Privacy policy

1. Controller

The controller within the meaning of the General Data Protection Regulation (GDPR) is CT-Software Solutions (sole proprietorship), the provider of CrackTap. Name, postal address and contact details are in the Impressum (legal notice), which also gives the e-mail address for privacy questions and for requests under Your rights.

The Impressum is provided by the Impressum service ZERODOX (zerodox.de). When you open it you leave our site; ZERODOX is responsible for the processing there.

2. Overview

We only process the data we need to run this website, to sell and deliver licenses, to sign you in and check your license in the software, and to protect against abuse. We do not use advertising or analytics services, we do not build advertising profiles and we do not sell data.

We name the legal basis for each processing. Mostly it is Art. 6(1)(b) GDPR (contract: account, purchase, license), (c) (legal obligations, e.g. keeping accounting records) or (f) (legitimate interests: secure operation, protection against abuse).

3. Hosting, Cloudflare and server logs

This website and our server functions (sign-in, shop, download, license check, e-mail delivery) run on the platform of Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA (among others Cloudflare Workers, the D1 database, KV and R2 storage, Durable Objects). Cloudflare processes data on our behalf (Art. 28 GDPR).

Every page request and every connection of the software produces technically necessary data: IP address, date and time, requested address (URL), browser or program identifier (user agent), status code and amount of data. We need it to deliver the pages, to keep operation stable and secure and to fend off attacks (Art. 6(1)(f) GDPR). Our application does not store the full IP address (for the license check we only store a shortened network prefix, see Use of the software); Cloudflare may log access data briefly for security and operation. To protect against overload and password guessing, our server counts requests per IP address and account in working memory only.

If someone attacks our administration interfaces, the requester's IP address may be included in an internal alert to us (Art. 6(1)(f) GDPR, protecting our systems).

Cloudflare may transfer data to the USA, see Recipients and transfers to third countries. More in Cloudflare's privacy policy.

4. Account, sign-in and license (KeyAuth)

We manage accounts and license keys with the service KeyAuth (keyauth.cc). When you register or sign in on the website or in the software, your username, password, e-mail address and license key are sent to KeyAuth and processed there. KeyAuth also keeps the term of your license, the device identifier (HWID, see Use of the software) and sign-in logs, including your IP address when you sign in from the software. We do not store your password ourselves; it is only passed on to KeyAuth.

"Forgot password" makes KeyAuth send an e-mail to the address you gave when registering. To display it faster, our server remembers the expiry date of your license (and the time at which a key redemption or a sign-in on our website last confirmed your subscription) under your username for up to 60 days.

Purpose and legal basis: providing the account and checking the license (Art. 6(1)(b) GDPR). Without this data we cannot set up an account. We keep it as long as the account exists; we delete the account on request.

5. Use of the software (loader and game module)

When the loader starts and while the game runs, the software talks to our servers and to KeyAuth to check your license and to limit use to the registered device. This involves your account name or license, a device identifier (HWID), the program version, session and check identifiers, and the times of sign-in and of the session's regular signs of life ("heartbeats").

The HWID is a hash value (SHA-256) that the software computes on your PC from hardware and system characteristics (among others the processor identification, the serial number of the system drive, the computer name and the UUID from the motherboard firmware). The underlying raw values do not leave your PC. The loader also sends a check value (hash) of its own program code so that tampering can be detected.

Of the network we store only a shortened prefix (IPv4: without the last octet, IPv6: the first 64 bits) plus country and network operator (ASN), not your full IP address. A sign-in from a device other than the registered one is refused automatically.

Session data is deleted a few minutes after use ends. The device record (license, HWID, last seen) stays as long as the license exists and is replaced when a new device is registered.

Purpose and legal basis: license check and binding to a device (Art. 6(1)(b) GDPR), and our legitimate interest in protecting against abuse, sharing of licenses and tampering with the software ((f)). To detect abuse we evaluate technical usage data, for example whether a license signs in from several devices or networks within a short time. Anomalies are only logged or reported to us; we decide on any blocking by hand.

6. Download and individual marking

When you download the loader in the customer area we store your account name, the program version and the time (download log, for administration and troubleshooting). It is kept as long as your account exists and deleted on request.

Every program component the loader fetches for a session is given an individual, invisible marking (watermark). For 180 days we store which license and which device (HWID) a marking was issued to, so that unauthorised redistribution can be traced (Art. 6(1)(f) GDPR: protecting our intellectual property).

7. Purchase, payment and delivery of the key

When you buy, you enter an e-mail address and choose a plan. We store the e-mail address, plan, order number, payment provider and status, times and, once payment is confirmed, the license key we delivered. This serves to process the purchase and the order page where you can find your key again (Art. 6(1)(b) GDPR). Without this data we cannot process the purchase. If an order is still unpaid about ten minutes after you started it, we send one e-mail to that address offering help (for example a ticket on our Discord): once per order, at most once a day per address, nothing else follows (Art. 6(1)(b) and (f) GDPR: a service message about the purchase you started). To keep it to one a day we store a keyed hash of the address (not the address itself) and delete it after three days. You can object at any time by writing to us.

