BloodCrimes Privacy Policy

Privacy Policy

BloodCrimes · Version 1.4 · Effective 2026-09-20

This document reflects the current implementation of the Game. Sections marked LEGAL_REVIEW_REQUIRED need confirmation from a qualified adviser.

1. Data Controller and Contact

The data controller for BloodCrimes is the operator of the Game ("BloodCrimes"). Contact: admin@bloodcrimes.pl. LEGAL_REVIEW_REQUIRED — confirm whether the operator's full identity and registered address must be disclosed under applicable law.

2. Categories of Data

We process the following categories of data:

  1. Account data (registered players): username, email address, password (stored as a salted hash), chosen display name, avatar.
  2. Guest account data: a generated guest identifier, a generated display name, and game progress associated with the guest account.
  3. Game progress data: levels, money, gold, respect, items, vehicles, properties, pets, messages, family membership, fight and race results.
  4. Technical data: IP address, browser and device information, dates and times of access (used for security and rate limiting).
  5. Analytics data (see section on GameAnalytics).

3. Purposes and Legal Bases

We process data for the following purposes and legal bases:

  1. Providing the service — necessary for the performance of the contract (Art. 6(1)(b) GDPR).
  2. Account security and fraud prevention — legitimate interest (Art. 6(1)(f) GDPR).
  3. Analytics (GameAnalytics) — based on consent where required (Art. 6(1)(a) GDPR); see section 12.
  4. Legal compliance — where we are legally obliged (Art. 6(1)(c) GDPR).

4. Registered Account

When you register, we store your username, email and a salted hash of your password, along with your game data. This data is necessary to provide and secure your account.

5. Guest Account

When you start in Guest Mode, we create a temporary guest account and store your game progress on it. Your progress is also stored locally in your browser (localStorage). Guest accounts may be deleted after a period of inactivity. See the Terms of Service, section 4.

6. Saving Progress

Game progress is stored on our servers (database) as part of your account or guest account. In addition, guest progress is mirrored to your browser's localStorage. Clearing your browser data may remove the local copy but does not remove the server-side guest record.

7. Technical Data and IP Addresses

We may process your IP address and access times to enforce rate limits, detect abuse and protect the service. These records are kept only as long as needed for security purposes.

8. Local Storage

The Game stores your language preference and (in Guest Mode) your guest token and progress in your browser's localStorage. This data stays on your device unless you clear it.

9. Cookies

The Game uses an authentication cookie to keep you signed in. We do not use third-party advertising cookies. LEGAL_REVIEW_REQUIRED — confirm cookie disclosure obligations for the authentication cookie.

9a. Partner recommendations and affiliate links

When the administrator explicitly enables the Affiliate System, BloodCrimes may show clearly labelled partner recommendations in selected editorial or recommendation areas. They are optional partner content, not gameplay rewards, system buttons or classic display advertising. Affiliate links may generate a commission for BloodCrimes without changing the price for you.

The system records aggregated campaign performance such as clicks, impressions, placement, country, language and audience type. If a partner requires third-party tracking, it is used only where the required consent exists; otherwise BloodCrimes uses a privacy-friendly link where possible. LEGAL_REVIEW_REQUIRED — confirm the final lawful basis, retention period and partner-specific consent requirements before activation.

10. Analytics — GameAnalytics

We use GameAnalytics to understand how the Game is played and to improve it. GameAnalytics may receive event data (such as game actions, progress, errors) and an identifier for analytics purposes. Where consent is required, analytics only starts after you consent. You may withdraw consent at any time (see section 12).

11. Cloudflare

The Game is served through Cloudflare. Cloudflare provides content delivery, DNS, DDoS protection and security features, and may process technical data (IP addresses, request logs) as part of this role. The underlying game data is stored with Cloudflare's D1 and R2 services.

12. Consent and Withdrawal

Where analytics is based on consent, you may give or withdraw consent. Withdrawing consent does not affect the availability of the Game. Your choice is remembered. LEGAL_REVIEW_REQUIRED — confirm whether GDPR requires a dedicated consent banner before GameAnalytics runs.

Affiliate System tracking is disabled by default. Any future non-essential cookies or third-party tracking must be connected to the applicable consent choice before activation.

13. Objection

Where we rely on legitimate interest, you may object to the processing of your data. Contact admin@bloodcrimes.pl.

14. Account Deletion

You may request deletion of your account at any time by contacting admin@bloodcrimes.pl. We will delete your account data (including game progress) within a reasonable time, except where we are required to retain data by law.

15. Email Communications / Newsletter

If you subscribe to BloodCrimes Gazette, we process your email address, user ID, preferred language, subscription status, consent and confirmation timestamps, and delivery outcomes such as sent, delivered, bounce, complaint and unsubscribe. The purpose is to operate the optional weekly Gazette newsletter, manage preferences, prevent delivery to suppressed addresses and demonstrate consent. Transactional account messages remain separate.

The Gazette uses a configured marketing email provider (currently Resend, when enabled) to process campaign and delivery data as a processor. Cloudflare Workers, D1 and Queues operate the consent and delivery ledger. Consent can be withdrawn at any time. Suppression records may be retained as necessary to prevent re-subscription and demonstrate compliance. Contact admin@bloodcrimes.pl for rights requests. LEGAL_REVIEW_REQUIRED — confirm the final controller identity, retention periods, provider agreement and lawful basis before production sending.

16. Retention Periods

Account and game data are retained while the account is active. Guest accounts may be removed after inactivity. Technical/security logs are retained for a limited period. Analytics data is retained in accordance with GameAnalytics' data retention policies.

17. Recipients and International Transfers

Data may be processed by service providers including Cloudflare (US/EU infrastructure) and GameAnalytics. Transfers outside the EEA, if any, rely on appropriate safeguards. LEGAL_REVIEW_REQUIRED — confirm the exact storage locations and transfer mechanisms of Cloudflare and GameAnalytics before making binding statements.

18. Your Rights

You have the right to access, rectify, erase, restrict, object to processing, data portability, and to withdraw consent. To exercise these rights, contact admin@bloodcrimes.pl.

19. Right to Lodge a Complaint

You have the right to lodge a complaint with a supervisory authority, in particular in the EU/EEA member state of your residence, place of work, or place of the alleged infringement.

20. Security

We use encryption in transit (HTTPS), salted password hashing, and Cloudflare security features to protect data. No method of transmission is 100% secure.

21. Children's Data

The Game is not directed at children under 13. We do not knowingly collect data from children under 13. If you believe a child has provided us data, contact admin@bloodcrimes.pl.

22. Profiling

We do not engage in profiling for automated decision-making that produces legal effects. Leaderboards and rankings are based on game performance only.

23. Changes to This Policy

We may update this policy. The current version and effective date are shown at the top of this document. Material changes will be noted in the version history.

24. Version and Effective Date

This document is version 1.4 and became effective on 2026-09-20.

25. History of Significant Changes

  1. 1.4 (2026-09-20): Clarified the separate marketing provider and Cloudflare ledger roles for Gazette delivery.
  2. 1.1 (2026-09-04): Rewritten to reflect the actual implementation (Guest Mode, D1/R2 storage, Cloudflare, GameAnalytics consent). Removed references to a non-existent newsletter and contact form. English default version added.
  3. 1.0 (earlier): Original document.