Early access— Scrap

Last updated 18 October 2026

Privacy policy

Cratekin collects as little as it can. You can play without telling us anything about yourself, and an account needs only an email address and a password.

Who is responsible

Cratekin (cratekin.io) is an independent early-access project. Its operator is responsible for the information described here. You can reach us via the contact page.

What we collect

One necessary cookie

Cratekin sets a single cookie, cratekin_session, only once you start playing (opening your first crate or starting a shift), create an account or sign in. It contains a random identifier: either your guest player id or a random sign-in token for your account. It is signed so it can't be forged, isn't readable by scripts on the page, lasts up to 180 days and is renewed when you visit. It is strictly necessary for the game to remember you, so it doesn't need consent. Cratekin sets no cookies while you are just browsing.

Your game data

For each player we store a random player id, your Scrap balance and a history of Scrap changes, the work shifts you played (the items dealt, the chute you picked for each, the result, the Scrap paid, and when), the crates you opened (which crate, what you got, the odds that applied, and when), the Cratekin you own, and when the player was created and last active.

Account information

If you create an account we also store your email address and your password, the latter only as a one-way cryptographic hash (argon2id), never in readable form. For each signed-in browser we store a session record with when it was created, last used and expires; we don't record the device, browser or location. If you reset your password, a single-use reset token is stored (hashed) for up to an hour.

IP addresses and technical data

Your IP address is used, in memory only, to apply rate limits and protect the site from abuse (for example, limiting how many new players or sign-in attempts come from one connection). It is not written to our database, and we don't keep logs of the pages you visit. Our server logs record errors and a few events, such as a new guest or account being created (identified by the random player id), and are rotated automatically.

Cloudflare

Cratekin is delivered through Cloudflare, which provides the secure connection and network protection for the site. To do that, Cloudflare processes connection data such as your IP address, under its own privacy policy.

What we don't do

  • No advertising, and no advertising or analytics cookies.
  • No analytics or tracking scripts, and no third-party fonts: everything is served from cratekin.io.
  • We don't sell your information or share it with anyone except as described on this page.
  • No public profiles: nothing about you is shown to other players.

Why we use it

  • To run the game you asked to play: remembering your player, your collection and, if you have one, your account (performance of our agreement with you).
  • To keep Cratekin safe and working: rate limits, preventing automated abuse, fixing errors (our legitimate interest in a secure service).

How long we keep it

  • Guest players: deleted, with their collection and history, 90 days after the last visit (14 days for guests that never collected anything).
  • Accounts: until you delete your account. Accounts are never removed for inactivity.
  • Sign-in sessions: until you sign out or after 180 days without use. Changing or resetting your password signs out your other sessions.
  • Backups: the database is backed up to recover from failures. Deleted data can remain in a backup until that backup is replaced.

Your choices and rights

You can delete your account and everything in it yourself, any time, from the account page. You can stop being a guest by clearing your cookies; the guest data is then deleted after the retention period above.

Depending on where you live (for example under the EU and UK GDPR), you also have the right to ask for a copy of your data, to have it corrected or deleted, to receive it in a portable format, and to object to or restrict how it is used. Contact us via the contact page to do so. You also have the right to complain to your local data protection authority.

Children

Cratekin is not directed at children under 13. If you are under the age at which you can agree to online services in your country, please ask a parent or guardian before creating an account.

Changes

We'll update this page when what we collect changes, and change the date at the top. If advertising is ever added, this policy will be updated before it starts, and you'll be asked for consent where the law requires it.