A paid order (order number, plan, e-mail address, the key delivered, payment provider, payment reference and times) is kept permanently as a record of the sale, with its order page (Art. 6(1)(c) and (f) GDPR: bookkeeping, proof of delivery, help with later questions about the order). Other order records and their order pages are deleted automatically 30 days after their last change; an order for which no payment was ever reported is deleted after 24 hours. So that a payment that still arrives later can be delivered (the payment link stays open at NOWPayments), the plan, e-mail address and invoice details of a removed order (automatically after 24 hours, or early from our admin list) are kept in a separate record: for up to 8 days after the purchase was started if no payment was ever reported, otherwise until the 30 days mentioned end (Art. 6(1)(b) GDPR). Statutory retention duties remain unaffected (e.g. section 147 of the German Fiscal Code, section 257 of the German Commercial Code): we keep payment and accounting records in our bookkeeping, and the payment providers keep them in their systems, for as long as the law requires (Art. 6(1)(c) GDPR).

Card payments and other payment methods enabled there are handled by Stripe. We send you to the payment page of Stripe Payments Europe, Ltd., Dublin, Ireland (group: Stripe, Inc., USA) and transmit your e-mail address, the order number, the plan and the amount. You enter payment data only there; we receive no card data, only status messages (e.g. paid, refunded) and the e-mail address given at Stripe. Stripe also processes data under its own responsibility, for example for fraud prevention: Stripe's privacy policy.

Crypto payments are handled by NOWPayments. We only transmit the amount, order number and plan name (not your e-mail address) and send you to the invoice page of NOWPayments, where you choose the cryptocurrency and pay. NOWPayments processes the data entered there, as well as payment and blockchain data, under its own responsibility according to its privacy policy. We receive status messages about the payment.

After payment we e-mail the license key to the address you gave (sender orders@cracktap.win). Delivery runs through Cloudflare's e-mail service; if it fails, it is retried at growing intervals for up to two days. Legal basis: Art. 6(1)(b) GDPR.

8. Discord link

You can optionally link your CrackTap account to your Discord account so that you automatically get your role on our Discord server. For this the website creates a one-time code (valid for ten minutes, stored by us only as a hash) that you enter in Discord with the CrackTap bot. We store your account name, your Discord user ID and your Discord display name, and the time of the link. The link stays until you ask us to remove it (Art. 6(1)(b) GDPR: the feature you asked for). While it exists, the bot can ask our server (with a shared secret) whether your subscription is currently active, when it ends and whether it is a Lifetime subscription (going by the last known expiry date of your license), and then gives or takes your role on the server (with a Lifetime subscription this includes a Lifetime role, which the other members of the server can see); for this we tell it your Discord user ID, your account name (never your e-mail address) and these subscription details. Role changes are logged with your account name and your Discord name in a channel of the server that only the team can see.

The Discord bot runs on Cloudflare, like this website. Discord Inc., USA, is responsible for your use of Discord itself: Discord's privacy policy.

9. Chat (shoutbox)

The customer area has a shared chat. Your messages (up to 500 characters) are stored with your account name and the time and shown to all signed-in members. Only the 50 newest messages are kept; older ones are deleted automatically. Please do not write personal data there. Legal basis: Art. 6(1)(b) GDPR (use of the chat) and (f) (moderation).

Moderation: an administrator can delete single messages and can bar an account from writing in the chat, for a set time or permanently. For that we store the account name, the reason shown to the member, the time, the length and the administrator's name; a timed bar is deleted automatically after it ends, a permanent one when it is lifted. An automatic filter does not let certain messages appear (for example slurs, links and words from the operator's own list). The 25 newest rejected messages are kept with account name, text and time so that the operator can review them; older ones are deleted automatically. The filter never bars anyone by itself. Legal basis: Art. 6(1)(f) GDPR (our legitimate interest in a chat free of abuse).

10. Profile picture

Signed-in members can add a profile picture, voluntarily, in the “Profile” area. Your browser shrinks and crops the picture to 256 × 256 pixels before it is sent (metadata such as where a photo was taken is normally lost in the process). We store the picture (at most 128 KB) at Cloudflare together with your account name, the file size and the time. It is shown only to signed-in members, next to your messages in the chat and on your profile page, not publicly. It stays until you remove it on the profile page or we remove it; we delete it with your account on request. The legal basis is your consent by adding the picture (Art. 6(1)(a) GDPR), which you can withdraw at any time by removing the picture (see also Your rights).

Moderation: an administrator can remove a picture that breaks the rules and can bar an account from adding more. For that we store the account name, the administrator's name and the time, until the bar is lifted (Art. 6(1)(f) GDPR). Please only add pictures you have the rights to and that show no people who have not agreed.

