CrankRank Privacy Policy
Effective date: 6 November 2026 Last updated: 6 November 2026
This policy explains what personal data CrankRank collects, why, who we share it with, and the choices you have. We've tried to keep it short and readable. If anything is unclear, email us at [CONTACT EMAIL].
CrankRank is a fan-run community site for Playdate games. It is not affiliated with, endorsed by, or connected to Panic Inc.
1. Who we are
CrankRank ([DOMAIN]) is run by [OPERATOR LEGAL NAME], [OPERATOR ADDRESS] ("CrankRank", "we", "us").
We are the controller of your personal data. That means we decide how and why it's used, and we're responsible for looking after it.
We follow the Isle of Man Data Protection Act 2018 and the GDPR as applied in the Isle of Man, and the UK GDPR and UK Data Protection Act 2018 where they apply to you.
Contact for anything privacy-related: [CONTACT EMAIL].
2. The short version
- We collect what we need to run your account and the community. Nothing more.
- Your reviews, ratings, comments, posts and profile are public.
- We use one cookie: a session cookie that keeps you signed in. No tracking or advertising cookies.
- Our analytics are cookieless and don't build a profile of you.
- We don't sell your data and we don't show ads.
- New posts may be checked by an automated moderation tool, and a human looks at anything it holds back.
- You can download your data or delete your account at any time.
3. What we collect
Information you give us
| What | Details |
|---|---|
| Account details | Email address, username, and password. We never store your password itself, only a scrambled version (a scrypt hash) that can't be turned back into the password. |
| Profile | Display name, avatar, bio, and anything else you choose to add. |
| Your content | Crank ratings (1–5), written reviews, comments, discussion threads, questions and answers, feature requests, and your Own / Played / Finished lists. |
| Social activity | Who you follow and who follows you. |
| Notification settings | Whether you want on-site, email, or weekly digest notifications. |
| Messages to us | Anything you send us, such as support emails, reports, developer claims, or takedown requests. |
| Reports | If you report content, we keep the report and the reason you gave. |
If you sign in with Google or Discord
If you choose to sign in with Google or Discord, that service sends us your name, email address, and avatar. We don't get your password for that service, and we don't post anything on your behalf. Google's and Discord's own privacy policies cover what they do.
Information collected automatically
- Session cookie. When you sign in, we set one cookie that links your browser to your session in our database. It's strictly necessary for signing in, so it doesn't need your consent. It's removed when you sign out or the session expires.
- Server and security logs. Like any website, our servers record basic technical details such as IP address, browser type, the pages requested, and the time. We use these to keep the site running, fix bugs, and stop abuse.
- Cookieless analytics. We use [Cloudflare Web Analytics / Umami] to count visits and see which pages are popular. It doesn't use cookies or similar tracking, and doesn't follow you across other sites. We see totals and trends, not individual people.
- Account signals. We note when your account was created. Ratings from accounts less than 7 days old are shown but not counted in a game's score. This helps stop people gaming the rankings.
We don't knowingly collect special category data (such as health, religion, or political views). Please don't post this kind of information about yourself or anyone else.
4. Why we use your data, and our legal basis
Data protection law requires us to have a legal reason (a "lawful basis") for each use.
| Why we use it | Lawful basis |
|---|---|
| Creating and running your account, signing you in, showing your profile and content | Contract: we need it to provide the service you signed up for. |
| Sending account emails (sign-up confirmation, password reset, security alerts, important changes) | Contract and legitimate interests (keeping your account secure). |
| Sending notifications and the weekly digest you've chosen | Consent / your settings. You choose these and can switch them off any time. |
| Moderating content, including automated screening, reports, and human review | Legitimate interests: keeping the community safe, friendly, and legal. |
| Not counting ratings from new accounts, and spotting spam, fraud, and abuse | Legitimate interests: keeping rankings fair and the site secure. |
| Cookieless analytics and server logs | Legitimate interests: understanding how the site is used and keeping it working. |
| Handling developer claims, removal requests, and copyright notices | Legitimate interests and, where it applies, legal obligation. |
| Responding to legal requests, and keeping records the law requires | Legal obligation. |
Where we rely on legitimate interests, we've weighed our interests against yours. You can object (see section 9).
5. Automated moderation
To keep CrankRank friendly, the text of each new post (reviews, comments, threads, Q&A, and so on) may be sent to OpenAI's moderation service. It checks for content that is blatantly abusive, hateful, sexual, violent, or otherwise inappropriate.
