CRATEMARKET PRIVACY POLICY
Effective Date: 22 August 2026 Last Updated: 22 August 2026
CrateMarket respects your privacy.
This Privacy Policy explains how CrateMarket, operated by HSN ("CrateMarket," "we," "us," or "our"), collects, uses, stores, protects, shares, and deletes personal data when you use the CrateMarket website, mobile applications, game services, accounts, marketplace, Global Chat, VIP Membership, and related services.
By using CrateMarket, you acknowledge that your information will be handled as described in this Privacy Policy.
1. Scope
This Privacy Policy applies to personal data processed through CrateMarket, including:
- the CrateMarket website
- Android application
- iOS application
- account services
- Global Chat
- marketplace
- VIP Membership
- Support & Feedback
- account security
- production monitoring and security systems
Third-party services such as Apple, Google, or payment providers may separately process information under their own privacy policies.
2. Information We Collect
The information we collect depends on how you use CrateMarket.
Account Information
We may process information such as:
- internal user/account ID
- email address
- authentication provider
- account creation date
- authentication state
- Display Name
- account settings
We do not need to know your password.
Passwords and authentication credentials are handled through secure authentication systems.
Authentication Information
When you use supported authentication providers such as Google or Apple, we may receive information needed to create and authenticate your CrateMarket account.
This may include:
- provider identifier
- verified email address where made available
- authentication status
CrateMarket does not receive your Google or Apple account password.
Display Name
Your selected Display Name is public within parts of CrateMarket.
It may appear in areas such as:
- Global Chat
- marketplace
- Global Leaderboard
- Player Status
- other multiplayer/community interfaces
Do not use a Display Name containing private information you do not want other players to see.
3. Gameplay Data
We process gameplay information necessary to operate CrateMarket.
This may include:
- Coin balance
- inventory
- crates
- item ownership
- progression
- statistics
- marketplace activity
- listing history
- settings
- game preferences
- Dynamic Market interaction state
- watched items
- notification preferences
- Global Leaderboard information
- VIP entitlement status
This information is associated with your CrateMarket account where necessary to synchronize gameplay across devices and platforms.
4. Marketplace Data
When you use the CrateMarket marketplace, we may process:
- seller account ID
- buyer account ID
- Display Name where needed for public presentation
- listing information
- virtual item or crate
- quantity
- virtual Coin price
- transaction status
- marketplace timestamps
- escrow state
- transaction identifiers
Marketplace information is used to complete transactions, prevent fraud, maintain economy integrity, provide history, and resolve technical problems.
5. Global Chat Data
If you use Global Chat, we process the messages you choose to submit.
Global Chat messages may be visible to other CrateMarket players.
We may also process:
- sender account ID
- Display Name
- message timestamp
- reply relationship
- moderation status
- report information
Messages may be reviewed where necessary for moderation, safety, abuse prevention, or legal compliance.
6. Player Reports
If you report another player's Global Chat message, we may process:
- your internal account ID
- reported player ID
- reported message
- selected report reason
- optional details you submit
- time of report
- moderation outcome
Reports are available only to authorized moderation/administrative systems as appropriate.
See Section 30 for role-restricted staff access and auditing.
7. Player Blocking
When you block another player in Global Chat, we store the relationship needed to enforce that preference.
This may include:
- your internal user ID
- blocked player's internal user ID
- time the block was created
A blocked player is not normally informed that you blocked them.
Block relationships are tied to account IDs rather than Display Names.
8. Support Information
When you contact Support & Feedback, we may process:
- account information
- contact email
- ticket category
- subject
- message
- support history
- administrative response
- relevant technical information
Please do not include passwords, payment-card details, or other unnecessary sensitive information in support tickets.
9. Subscription and Payment Information
When you purchase or manage VIP Membership, payment processing may be performed by Apple, Google, or another authorized payment provider.
CrateMarket may process information such as:
- subscription provider
- product/plan identifier
- transaction reference
- purchase state
- subscription state
- verification state
- entitlement state
- renewal or expiry information
CrateMarket should not store full payment-card numbers or CVV information in its game database.
Payment providers may independently process payment information according to their own policies.
10. Security Information
We may process security-related information needed to protect accounts and CrateMarket.
This may include:
- authentication security events
- suspicious activity
- abuse attempts
- rate-limit events
- account security changes
- administrative security actions
- fraud indicators
- technical request identifiers
Security records are used to protect users, prevent unauthorized access, investigate abuse, and maintain the integrity of CrateMarket.
11. Operational and Error Monitoring
CrateMarket uses operational monitoring to identify crashes, failures, performance problems, authentication issues, payment-verification problems, database errors, and similar reliability issues.
