Privacy policy
Last updated 1 November 2026
This policy explains what personal data CrunchCube (https://crunchcube.in, “we”) collects, why, how long we keep it, and the choices and rights you have. It is written to meet India's Digital Personal Data Protection Act, 2023 and Rules, 2025 (the “DPDP Act”), the EU and UK GDPR, and US state privacy laws such as California's. For DPDP purposes we are the Data Fiduciary; for the GDPR, the controller.
- The tools work entirely in your browser. What you paste into them is never sent to us.
- You can play every game as a guest without giving us anything.
- If you create an account, we keep your email, a nickname, your scores and a scrambled (hashed) password. Only your nickname and scores are ever shown publicly.
- We never sell your data. Newsletter emails only go to people who asked for them.
- You can download or delete your data any time from My account.
What we collect and why
| Data | Why we use it | How long we keep it |
|---|---|---|
| Account: email address, nickname, password (stored only as a one-way bcrypt hash), confirmation that you're 18 or over, and your Google account ID if you sign in with Google | To create and secure your account, sign you in, and send account emails (confirm email, reset password) | Until you delete your account. Accounts whose email is never confirmed are deleted after 30 days. |
| Accounts a friend sets up for you: a nickname they chose with you, and either an invite link or an email address with a starting password (stored only as a hash). You confirm you're 18+ and accept these terms when you first open the link or sign in, and you can change the nickname and password any time | To let you start playing without signing up yourself | Until you delete the account. Invites never opened are deleted after 30 days. |
| Game data: your scores, game stats (level, streak, accuracy, enemies defeated, blocks) and the answers, level results and timings of each game | To work out scores fairly on our server, keep your history, show leaderboards and detect cheating | Saved scores: until you delete your account. Records of individual games: 30 days. |
| Guest games: the game record and a hashed (scrambled) version of your IP address, with no name or email | To run the game, limit abuse, and let you save the score if you sign in within 2 hours | 30 days (unfinished games: 1 day) |
| Challenge links: the game, your score, and your nickname (or the first name you type, if you're a guest) | To show the people you send the link to what score they need to beat | 90 days |
| Newsletter: email address and a record of when and how you agreed | To send the newsletter you asked for, and to prove you agreed | Until you unsubscribe. Unconfirmed sign-ups are deleted after 30 days. |
| Consent records: what you agreed to, which version of this policy, and when | To show we have your consent, as the DPDP Act and GDPR require | As long as your account or subscription exists |
| Security logs: events such as sign-ins, failed sign-ins, password resets and account deletion, with the time and a hashed IP address | To protect accounts, investigate misuse, and meet the DPDP Rules' requirement to keep processing logs | About 1 year (400 days), then deleted automatically |
| Signed-in sessions: a random session ID and your browser name | To keep you signed in and let you sign out other devices | 30 days, or until you sign out |
| Emails you send us | To reply to you | As long as needed to deal with your message |
We don't store raw IP addresses: they are only kept as a keyed, one-way hash. Everything you type or paste into a CrunchCube tool (JSON, tokens, colours, images, timestamps) is processed on your own device and isn't sent to us.
What other people can see
Your nickname and scores appear on public leaderboards once your email is confirmed. If you create a challenge link, anyone who has the link can see the name and score in it. Your email address is never shown. You can change your nickname, or delete your account to remove your scores, at any time.
Our legal grounds
- Your consent, given when you create an account, subscribe to the newsletter, or accept personalised ads. Under the DPDP Act this is our basis for processing account and game data.
- Providing the service you asked for (GDPR “contract”): running your account and games.
- Legitimate uses and interests: keeping the site secure, preventing cheating and abuse, and keeping the logs the law requires.
- Legal obligations: responding to lawful requests and keeping records the law requires.
You can withdraw consent as easily as you gave it: unsubscribe with the link in any email or the switch in My account, change your cookie choices with Cookie settings in the footer, or delete your account. Withdrawing doesn't affect anything we did before.
Who we share data with
We don't sell personal data, and we don't share it for others' marketing. We use these service providers (Data Processors), only for the purposes above:
- Our web hosting provider, which stores the site, database and email.
- Google, if you choose “Continue with Google” (Google tells us your name, email and Google account ID), and for advertising and analytics (see below).
We may disclose data if the law requires it, for example to comply with a court order or a request from the Data Protection Board of India. Some providers, including Google, may process data outside India or your country. Where the GDPR applies, those transfers are covered by safeguards such as the EU Standard Contractual Clauses.
Advertising and analytics
We use Google AdSense to show ads, which keeps the tools and games free. Google and its partners use cookies to show ads and measure them, and may personalise ads based on your visits to this and other websites. Visitors in the EEA, UK and Switzerland are asked for consent before personalised ads are shown, and can change their choice with Cookie settings in the footer. You can also turn off personalised ads in Google Ads Settings, and read how Google uses data from sites that use its services.
We use Google Analytics to see which pages are useful: pages visited, approximate location, browser and device type. We don't use it to identify you.
Some pages contain affiliate links. If you buy through one, the seller may set a cookie to record the referral. We never see your payment details. Full details of cookies and browser storage are in our Cookie policy.
Your rights
Wherever you live, you can:
- Access your data: download a copy from My account (“Download my data”), or ask us.
- Correct it: change your nickname and newsletter choice in My account. To change your email address, contact us.
- Erase it: delete your account in My account. Your account, scores, mailing-list record and consent records are deleted straight away. Security log entries keep only a number and a time, and are removed within about a year.
- Withdraw consent at any time, as described above.
- Nominate someone to exercise these rights for you if you die or can't act yourself (DPDP Act, section 14). Email us with their name and contact details.
- Object to processing or ask us to restrict it, and port your data (the download is machine-readable JSON), where the GDPR applies.
California and other US states: we don't sell personal information. Personalised advertising by Google may count as “sharing”; you can opt out through Cookie settings or Google Ads Settings. We won't treat you differently for using your rights.
Questions and complaints (grievance redressal)
Email hello@crunchcube.in with “Privacy” in the subject line. This is also our grievance contact under the DPDP Act. We aim to reply within 30 days, and in any case within the 90 days the DPDP Rules allow. We may ask you to confirm your identity first, for example by writing from your account email.
If you're not satisfied, you can complain to the Data Protection Board of India after using our grievance process, or, in the EU or UK, to your local data protection authority.
Children
Accounts are only for people aged 18 or over, so we don't need to collect parental consent. Anyone can play as a guest, and guest play doesn't involve giving us a name, email or account. If we learn that someone under 18 has created an account, we delete it. Parents or guardians who think this has happened can email hello@crunchcube.in.
How we protect your data
Pages and data are sent over HTTPS. Passwords are stored only as bcrypt hashes. Sign-in cookies can't be read by scripts. Reset and confirmation links expire and work once. Sign-in attempts are rate-limited. Database access is limited to the site itself. If a personal data breach happens, we will tell affected users and the Data Protection Board of India as the DPDP Rules require, and the relevant authority where the GDPR applies.
Inactive accounts
If you don't sign in for 3 years, we may delete your account. We'll email you at least 48 hours before, so you can sign in to keep it.
Changes to this policy
If we change how we use personal data in a meaningful way, we'll update this page and its date. Account holders will also be told by email, and we'll ask for fresh consent where the law requires it.