Last updated: September 23, 2026
Privacy Policy
This Privacy Policy explains how Crime Codex collects, uses and protects your personal data when you use our service, and the rights you have under the General Data Protection Regulation (GDPR) and applicable data protection law in the United States.
Data controller
The data controller responsible for your personal data is the operator of Crime Codex. You can reach our data protection contact at legal@crimecodex.com.
Data we collect
We collect account data (email, display name), authentication identifiers via our identity provider, purchase and licensing records, gameplay progress and scores, and technical data such as device and usage information. We do not collect special categories of data.
How we use your data
We use your data to provide and secure the service, deliver the cases and content you purchase, maintain leaderboards and community features, process payments, send transactional and (with consent) marketing communications, and improve the product through aggregated analytics.
Legal basis for processing
We process data on the basis of contract performance (providing the service you purchased), legitimate interests (security, product improvement and recording sales in our analytics), consent (marketing communications, analytics cookies and advertising cookies, each asked for separately), and legal obligations (tax and accounting). Purchases are recorded in our analytics —amount, cases and order number— even if you reject cookies, because that record is made on our servers, not in your browser; what is not recorded without your consent is your journey through the site.
Data retention
We retain personal data only as long as necessary for the purposes described, to comply with legal obligations, and to resolve disputes. Account and gameplay data are deleted or anonymized after prolonged inactivity or upon a valid erasure request.
Your rights
Under the GDPR you have the right to access, rectify, erase, restrict and object to the processing of your data, and the right to data portability. To exercise these rights, contact legal@crimecodex.com.
Sharing with third parties
We share data with processors who help us operate the service (payment processing, identity, email delivery, analytics, error monitoring and hosting). All processors act under data processing agreements and only on our instructions. In addition, if you accept advertising cookies, we share with Meta the data described in "Ad measurement with Meta", as joint controllers.
International transfers
Where data is transferred outside the European Economic Area, we rely on adequacy decisions or Standard Contractual Clauses to ensure an equivalent level of protection. For Meta, the transfer to Meta Platforms, Inc. relies on the EU-US Data Privacy Framework.
Security
We apply appropriate technical and organizational measures, including encryption in transit, access controls and least-privilege practices, to protect your personal data against unauthorized access, loss or disclosure.
Cookies
We use cookies and similar technologies as described in our Cookie Policy. Non-essential cookies are only set with your consent.
Ad measurement with Meta
If you accept advertising cookies, when you view a case, add it to your cart, start checkout or complete a purchase, we send Meta Platforms Ireland Limited ("Meta", which runs Facebook and Instagram) a notice of that event, so we can tell which ads bring us buyers and so Meta can show our ads to people more likely to be interested. That notice includes the type of action, the date, the amount and currency, the cases involved and, for a purchase, the order number. So that Meta can match it to the ad you saw, we add your email address turned into an irreversible code (a SHA-256 hash), never in plain text; the identifier of the Meta ad you came from, if you came from one; and your IP address and technical browser data. We do not send your name, address, phone number, payment details or anything about your game. We do not install the Meta pixel or any Meta cookies in your browser: the notice is sent from our servers. The email code is computed at the moment of sending and we do not keep it. The legal basis is your consent, which is asked for separately from analytics. Without it we send nothing to Meta. You can withdraw it at any time from "Cookie preferences" at the bottom of any page; withdrawal does not affect notices sent before. For the collection and sending of this data, the operator of Crime Codex and Meta are joint controllers; any further processing by Meta is Meta's own responsibility under its privacy policy (facebook.com/privacy/policy), which explains how long Meta keeps the data and how to exercise your rights with Meta. Meta may transfer data to Meta Platforms, Inc. in the United States under the EU-US Data Privacy Framework and standard contractual clauses. You can exercise your rights with us at legal@crimecodex.com or with Meta.
Complaints
If you believe your data protection rights have been infringed, you have the right to lodge a complaint with the competent supervisory authority (the competent data protection authority).
Changes to this policy
We may update this Privacy Policy from time to time. Material changes will be communicated through the service, and the effective date above will be revised.