Privacy policy

Only what the game and billing need. Nothing else.

Account

Your email address, the display name you choose and a hashed password (we never see or store the password itself). If you sign in with Google we get your Google account id, name and email instead of a password.

Guest id

When you press Begin without an account we create a guest record with a random id, no email and no name, so your progress survives a reload. If you later create an account, the guest progress moves to it.

Sessions

A session record for each sign-in: a random token (in a cookie), when it expires, and the IP address and browser user agent it was created from. We use these to keep you signed in and to spot abuse.

Play data

For each case you start: when you started, hints used, your one accusation (suspect, motive and the two evidence cards), the verdict, score and time taken.

Public verdicts

Each verdict gets a share link (/v/...). It shows the case, your score, time and hints, and your display name if you have an account. It never shows the solution. Guests appear as "A detective".

Billing

If you pay: the payment provider (Paddle), its customer, subscription and transaction ids, your plan, renewal date, whether you cancelled, and the cases you bought. Card and UPI details go straight to Paddle and never touch our servers. To open the checkout we send Paddle your account email, so the receipt reaches you.

IP for rate limits

Your IP address is used to limit how often guest accounts can be created and accusations made, and how often anyone can sign in, sign up, reset a password or be sent a verification email. We never store the address itself: the count is kept under a one-way keyed hash of it, and deleted soon after its limit window (at most an hour) ends.

Country

Our host tells us which country a request comes from. We use it only to pick which prices to show: rupees in India where rupee prices are available, US dollars elsewhere. We do not store it.

On your device

Your browser's local storage keeps a few things for you: the cards you pin to your notebook and the objections you raise, kept separately for each player and each case and wiped when you sign out or delete your account; an anonymous guest id, so a guest who creates an account keeps their notes; whether Skim mode and sound are on; whether you have seen the opening intro and the first-time hint; and which floor renderer you picked, if you switched it. They stay on your device and are never sent to us. Clearing this site's data in your browser removes them.

Email

If you ask for email verification or a password reset, we send that email through Resend.

Share buttons

When you press a share button we add one to a daily total for that button (for example "WhatsApp, from a verdict, today"). Nothing else is kept: no account, no cookie, no link, and no IP address is stored (it is held in memory for a minute to stop one browser inflating the totals, like the other rate limits). The X, WhatsApp, Facebook, Reddit, Threads, LinkedIn and Telegram buttons are plain links to those sites' own share pages; nothing of theirs loads on Crimefloor until you press one, and what you post there is under their policies.

We do not run ads, analytics, tracking pixels or third-party trackers (the share-button totals above count presses, not people), and we do not sell or share your data for advertising.

• To provide the game and your account (GDPR Art. 6(1)(b), contract): guest ids, accounts, sessions, play data and verdict links.
• To take payment for Pro (contract, and legal obligation for tax and accounting records): billing ids and the payment provider's records.
• To keep the service safe and fair (legitimate interests): IP addresses for rate limits, session IP and user agent to spot abuse, country for regional pricing.

Under India's Digital Personal Data Protection Act 2023 we process your data on the basis of the consent you give when you start a case or create an account, and for the legitimate uses the Act allows (such as the service you asked for). You can withdraw consent at any time by deleting your account; this does not undo processing that already happened.

A small number of providers process data for us, only to run Crimefloor:

Vercel

Hosting and content delivery. Sees every request, including your IP address and country.

Neon

Our Postgres database. Stores accounts, guest ids, sessions, play data and billing ids.

Paddle

Payments (cards, UPI, PayPal and wallets), subscriptions, invoices and receipts, tax and card updates, as our merchant of record: Paddle is the seller of record for every purchase. Paddle is also an independent controller for payment and tax data.

Resend

Sends account emails (verification and password reset).

Google

Only if you choose Sign in with Google.

Some of these providers process data outside your country, including in the United States. Where GDPR applies, those transfers rely on the European Commission's standard contractual clauses or an adequacy decision.

• Account, play data and billing ids: until you delete your account.
• Sessions: until they expire (about 7 days after your last visit) or you sign out; expired sessions are then deleted.
• Rate-limit counters (a keyed hash of your IP address, never the address itself): deleted soon after their limit window (at most an hour) ends.
• Guest records: until the guest is linked to an account, or deleted automatically once the guest's session has expired (a guest can only be reached through that session). Its verdicts stay, anonymous.
• After you delete your account, your verdict links keep working but are anonymous: the name and the link to you are gone.
• Paddle keeps invoices and payment records for as long as tax and accounting law requires.

You can do the two most common things yourself, any time, on your account page:

• Download your data as a JSON file (access and portability).
• Delete your account, which removes your user record and sessions and anonymises your play history (erasure).

Under GDPR you can also ask us to correct your data, restrict or object to processing, and you can complain to your local data protection authority. Under the DPDP Act you can ask for a summary of your data and who it is shared with, correction and erasure, nominate someone to act for you if you die or cannot act, and have a grievance addressed. If we do not resolve a grievance you can take it to the Data Protection Board of India.

To use any right that is not in the app, email hello@crimefloor.com. We reply within 30 days.

For complaints about how your personal data is handled, write to the Crimefloor Grievance Officer at grievance@crimefloor.com. Tell us the email on your account (or that you played as a guest) and what went wrong. We acknowledge every grievance and aim to resolve it within 30 days.

We use only the cookies needed to keep you signed in (the session cookie and short-lived cookies used during sign-in). They are strictly necessary, so there is no cookie banner. No advertising, analytics or tracking cookies. Paddle sets its own cookies in its checkout (which opens over our page) and its card-update page, under its own policy.

Crimefloor is a mystery game and is not meant for children under 13. Do not use it if you are under 13, or under the minimum age for online services in your country. In India, anyone under 18 may use Crimefloor only with the consent of a parent or lawful guardian. If you believe a child has given us data without that consent, email hello@crimefloor.com and we will delete it.

Traffic is encrypted with HTTPS, passwords are hashed, payment details stay with the payment provider, and we collect as little as we can. If a breach affects your data we will tell you and the authorities as the law requires.

If this policy changes we update the date at the top, and for important changes we tell signed-in players in the app. The data controller is Crimefloor, an independent project by github.com/satvikpathak. Questions: hello@crimefloor.com. See also the terms and the refund policy.