'%20d='M59%207L38%2024L24%2022L17%2033L26%2044L39%2040L57%2048L36%2060L13%2050L3%2029L18%209L35%204L29%2014Z'/%3e%3c/svg%3e)
1. Who is responsible
Sergei Vladimirovitsj Saliukov, trading as Crunchy.Host, Hora Siccamasingel 47, 9721HA Groningen, the Netherlands, KVK 95500324, is the controller for the personal data described here. For any privacy question or request, email [email protected].
2. What this policy covers
This policy covers crunchy.host, the billing panel, the game panel and our support channels. It does not cover data your players send to your game server. For that data you are the controller and we act as your processor, as set out in section 12 of the terms of service.
3. What we collect and why
| Data | Purpose | Legal basis | Kept for |
|---|---|---|---|
| Account: email address, name, password (stored hashed), passkeys, two-factor settings, avatar image, language preference, referral used at sign-up | Create and run your account | Contract | Until you request account deletion, then removed within 30 days |
| Billing: balance, top-ups, charges, refunds, saved payment method (brand, last 4 digits, expiry date) | Take payments, keep accounts, meet tax law | Contract, legal obligation | 7 years, as Dutch tax law requires |
| Servers: configuration, files, resource usage, console output | Run your game servers | Contract | Until you delete the server, or 10 days after it expires |
| Security log: IP address, browser and time of sign-ins and account changes | Security, fraud prevention. You can see this log in your account settings | Legitimate interest | Until you request account deletion, then removed within 30 days |
| Support: tickets, emails, Discord messages you send us | Answer your questions | Contract, legitimate interest | Until you request account deletion, then removed within 30 days |
| Fraud and abuse cases: account details, payment signals, report contents | Handle abuse, stop repeat fraud | Legitimate interest, legal obligation | Up to 2 years after the case is closed |
If you sign in with Google, GitHub or Apple, we receive your email address, name and account ID from that provider.
Visiting crunchy.host without an account: we do not use analytics, advertising or tracking tools. Cloudflare and our servers process your IP address to deliver the site and block attacks.
If you do not give us the data we need for an account or payment, we cannot provide the services.
4. Who we share data with
We do not sell your data and we do not show ads. We use these providers, who process data only on our instructions:
| Provider | What they do | Location |
|---|---|---|
| Cloudflare, Inc. | DNS, content delivery and attack protection for our websites | Global network, United States |
| Stripe Payments Europe, Ltd. | Payment processing and fraud prevention | Ireland, United States |
| Intuition Machines, Inc. (hCaptcha) | Bot protection on sign-up and login | United States |
| Resend | Sending account and billing emails | United States |
| VibeGames | Datacenter space, server hardware and network | European Union |
If you contact us through Discord, Discord processes your messages under its own privacy policy.
We also share data when:
- a court, the police or another authority orders us to;
- it is needed to handle abuse, fraud or a legal claim;
- the business is transferred to a new owner. We tell you in advance, and this policy keeps applying.
5. Where your data is stored
Our servers, the billing system and your game servers are in the European Union. Some providers above process data outside the EU. Transfers to the United States are covered by the EU-US Data Privacy Framework or by the European Commission's standard contractual clauses.
6. Cookies
We only use cookies and browser storage that the site and panel need to work: keeping you logged in, remembering your language preference, and protecting against bots and payment fraud. Cloudflare, hCaptcha and Stripe set some of these. We do not use analytics or advertising cookies, so there is no cookie banner.
7. Emails
We send emails you need: receipts, renewal and expiry notices, deletion warnings, security alerts and changes to our terms. We only send news or offers if you opt in, and every such email has an unsubscribe link.
8. Automated decisions
Stripe may automatically block a payment it considers high-risk, and hCaptcha may block sign-ups that look automated. If this happens to you, contact us and a person will review it.
9. Security
- All connections to our sites and panels use TLS.
- Passwords are stored hashed. Passkeys are supported.
- Only people who need access to production systems have it.
- Our infrastructure sits behind DDoS protection.
If a data breach puts your data at risk, we report it to the Dutch Data Protection Authority within 72 hours and inform you without undue delay if the risk to you is high.
10. Your rights
You can ask us to:
- give you a copy of your personal data;
- correct data that is wrong;
- delete your data, unless we must keep it, for example invoices for tax law;
- limit how we use your data;
- send your data to you or another provider in a machine-readable format;
- stop using your data based on legitimate interest, if your situation justifies it.
Email [email protected] from the address on your account. We answer within one month. We may ask you to confirm your identity first.
You can also complain to the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) or the data protection authority where you live.
11. Age
You must be at least 16 to create an account. If we learn that an account belongs to someone younger, we close it and delete the data within 30 days, except records the law requires us to keep.
12. Changes
We email you about changes that affect how we use your data before they take effect. The date at the top shows the current version.