Cratefall Arena
Privacy Policy
Last updated 4 September 2026
Cratefall Arena is a browser game. This page describes exactly what it stores, why, and what you can do about it. It is written to be read, not to be endured.
The short version. You can play the entire game without an account and without giving us anything. If you sign in with Google we keep your email, your display name, and a list of the cosmetic items you own — nothing else. We show Google ads, we run no analytics, we do not sell your data, and we never see your payment card.
Who we are
Cratefall Arena is operated by the developer of this site (“we”, “us”). For any privacy question, or to ask us to delete your data, contact cbrollins11@gmail.com.
What we collect
If you play without signing in
Your browser generates a random identifier and keeps it in
localStorage. It is not linked to you, your email or your device —
it is just a number that lets the server remember which skins you have earned.
Clearing your browser data deletes it permanently, and with it the skins tied
to it.
If you sign in with Google
Google tells us three things: your account identifier, your email address and
your display name. We ask for nothing else — the scopes we request are
openid, email and profile. We never
receive your Google password, and we cannot read your Gmail, contacts, files or
anything else in your Google account.
| What | Why |
|---|---|
| Account identifier (stored only as a one-way hash) | To recognise you across devices without keeping the raw Google id |
| Email address | Shown to you so you know which account you are on; used to contact you about your account |
| Display name | Shown on the join screen |
Session record: a random session id, a hash of your browser's User-Agent, a coarse network location (e.g. 203.0.113), and timestamps | To keep you signed in, and to refuse a session cookie replayed from a different browser |
What the game itself stores
| What | Notes |
|---|---|
| Cosmetic items you own, and how you got each one | Earned by playing, opened from a crate, or bought from another player |
| Which skin and effect you have equipped | |
| Your in-game currency balance | Zero unless you buy currency |
| Number of times you have joined, and when you were last seen | |
| Marketplace listings you create | Item, price and your account id, until the listing sells or is cancelled |
| A transaction ledger | Every currency movement, so balances can be audited and disputes resolved |
Your score is not stored. It exists only for the length of a match and is discarded when you die or leave. Nothing about how you played — position, aim, kills — is written to disk.
Anti-cheat
While you are in a match the server measures aiming statistics (how far your aim moves between frames, how often shots connect) to detect automated play. This lives in memory and is discarded when you disconnect. If a session scores above our threshold, a short summary — your name, account id and the statistics — is written to the server log for a human to review. We do not record your screen, your inputs, or anything outside the game.
Server logs
Our host records ordinary web server logs, including IP addresses, for security and debugging. These rotate automatically.
Cookies
One cookie, cf_session, set only if you sign in. It is
HttpOnly (page scripts cannot read it), SameSite=Lax,
and marked Secure over HTTPS. It holds a random session identifier
and nothing else.
We run no analytics and set no tracking cookies of our own. Google's advertising script, described below, sets its own cookies and reads device identifiers to serve and measure ads and to limit how often you see the same one. We cannot read those cookies, and they are governed by Google's policies rather than ours.
Payments
If and when currency purchases are enabled, they are handled entirely by Stripe. You enter your card details on Stripe's own page, on Stripe's domain. Your card number never reaches our servers and we never store it. Stripe tells us only that a payment succeeded, for which item, and for which account.
Advertising
After dying you may optionally watch a video advertisement to recover part of your experience. Watching is always your choice, and declining costs you nothing but the experience itself. There are no ads anywhere else in the game — no banners, no ads between rounds, nothing that interrupts play.
Those ads are served by Google AdSense (H5 Games Ads). To make that possible, Google's advertising script loads on the game page whether or not you ever choose to watch an ad. Google may use cookies and device identifiers to select ads, measure whether they were seen, cap how often they repeat, and detect fraud. Depending on your settings and where you live, ads may be personalised — chosen using data Google holds about you from outside this game.
Your controls. You can turn off personalised advertising for your Google Account at My Ad Center, and read how Google uses data from sites that show its ads at policies.google.com/technologies/partner-sites. In the UK and EU, Google shows its own consent prompt before setting advertising cookies. Blocking the ad script does not lock you out — the game falls back to a placeholder and stays fully playable.
We are paid per ad viewed. We never send Google your email address, your account identifier, or anything about what you own in the game.
If you are playing Cratefall Arena on a third-party games portal rather than on cratefall.io, that portal serves the ads through its own system and its privacy policy applies to them, not this one.
Who we share data with
We do not sell your data. We do not send any account information to advertisers — but note that Google's ad script, like any ad script, receives your IP address and browser details simply by loading. We use these services to run the game:
- Google — sign-in, if you choose to use it; and AdSense, which serves the optional rewarded ads
- Fly.io — hosting; your data is stored on their infrastructure
- Stripe — payment processing, if purchases are enabled
We may disclose data if legally required to do so.
How long we keep it
- Account and items — until you ask us to delete them
- Sessions — 30 days from last use, then automatically deleted
- Transaction ledger — retained for accounting and fraud investigation, typically several years
- Match data — never written down at all
Your choices
- Play anonymously. Sign-in is optional; the whole game works without it.
- Sign out everywhere. The join screen has a control that ends every session on every device at once.
- Delete your account. Email us and we will remove your profile and items. We keep the minimum required transaction records where money was involved.
- Get a copy of your data. Ask and we will send you what we hold.
If you are in the UK, EU or a similar jurisdiction, you have rights to access, correct, delete, restrict and port your data, and to complain to your data protection authority. Our basis for processing is the legitimate interest of running the game and, for sign-in, your consent.
Children
This game is not intended for children under 13, and we do not knowingly collect data from them. If you believe a child has given us data, email us and we will delete it. If you are under 18, do not make purchases without permission from a parent or guardian.
Where your data lives
Our servers are in the United States. If you play from elsewhere, your data is transferred there.
Changes
If this policy changes materially we will update the date at the top and, for significant changes, note it on the join screen.