11. Scoreboard badge (CT badge)

The game module shows a badge in the scoreboard next to players who also use CrackTap in the same match. For this it reports, about every 20 seconds, the Steam ID (SteamID64) of your player and the Steam IDs of the players on your scoreboard to our server. The server compares which games list each other and returns the other's Steam ID only to those. Reports are stored together with your account name, deleted at the latest ten minutes after the last one and used for nothing else. The feature is always on and cannot be switched off.

The legal basis is our legitimate interest (Art. 6(1)(f) GDPR) in offering our customers this recognition. This also affects fellow players who do not use CrackTap; their Steam IDs are visible to everyone in the scoreboard and are processed only briefly and only for the comparison. You can object to the processing (see Your rights).

12. Web radar

If you switch the web radar on in the menu, the software sends live data of the running match (player names, positions, health, weapons, bomb status) to our server, which forwards it to everyone who opens your radar link. Anyone who knows the link can watch without signing in; only give it to people you want to show the data. The live data is only passed through and held in working memory, not stored; we only store which account the link belongs to. Legal basis: Art. 6(1)(b) GDPR (the feature you switched on). For viewers, the technical data described under Hosting arises.

13. In-game chat

The game module has a chat that only users of the software can see; the website has no access to it. It connects only after you have opened it in the menu for the first time, and stays connected until you switch it off there. Your messages (up to 200 characters) are shown to all connected users with your account name and the time. Only the 60 newest messages are kept, so that a game that connects later can see them; older ones are deleted automatically. If you send your Steam friend code, everyone in the chat sees it; please do not write any other personal data there. Legal basis: Art. 6(1)(b) GDPR (the feature you use). For the connection, the technical data described under Hosting arises.

Moderation: an automatic filter keeps certain messages from appearing (such as insults and links); they are not stored. The operator can empty the chat and bar an account from writing for a set time; for that we store the account name and the end of the bar, and delete the entry as soon as it has run out. Legal basis: Art. 6(1)(f) GDPR (our legitimate interest in a chat without abuse).

14. Cookies and local storage

We only use technically necessary cookies. After you sign in, the website sets the session cookie "ct_web" (valid for 24 hours, HttpOnly, Secure, SameSite=Lax) that recognises you as signed in. A second cookie (60 seconds) carries one-time confirmation and error messages after an action. Neither is used for tracking (section 25(2) no. 2 TDDDG, Art. 6(1)(b) GDPR).

The chat remembers a list of recently used emoji in your browser (local storage). It stays on your device and can be deleted at any time in your browser settings. We use no analytics, advertising or social media cookies. On the payment pages of Stripe and NOWPayments these providers may set their own cookies.

15. Fonts (Google Fonts)

Our pages load the typefaces "Space Grotesk" and "JetBrains Mono" from Google Fonts (fonts.googleapis.com and fonts.gstatic.com). Your browser connects to servers of Google (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, or Google LLC, USA) and transmits, among other things, your IP address. The legal basis is our legitimate interest in a uniform and appealing presentation (Art. 6(1)(f) GDPR). If your browser blocks external fonts, system fonts are used. More: Google's privacy policy.

16. Recipients and transfers to third countries

As described above, these recipients receive your data:

• Cloudflare, Inc. (hosting, database, storage, e-mail delivery; processor)
• KeyAuth (accounts, licenses, sign-in)
• Stripe Payments Europe, Ltd. and Stripe, Inc. (card payment)
• NOWPayments (crypto payment)
• Discord Inc. (only when you link your account or use our Discord server)
• Google (fonts)
• ZERODOX (Impressum service, only when you open the Impressum)

Authorities, courts or advisers only receive data where a legal duty exists or where it is needed to enforce our rights.

Several of these recipients are based in, or process data in, the USA. Where the recipient is certified under the EU-US Data Privacy Framework (e.g. Cloudflare, Stripe, Google), the transfer relies on the European Commission's adequacy decision; otherwise on standard contractual clauses (Art. 46 GDPR) or, where a transfer is only occasional and necessary to perform the contract with you, on Art. 49(1)(b) GDPR.

17. External links

Our pages link to third-party sites, for example our Discord server and the Impressum at ZERODOX. When you click, you leave our site; the respective operators are responsible for the processing there.

18. Security

The connection to our pages and servers is encrypted with HTTPS (TLS). One-time codes are stored only as hashes, passwords are not stored by us at all, and the number of requests is limited. Our administration interfaces are protected by secret keys.

19. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20). You may object to processing that we base on legitimate interests, on grounds relating to your particular situation (Art. 21). You may withdraw any consent at any time with effect for the future (Art. 7(3)).

Write to the e-mail address in the Impressum. To avoid giving data to the wrong person, we may ask you to prove that the account or order is yours.

You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), for example the authority where you live or where we are based.

20. Changes to this policy

We update this policy when our services or the law change. The version published here applies.