Monitoring may include:
- platform
- application version
- feature
- operation
- sanitized error code
- sanitized technical error message
- request/correlation identifier
- operation duration
- success/failure result
- authenticated or guest state
- internal privacy-safe user reference where genuinely necessary
Monitoring is designed to collect technical reliability information, not unnecessary player content.
12. Information We Do Not Intentionally Store in Operational Monitoring
CrateMarket's generic operational monitoring is designed not to store:
- passwords
- password hashes
- access tokens
- refresh tokens
- session JWTs
- OAuth authorization codes
- Google authentication tokens
- Apple authentication tokens
- payment-provider secret keys
- Supabase service-role credentials
- full card numbers
- CVV
- bank-account credentials
- raw authorization headers
- raw session cookies
- CAPTCHA secrets
- full Global Chat message content
Technical error information is sanitized where practical before storage.
13. Why We Use Your Information
We may use information to:
- create and maintain your account
- authenticate you
- synchronize gameplay
- operate inventory and crates
- maintain Coins and game progress
- provide Dynamic Market functionality
- operate the marketplace
- process marketplace transactions
- provide Global Chat
- enforce blocks
- handle reports
- provide moderation
- provide VIP entitlement
- verify purchases
- deliver support
- send account/security messages
- maintain leaderboards
- prevent fraud
- detect exploits
- prevent abuse
- protect accounts
- monitor service reliability
- diagnose technical problems
- improve performance
- comply with legal obligations
- exercise or defend legal rights
We seek to process only information reasonably necessary for these purposes.
14. Legal Basis and Authorization
Depending on applicable law and the circumstances, personal data may be processed because:
- it is necessary to provide the Service you requested
- you provided consent where required
- processing is necessary to protect security or prevent fraud
- processing is necessary to comply with legal obligations
- processing is necessary to establish, exercise, or defend legal rights
- another lawful basis applies
Where consent is legally required, you may have rights regarding that consent under applicable law.
15. Public Information
Some CrateMarket information is intentionally public to other players.
Examples include:
- Display Name
- Global Chat messages
- applicable leaderboard information
- marketplace listing information
- applicable Player Status information
Do not submit information to public features that you do not want other players to see.
Your email address is not intended to be shown publicly as your normal CrateMarket identity.
16. Service Providers
We may use trusted third-party providers to operate CrateMarket.
These may include services for:
- database hosting
- authentication
- website/application hosting
- email delivery
- app distribution
- payment processing
- infrastructure
- security
For example, CrateMarket currently uses Supabase for important backend/database/authentication functionality and may use Resend for applicable transactional email services.
Apple and Google may process information when you use their authentication, application-distribution, or payment systems.
Service providers should receive only the information reasonably required to provide their service.
17. International Processing
CrateMarket's infrastructure providers may process or store information in countries other than the country where you live.
Where applicable law requires safeguards for international or cross-border processing, we take reasonable steps to use appropriate providers and safeguards.
18. Data Retention
We retain personal information only for as long as reasonably necessary for the purpose for which it was collected, subject to legal, security, financial, dispute, and technical requirements.
Different information may have different retention periods.
For example:
Active Account Data
Usually retained while your account remains active and as reasonably necessary to provide CrateMarket.
Gameplay Data
Usually retained while required to maintain your account and game progress.
Global Chat and Moderation Records
May be retained for community operation, moderation, abuse prevention, reports, and security.
Payment and Transaction Records
May be retained where necessary for accounting, reconciliation, refunds, fraud prevention, disputes, or legal requirements.
Security Records
May be retained for a reasonable period where required to protect CrateMarket or investigate abuse.
Operational Monitoring
Detailed monitoring information is subject to limited operational retention and may later be deleted or aggregated.
Deleted Accounts
Account-owned data is deleted or anonymized according to the Account Deletion process, while limited records may remain where legitimately required for security, financial, dispute, or legal purposes.
19. Account Deletion
You can request permanent CrateMarket account deletion through:
Account & Security → Delete Account
The process requires explicit confirmation and may require recent authentication.
When deletion completes, CrateMarket removes the active authentication account and associated account-owned game data according to the deletion process.
This may include:
- profile
- Display Name association
- Coins
- inventory
- crates
- progression
- current marketplace listings
- settings
- active game entitlement
Certain shared or legally necessary records may instead be anonymized or retained in limited form.
See Section 32 for the distinction between eligible game-history deletion, anonymization, aggregation, and required retention.
20. Your Privacy Rights
Depending on the laws applicable to you, you may have rights concerning your personal data.
These may include rights to:
- receive information about processing
- access personal information
- correct inaccurate information
- request deletion where applicable
- restrict certain processing
- object to certain processing
- request portability where applicable
- withdraw consent where processing depends on consent
- submit a privacy complaint to an appropriate authority
These rights may be subject to lawful exceptions.