- If the tool flags a post, the post is held, not deleted, and a human moderator reviews it before deciding what to do.
- The tool never makes a final decision about your account on its own. A person does.
- We only send the post text. We don't send your email address or password.
- OpenAI processes this text as our service provider. Under its API terms, it doesn't use API data to train its models and keeps it only for a limited time (currently up to 30 days) for abuse monitoring. [Confirm current OpenAI API data terms before launch.]
If you think a moderation decision is wrong, email [CONTACT EMAIL] and we'll take another look.
6. Who we share data with
Everyone, for public content. Your username, profile, ratings, reviews, comments, posts, lists, and follows are public. Anyone can see them, including people without an account, and search engines may index them.
Service providers who help us run the site. They only process data on our instructions and under contracts that protect it:
| Provider | What they do | Where |
|---|---|---|
| Railway | Hosting and our Postgres database | United States / European Union |
| Resend | Sending emails (account emails, notifications, digest) | United States |
| OpenAI | Automated text moderation | United States |
| Cloudflare | [Web analytics, and later image storage (R2)] | United States and global network |
| Umami | [Web analytics, if used instead of Cloudflare] | [Self-hosted / location TBC] |
| Google, Discord | Sign-in, only if you choose it | United States |
Other cases. We may share data if the law requires it, to protect people's safety, to deal with fraud or abuse, or to enforce our Terms. If CrankRank is ever transferred to a new operator, your data would move with it under this policy, and we'd let you know first.
We never sell your personal data, and we don't share it with advertisers.
7. International transfers
Some of our providers are in the United States or elsewhere outside the Isle of Man, the UK, and the EU. When data goes abroad, we use approved safeguards. These include adequacy decisions (such as the EU–US Data Privacy Framework and its UK Extension, where the provider is certified) or standard contractual clauses with the UK Addendum. You can ask us for details at [CONTACT EMAIL].
8. How long we keep data
| Data | How long |
|---|---|
| Account and profile | Until you delete your account |
| Your public content | Until you delete it or your account (see below) |
| Session records | Until you sign out or the session expires |
| Server and security logs | Up to [90 days] |
| Moderation records and reports | Up to [12 months] after the decision, or longer if needed for an ongoing issue |
| Takedown and copyright notices | Up to [3 years] |
| Support emails | Up to [2 years] |
| Backups | Deleted data drops out of backups within [30 days] |
When you delete your account, we delete your account details and profile. You can choose to have your content deleted too. Otherwise, content that is part of a public conversation (such as comments others have replied to) is kept but shown as "deleted user", with nothing linking it to you. Your ratings are removed from game scores. [Confirm the chosen approach.]
9. Your rights
You have the right to:
- Access your data and get a copy of it
- Correct data that's wrong
- Delete your data
- Restrict how we use it
- Object to uses based on legitimate interests
- Data portability, meaning you get your data in a machine-readable format
- Withdraw consent at any time, for example by turning off email notifications
- Not be subject to decisions made purely by automated means that significantly affect you. We don't make those (see section 5).
How: most things can be done in your account settings, including editing your profile, changing notifications, downloading your data, and deleting your account. For anything else, email [CONTACT EMAIL]. We'll reply within one month. We may need to confirm it's really you first.
Complaints: please talk to us first, and we'll try to put it right. You can also complain to a regulator:
- Isle of Man Information Commissioner: inforights.im
- UK Information Commissioner's Office (ICO): ico.org.uk, if you're in the UK
- Your local data protection authority, if you're in the EU
10. Children
You must be at least 13 to use CrankRank. We don't knowingly collect data from anyone under 13. If you think a child under 13 has an account, email [CONTACT EMAIL] and we'll delete it.
11. Security
We use reasonable technical and organisational measures to protect your data. These include encrypted connections (HTTPS), hashed passwords (scrypt), limited access to our systems, and providers with good security practices. No system is perfect, though. If a breach puts your rights at risk, we'll tell you and the regulator as the law requires.
12. Links to other sites
CrankRank links to other sites, including Panic's Playdate Catalog ("Buy on Catalog" links), YouTube, and other review sites. We don't control those sites, and their own privacy policies apply. Embedded or linked content may set its own cookies once you visit it.
13. Changes to this policy
We may update this policy. We'll change the "Last updated" date, and if a change is significant we'll tell you on the site or by email before it takes effect.
14. Contact
[OPERATOR LEGAL NAME] [OPERATOR ADDRESS] Email: [CONTACT EMAIL]