Privacy policy

EI Meidy BAFFOU — SIRET: 80473268300045

Contact: hello@crackandreveal.com

CrackAndReveal collects the following data:

• Email address — used for authentication (sign-up, login, password reset). Provided by the user or via Google OAuth.
• First name and last name — optional, entered in the user profile.
• IP address — recorded with each lock unlock attempt, for security and rate limiting purposes, and with the site's internal usage measurement (button clicks, lock creation steps).
• User-Agent — recorded with attempts to detect automated abuse.
• Payment data — handled directly by Link, a Stripe service and the official reseller of our subscriptions (payment method, billing address, country). CrackAndReveal never receives your card numbers: we only keep your Stripe customer ID and your subscription status (plan, status, dates).

Data is used exclusively for:

• Managing your account and authenticating your requests
• Providing statistics for your locks (attempts, successes)
• Protecting the service against abuse (IP rate limiting)
• Manage your subscriptions, payments and receipts, with our payment provider Stripe (Link)

What a lock's creator sees: for each of their players' attempts, the date, the result (success or failure) and the code entered — for a GPS geolocation lock, only the approximate distance to the target, never the player's location — as well as the nickname entered in competition mode. They never see players' IP addresses or browsers.

We do not sell, rent or share any personal data with third parties for commercial purposes.

• User account — retained as long as the account is active. Deleted upon request.
• Attempts — the IP address and user-agent are automatically erased after 90 days. The code entered, the result, the date and the country stay attached to the lock for its statistics, and are deleted with it.
• Internal usage measurement — the associated IP address is automatically erased after 90 days.
• Locks and content — retained as long as the account exists. Deleted with the account.
• Subscription — Stripe customer ID and subscription status, kept as long as the account exists. Receipts and invoices are kept by Link (Stripe) in line with its legal obligations.

Lock codes are stored as bcrypt hashes. Communications are encrypted via HTTPS. Authentication uses ES256-signed JWTs (asymmetric keys).

In accordance with the General Data Protection Regulation (GDPR), you have the following rights:

• Access — obtain a copy of your personal data.
• Rectification — correct inaccurate data.
• Deletion — request the deletion of your account and all your data.
• Portability — receive your data in a structured format.

To exercise these rights, contact us at hello@crackandreveal.com. You can also delete your account directly from the Profile page of your dashboard.

CrackAndReveal uses cookies through the following services:

• Google Analytics (GA4) — anonymous audience measurement to improve the service.

On your first visit, a banner lets you accept or decline these cookies. You can change your choice at any time by deleting the 'cr_consent' cookie from your browser.

A functional cookie, "cr_country", remembers for 30 days the country derived from your IP address so that prices are shown in the right currency (euro or dollar). It is not used for audience measurement or advertising.

For any questions about privacy: hello@crackandreveal.com