you except the support tickets described above
• We may retain anonymous, aggregated statistics (e.g., "X games were played") that cannot identify you

Your Rights

Depending on your jurisdiction, you may have the right to:

• Access: Request a copy of the personal data we hold about you
• Correction: Request correction of inaccurate data
• Deletion: Request deletion of your account and personal data
• Data Portability: Export your data in a portable format
• Object / Restrict: Object to or restrict certain processing of your data
• Withdraw Consent: Unlink OAuth accounts, turn off marketing email, or close your account at any time

You can delete your account yourself from your profile page. For any other request, contact us at [email protected].

Children's Privacy (COPPA Compliance)

CrownCade requires all users to be at least 13 years old. We verify age at registration and do not knowingly collect personal information from children under 13, in compliance with the Children's Online Privacy Protection Act (COPPA).

Our age verification measures include:

• Date of birth collection during account registration
• Age verification before OAuth-based account creation (Google, Discord, Twitch)
• Rejection of registrations from users under 13: no personal data is stored for rejected registrations

If we learn that a user is under 13, we close the account and delete the child's personal information. We keep payment and charge records without the child's details, for the periods above.

If you believe a child under 13 has provided us with personal information, please contact us immediately at [email protected].

Enhanced Protections for Users Ages 13–17

We apply additional data protections for users between 13 and 17 years of age:

• Data minimization: We collect only the minimum data necessary to provide the Service. We do not build behavioral profiles of minor users for marketing purposes.
• Non-personalized ads only: If the birthday on your account shows you are under 18, you see only non-personalized ads, and we ask Google to restrict how it processes data for the ad units we place. Google’s ad code can also request ads on its own from our pages. Those ads are non-personalized too, but we can’t ask Google to restrict them. Non-personalized ads still use cookies for frequency capping, fraud prevention and measurement (see Advertising).
• No data sharing: We do not sell personal data of minor users, we do not pass a minor's account data (email, name or date of birth) to advertisers, and we do not share it with any third party for marketing or commercial purposes.
• Public profile visibility: Minor users' profiles display only their chosen display name, level, and achievements on leaderboards. We encourage minor users to use a pseudonym rather than their real name.
• Parental access: Parents or legal guardians may contact us at [email protected] to review, correct, or delete their child's personal information at any time.
• Prompt deletion: Requests to delete a minor's account and data are prioritized and completed within 7 days.

Changes to This Policy

We may update this Privacy Policy from time to time. We will notify users of material changes by:

• Posting the updated policy on this page with a new effective date
• Displaying a notice on the Service when significant changes are made

Your continued use of the Service after changes take effect constitutes acceptance of the updated policy.

Jurisdiction

CrownForge LLC is operated from Pennsylvania, United States. By using our Service, you consent to the processing of your data in the United States. If you are accessing from outside the US, please be aware that your data may be transferred to and processed in the United States, where data protection laws may differ from those in your jurisdiction.

Contact