To make a privacy request, contact:
For security-sensitive requests, identity verification may be required before information is provided or changed.
21. Account/Profile Correction
Certain information can be corrected through CrateMarket's Account & Security interface where supported.
For other correction requests, contact Support.
22. Security Measures
We use reasonable technical and organizational measures designed to protect information.
These may include:
- authenticated access controls
- Row Level Security
- restricted backend functions
- database permissions
- encrypted network communication
- secure service credentials
- monitoring
- rate limiting
- administrative access restrictions
No online service can guarantee absolute security.
If you identify a potential security vulnerability, contact:
23. Data Breaches
If CrateMarket becomes aware of a personal-data security incident, we will evaluate and respond to it according to the circumstances and applicable legal requirements.
Where legally required, affected users or relevant authorities may be notified.
24. Children and Minors
CrateMarket is not intended to be used in violation of applicable age or child-protection requirements.
Users who are not legally able to agree to these Terms independently should use the Service only with the permission of a parent or legal guardian where legally permitted.
We do not knowingly seek unnecessary sensitive personal data from children.
Community and Global Chat use remains subject to the Community Guidelines.
25. Cookies and Local Device Storage
CrateMarket may use browser or application storage technologies necessary for functionality, for example:
- authentication/session management
- player settings
- application state
- security
- performance
- user-interface preferences
Account-authoritative game data is stored through the backend where required for cross-platform synchronization.
We do not intend to use local storage as a substitute for server-side legal acceptance or important account records.
26. Notifications and Email
We may send transactional or security-related communications such as:
- email confirmation
- password reset
- account security notices
- support-related messages
- account deletion confirmation where supported
- other necessary service communications
Operational Critical Error emails are intended for administrators, not normal players.
27. No Sale of Personal Data for Advertising
CrateMarket does not intend to sell player personal data to advertisers.
If CrateMarket's business model changes in a way that materially changes how personal data is used, the Privacy Policy must be updated and any legally required consent obtained.
28. Changes to This Privacy Policy
We may update this Privacy Policy when CrateMarket changes or when legal, technical, security, or operational requirements change.
The current document will show its Effective Date and Last Updated date.
Where a material update requires renewed acknowledgment or consent, CrateMarket may require you to review the new Privacy Policy before continuing to use the Service.
29. Contact Us
For privacy questions, data requests, general support, or account assistance:
For security matters:
CrateMarket / HSNDev United Arab Emirates
30. Authorized Staff Access and Accountability
Authorized Moderator, Admin, and Owner roles may access only the information reasonably required for functions their current backend role permits. Role descriptions do not expand technical access.
- Moderators may access community reports, Global Chat, Display Name, active listing, restriction, and moderation-history information reasonably required for authorized safety and enforcement work.
- Admins may additionally access player, support, virtual-asset, Marketplace, entitlement, operational, and audit information reasonably required for authorized corrections, investigations, and account administration.
- The Owner may access protected configuration, legal-document, release, security, retention, economy, and administrative records where necessary for owner-authorized functions.
Protected staff access is role-restricted and may require an active session, MFA, a reason, and an audit record. Staff must protect confidential player information, avoid conflicts and retaliation, use only assigned permissions, and preserve required evidence. The owner may investigate misuse and remove staff access.
31. Complimentary VIP and Subscription Records
When a player activates complimentary VIP, CrateMarket may process the internal account ID, entitlement source, campaign version, activation time, optional end time, revocation time and reason, idempotency reference, legal-acceptance state, and a security or audit event.
Complimentary activation does not require payment-card information and must not create a fake Apple transaction ID, Google purchase token, payment intent, invoice, receipt, charge, refund, renewal, or paid-subscription record. If a player later makes a real purchase, the applicable provider and verified transaction data are processed separately as described in Section 9.
32. Eligible Game-History Deletion and Retention
Account-owned gameplay records that are no longer required may be deleted with the account or anonymized so they are no longer linked to the player. This may include eligible progress, inventory, unopened crates, settings, private statistics, active entitlements, and other account-owned game state.
Some records cannot always be removed immediately or completely. CrateMarket may retain or anonymize the minimum information reasonably required for shared Marketplace history, other players' transaction integrity, payment and accounting obligations, refunds, chargebacks, fraud prevention, moderation evidence, disputes, security, rate limiting, legal compliance, and administrative audit integrity.
Retention decisions remain limited to legitimate purposes. The owner may authorize deletion of eligible operational history subject to required legal, financial, security, dispute, and audit retention. Existing data-subject rights and lawful exceptions in Section 20 remain unchanged.