Crab Attack privacy policy

Last updated 29 October 2026

In short: Crab Attack sends our own server a few anonymous counts, such as "the game was opened for the first time" or "round 3 was cleared", so we can see which ads bring players and how far they get. The counts carry no name, account, device identifier or IP address, and nothing links one to another or to you. We don't show ads in the game, we don't sell or share anything, and we don't track you across other companies' apps or websites.

What the game saves on your device

To remember your progress, the game saves these settings on your device:

your best score and best round for each difficulty
the stars you've earned in each round
the difficulty you picked
whether sound is muted
the towel you picked
whether the game has been opened before, and, on the website, the campaign tags of the ad or link you arrived from

Deleting the app, or clearing the website's data in your browser, removes them.

What we collect on our server

The game sends a short note to our own server, which runs on Cloudflare, when it's opened for the first time and each time a round is cleared. Each note contains only:

Information	Examples
What happened	"First open" or "round cleared", with the round number
Platform and difficulty	iPhone, Android or web, and the difficulty you picked
Country	The country the request came from, which Cloudflare works out from your IP address. We don't store your IP address, and we never use GPS or your precise location.
Campaign tags (website only)	If you reached the website from an ad or a tagged link, that link's tags, such as `utm_campaign`, or the `gclid` or `fbclid` that Google and Meta add to ad links

There is no install ID, device identifier, account, score history or session data in these notes, so we can't link one note to another or to you.

How we use it

To count how many players each ad campaign brings and how far they get
To see which rounds players reach, so we can improve the game

We only use these counts ourselves. We don't sell them, share them or use them for advertising, and we don't combine them with information from other companies.

What the game doesn't do

There are no accounts or sign-in of our own.
There's no advertising in the game, no advertising identifier, no cookies, and no third-party analytics or tracking tools.
It doesn't track you across other companies' apps or websites.
It doesn't access your contacts, photos, camera, microphone or precise location.

How long we keep it

We keep the counts for as long as they help us measure campaigns, and no longer than 24 months.

Ad measurement

We sometimes advertise Crab Attack on Meta and Google. To find out which ads lead to downloads, the iOS app uses Apple's privacy-preserving ad attribution (SKAdNetwork). Apple tells the ad network, and us, only that an ad led to an install, with a number showing how far the player got (opened, or how many rounds were cleared). Apple sends this as a delayed count with no information that identifies you or your device. The app doesn't use the advertising identifier (IDFA), doesn't ask for permission to track you, and has no ad network code inside.

Buying the app

From version 1.3, the iOS app is bought once from the App Store and has no in-app purchases. Earlier versions offered the full game as a one-time in-app purchase, and asked the App Store whether you owned it without saving that anywhere else. Either way, Apple handles the payment under Apple's privacy policy, and we don't receive your name, payment details or Apple Account.

Game Center

If you're signed in to Game Center on your iPhone, the iOS app sends your scores and achievements to Apple's Game Center. That's how they appear on the leaderboard and in your Game Center profile. Apple handles this under Apple's privacy policy, and we don't receive your name or Apple Account. You can turn Game Center off in Settings at any time.

Website and TestFlight

The web version is served by Cloudflare, which handles standard web requests to deliver the page. If you test the iOS app through TestFlight, Apple shares crash reports and any feedback you choose to send with the developer, under Apple's privacy policy.

Children

Crab Attack is for players of all ages. We don't ask for names, emails or any other information that identifies a person, and the counts described above are anonymous.

Your choices and rights

Under the New Zealand Privacy Act 2020, you can ask what information we hold, ask us to correct it, or ask us to delete it. Because the counts we keep don't identify anyone, we usually can't find any that came from you, but we'll tell you what we hold and answer your questions. We'll respond within 20 working days. If you're not happy with our response, you can contact the Office of the Privacy Commissioner at privacy.org.nz.

Questions

For privacy questions or support, email [email protected] or visit the support page.