Privacy Policy

This Privacy Policy explains what information Crossplay ("we", "us") collects when you use crossplay.dev and the Crossplay Hub desktop application, why we collect it, and the choices you have. We collect only what we need to run the service and keep it secure.

Information we collect

Account information

When you create an account we store your username, email address, and a hashed (Argon2id) password. Your password is never stored in plain text.

Device identifiers

When you sign into the Crossplay Hub on a computer, that device is linked to your account so we can enforce your license (the number of seats you own) and prevent abuse. We store a salted, one-way hash of a device identifier — never a raw hardware serial or MAC address. From the hash alone we cannot reconstruct your hardware. You can view and remove your linked devices at any time from your account page.

Purchases and billing

We keep a record of your purchases (which pieces or plans, amount, and date). Card payments are processed by our payment provider; we do not store full card numbers.

Usage and technical data

Like most services, our servers process standard technical data (such as IP address and request metadata) to operate, secure, and debug the service.

Why we use it (legal bases)

• To provide the service you asked for — accounts, purchases, downloads, and licensing (performance of a contract).
• To enforce licenses and prevent abuse, fraud, and cheating — including binding licenses to devices and, where necessary, blocking a device identifier (our legitimate interests; fraud prevention is a recognized legitimate interest under the GDPR).
• Security and reliability of the platform.

Device bans

If an account is terminated for serious or repeated violations of our Terms of Service, we may add the associated hashed device identifier to a blocklist to prevent the abuse from continuing under a new account. Because we store only a hash, this list does not contain your hardware details.

Retention

We keep account and purchase data for as long as your account is active, and as needed to comply with legal, tax, and accounting obligations. We keep a minimal record of a banned device hash for as long as necessary to prevent recurring abuse.

Your rights

Depending on where you live, you may have the right to access, correct, export, or delete your personal data, and to object to certain processing. You can manage your linked devices yourself from your account, and you can contact us to exercise other rights. We will respond in line with applicable law (e.g. GDPR, CCPA/CPRA).

Sharing

We do not sell your personal data. We share it only with service providers who help us run the platform (such as hosting and payment processing), under appropriate safeguards.

Contact

Questions about this policy or your data: privacy@crossplay.dev.

This is a good-faith draft to accompany the device-binding feature. Have it reviewed by qualified legal counsel — especially for EU/UK (GDPR) and California (CCPA/CPRA) — before launch.