Privacy notice

Who we are

Crash! (playcrash.app) is operated by AlmostAnEngineer Ltd, the data controller for the personal data described here. You can reach us about anything on this page at daniel@almostanengineer.co.uk.

What we collect

• Email address — only if you sign in. We use it to email your 6-character sign-in code and, if you asked for them, occasional product updates.
• Player tag and display name — shown to the person you are playing against.
• Game data — your games, hands, melds and scores, so a game can be resumed on another device.
• A device identifier stored in your browser, so guest players keep their seat without an account.
• Game history — a move-by-move log of each round (which cards were drawn, melded and discarded, and the seat and display name that made the move), used to troubleshoot bugs and to improve the computer player.
• Analytics — aggregated usage statistics, only when you have accepted analytics in the cookie notice.

We do not collect payment details, we do not sell your data, and we do not use your data for advertising or automated decision-making.

Game history and the computer player

Every move in a game is logged so we can replay a round when something goes wrong, and so we can study how Crash! is actually played in order to make the computer opponent better. The log records card moves, the seat number and the display name shown at the table — never your email address, and nothing about you outside the game.

We rely on legitimate interests for this: keeping the game correct and improving how it plays. Any use for training or tuning the computer player is done on game data only, with display names stripped out, and no decision is made about you as an individual. Logs are kept while the game exists and are deleted with the game — deleting your account removes the history of your games as well. Your account export includes the history of every game you played. You can object to this use at any time by emailing us.

Why we can use it (lawful bases)

• Contract — running your account and your games.
• Legitimate interests — keeping the service secure and working.
• Consent — optional analytics and any marketing emails. You can withdraw consent at any time without affecting anything before that.

Cookies and local storage

Essential storage keeps you signed in and remembers your player key and card groupings — the game cannot work without it, so it needs no consent. Optional analytics storage is only used once you accept it. You can change your choice at any time on your account page.

To be clear about what happens today: Crash! sets no analytics or advertising cookies at all, and no analytics script is loaded unless you have chosen “Accept analytics”. Our hosting provider also counts page requests in aggregate on the server, which uses no cookies and cannot identify you.

How long we keep it

Sign-in codes are deleted within minutes of expiring. Games and scores are kept while your account exists so you can see your history. Delete your account and we remove your profile, your seats in games and your email from our systems.

Who processes it for us

We use a small number of processors under written terms: our cloud database and authentication provider (Supabase), our hosting and email delivery provider (Lovable), and our analytics provider. Data may be processed in the UK, the EEA or the United States under appropriate safeguards such as Standard Contractual Clauses.

Your rights

Under the UK GDPR and EU GDPR you can ask for access, correction, erasure, restriction, portability, or object to processing based on legitimate interests. Two of these are self-service: your account page lets you download everything we hold about you as a JSON file, and permanently delete your account. For anything else, email daniel@almostanengineer.co.uk and we will respond within one month.

If you are unhappy with our response you can complain to the UK Information Commissioner's Office (ico.org.uk) or your local supervisory authority.

Children

Crash! is not aimed at children under 13, and we do not knowingly collect their data. If you believe a child has signed up, email us and we will remove the account.