Privacy policy
Last updated 21 October 2026
The short version
- You can play without giving us anything. Signing in needs only an email address.
- We keep what the game needs: your sign-in, your name, your progress and your match results.
- Linking a wallet is optional and read-only. We store the address, never your keys.
- No ads, no tracking cookies, no selling your data.
- You can delete your account in the game at any time.
- Who we are
- What we collect
- How we use it
- Wallets
- Who we share with
- Your device
- How long
- Your choices
- Children
- Contact
Who we are
The Crypto Rabbit Hole® trading card game ("the game", "we", "us") is made by Crypto Rabbit Hole Productions in South Australia. This policy covers the game at tcg.thecryptorabbithole.io and its online server. We handle personal information in line with the Australian Privacy Principles in the Privacy Act 1988 (Cth), and we aim to meet the same standard for players everywhere.
What we collect
| What | When | Why |
|---|---|---|
| A random guest token | When you open the game | So a reload or a dropped connection keeps your seat and your progress as a guest. |
| Email address | Only if you sign in | To send your one-time sign-in code and keep your account. We don't send marketing email. |
| Player name, avatar and frame | When you choose them | Shown to other players online and on the leaderboards. |
| Game progress | As you play | Your level, Carats, decks, collection, badges, Decrypt progress and settings, so they follow you between devices. |
| Match records | After online matches | Results, turns and stats for the leaderboards and your profile. |
| Time zone | When you connect | So daily rewards reset at your midnight. |
| Wallet address | Only if you link a wallet | To read which Crypto Rabbit Hole cards it holds on Deck-0. See Wallets. |
| Purchase records | If you buy something | Which item, when, and Stripe's payment and customer reference, to deliver it and handle refunds. We never see your card number. |
| Technical logs | When you connect | Our hosting keeps standard server logs (such as IP address and time) to run the service, stop abuse and fix problems. |
We don't collect your real name, address, phone number, contacts or location, and we don't use analytics or advertising trackers.
How we use it
- To run the game: sign-in, saving progress, online matches, leaderboards and the shop.
- To keep play fair and safe: the server decides match results and rewards, and we may look at records to investigate cheating, abuse or payment problems.
- To answer you when you contact us.
We don't sell or rent personal information, and we don't use it for advertising.
Wallets
Linking a wallet is optional. It works by one free sign-in signature, in the "Sign-In with Ethereum" style:
- Your wallet shows a plain-text message from tcg.thecryptorabbithole.io. Signing it costs nothing, sends no transaction, moves no funds and grants no approvals.
- The game can ask a wallet for only two things: which account to use, and that sign-in signature. It blocks any other request (transfers, token approvals, "permits", network switches) before it reaches your wallet.
- Our server checks the signature and stores only your wallet address. It then reads the public ApeChain records of the Crypto Rabbit Hole album on Deck-0 to see which cards that address holds. Nothing is ever written to the blockchain.
- We will never ask for your seed phrase or private key. Anyone who does is not us.
Only link a wallet on tcg.thecryptorabbithole.io. You can unlink it from your profile at any time; we then stop reading it and remove the address from your account.
Who we share with
We use a small number of service providers, only for the jobs below. They process data for us under their own privacy and security terms, and some of them store data outside Australia (including the United States).
| Provider | What for |
|---|---|
| GoDaddy | Hosting the website, the game server and its database. |
| Resend | Sending the sign-in code email. |
| Stripe | Taking payments for the HODL Club and bundles. Stripe handles your card details directly. |
| Google Fonts | The game's typefaces load from Google's servers, which see your IP address. |
| ApeChain / Deck-0 | Public blockchain and card data we read for linked wallets. We send them nothing about you except the public address we look up. |
Other players see your player name, avatar, frame, match results and leaderboard stats. We may also disclose information if the law requires it.
Card packs are sold by Deck-0 on their own site. When you follow a link to Deck-0, X, Discord, Instagram or YouTube, their privacy policies apply.
Your device
The game keeps a few things in your browser's local storage: your settings, your sign-in token and a copy of your progress for instant loading and offline play. These aren't tracking cookies and aren't shared with anyone. Clearing your browser data removes them (you can sign in again to get your account back).
How long we keep it
- Accounts and progress: while your account exists. Delete it and they're removed.
- Guest progress that is never signed in to: it may be removed after a long period of inactivity.
- Sign-in codes: minutes. Sessions: until you sign out or delete your account.
- Purchase records: as long as tax and consumer law require (usually up to 7 years in Australia).
- Backups: overwritten on a rolling basis.
Your choices
- Access or correct: your profile shows what we hold about you; change your name there, or ask us.
- Delete: Profile → Delete account removes your account, progress and stats immediately (purchase records we must keep for tax are retained separately).
- Wallet: unlink it from your profile at any time.
- Complain: contact us first. If you're not satisfied, you can complain to the Office of the Australian Information Commissioner at oaic.gov.au, or your local data protection authority.
Security
Connections are encrypted (HTTPS and secure WebSockets). Sign-in codes and session tokens are stored only as one-way hashes. The website runs under a strict content security policy that lets it load only its own code. No system is perfectly secure, so if we ever learn of a breach that is likely to cause you serious harm, we'll tell you and the regulator as the law requires.
Children
The game is for players aged 13 and over. Under-18s need a parent or guardian's permission to buy anything. If you believe a child under 13 has given us personal information, contact us and we'll delete it.
Changes
We'll update this page if what we do changes, and change the date at the top. Big changes will also be announced in the game.
Contact
Questions about privacy, or a request about your data: email info@thecryptorabbithole.io, or see Contact for our other channels. Please don't send wallet keys, seed phrases or card numbers in any message.