Privacy policy

Who is responsible

Eugene Vasev. Questions, access and deletion requests: support@crcsn.com.

What is stored, why and for how long

• Guest profile. When you enter a room, the server creates a guest: an ID, a nickname (up to 24 characters), a hash of a secret key and a ban mark if there has been one. The key itself stays only in your browser and lets the server recognise you when you come back. Kept with no time limit, deleted on request.
• Playing in Telegram. If you open the game inside Telegram (via the @crcsn_bot bot), Telegram passes signed data about your account to the server. The server checks the signature and keeps only your Telegram account ID in the guest profile, so you are the same player on every device in Telegram. The name from your Telegram profile is only suggested in the name field, and you can change it. Photos, phone numbers and messages are not passed on.
• Notification subscription. If you turn on the “Someone wants to play” notification in the settings, the server keeps your browser’s subscription address and the keys for encrypting notifications (issued by the browser), your language and your guest ID, so that you are not notified while you are playing yourself. Notifications are delivered by your browser’s notification service (Google for Chrome, Mozilla for Firefox, Apple for Safari), and their text is encrypted. The subscription is deleted when you turn it off (in the settings or with the “Stop these” button) or when the browser reports that it is no longer valid.
• Rooms. Seats, player names, guest IDs and the move log of the current game, so the game can go on after a lost connection or a server restart. Deleted 30 days after the room last changed.
• Chat messages. Text, nickname, colour, channel (players or spectators), time and a hash of the sender’s IP address (SHA-256 with a secret salt, the address cannot be recovered from it). The hash is used for moderation and spam protection. Deleted after 90 days.
• Archive of finished games. Final map, scores, move log, player names and guest IDs at the table, so the game can have its own link. Kept with no time limit. The chat shown in the archive comes from chat messages and disappears with them after 90 days.
• Chat reports. Who reported whom, the message and the reason, plus the last 30 messages of the room for context (without IP hashes). Not deleted automatically; deleted on request.
• Your IP address in plain form exists only in the server’s memory, to limit request rates (for example, no more than 20 new rooms per hour from one address). It is never written to disk and is gone after a server restart.
• Country by IP address is looked up on the server in a local DB-IP database: to send players in Russia to the mirror and to show the flag of your country next to your name to others in the room. You can hide the flag in the game settings - then it is not passed to others. The country is not sent anywhere else and not stored.
• Technical logs. Logs of the crcsn.ru relay and of the TURN server used for voice may contain IP addresses and connection times. They are kept for a limited time and deleted by rotation.

Voice and video

Voice and video chat only runs if you switch it on yourself with the button in the room. Before that, your browser asks for microphone and camera permission, which you can revoke in the browser settings. Without it, the game uses neither the microphone nor the camera.

Until you turn on your microphone or camera, you hear others only through the project’s TURN server: they see its address, not yours. Once you turn on the microphone or camera, audio and video travel directly between players or, when a direct connection fails, through the TURN server. With a direct connection, the people you talk to can technically see your IP address. The stream is encrypted (DTLS-SRTP), never recorded or stored; the TURN server only passes it on.

What other players see

Players and spectators in a room see your nickname, colour, moves and chat messages. Anyone who has the link to an archived game can open it and see player names and the result.

If you look for opponents in a quick game, the @crcsn_bot bot may announce your table in the public community chat on Telegram: it shows the nicknames of those at the table and the chosen expansions. When the game starts, the announcement gets a button to watch it as a spectator, and when it ends - the players’ nicknames and scores and a link to the game record; if the table empties before the game starts, the announcement is deleted. Games with friends (your own room) are never announced.

Who else processes data

Data is never sold or shared. It is processed only by the hosting providers that run the servers:

• main server and database: Hetzner, Germany;
• relay for players in Russia: a Timeweb VPS in Russia, which forwards traffic to the main server and stores nothing except logs;
• DNS: Cloudflare, without proxying, so site traffic does not pass through Cloudflare.

Legal basis

Under the GDPR: providing the service you ask for, such as rooms, chat and the game archive (Art. 6(1)(b)), and legitimate interest in moderation and abuse protection: the IP hash, rate limits, reports and logs (Art. 6(1)(f)).

Your rights

You can ask what data about you exists, have it corrected or deleted, restrict or object to its processing, and complain to a data protection authority.

There is no personal account, so everything goes by email: write to support@crcsn.com with your nickname and the room code or the link to the finished game. The data will be found and deleted by hand, and you will get a reply.

You can delete the data stored in your browser (below) yourself by clearing the site data in your browser settings.

Cookies and browser storage

One cookie: lang, the language you picked with the switcher. It is set only when you switch the language yourself and lasts a year. There are no other cookies and no third-party ones.

localStorage holds data the game keeps in your browser and sends nowhere, except the guest key:

• carc.token: the secret guest key the server uses to recognise you in a room;
• carc.name: your nickname;
• carc.save.v2 and carc.setup.v1: a game against bots and its settings, so you can continue later;
• carc.sound, carc.music, carc.sound.volume, carc.music.volume: whether sounds and music are on, and their volume;
• carc.music.url: the link to your own track, if you set one in the settings; the track itself, if its server allows it, is stored in this same browser (Cache Storage) and is not sent anywhere;
• carc.voice.intro, carc.mic, carc.cam, carc.micmode: the voice chat tip has been shown, and your chosen microphone, camera and microphone mode;
• carc.rtc: connection debug mode (only if you turn it on by hand);
• carc.chat.notice: the chat retention note has been shown;
• carc.stage: whether the current player’s window is open or collapsed;
• carc.tutorial.done: which tutorials you have finished.

Age

The service is not meant for children under 16 without parental consent.

Changes

If what is stored, or how, changes, this page changes too, along with its date.