Privacy Policy

CryptoTD — https://cryptotd.me · https://app.cryptotd.me
Effective date: 16 October 2026 · Version: 1.0

1. Who we are

CryptoTD is a blockchain-based tower-defense browser game operated under the studio name TokenTide Studios (“TokenTide Studios”, “we”, “us”, “our”). TokenTide Studios is an independent game project and is not a registered company; the operator of the project is the data controller responsible for your personal data under this policy.

You can reach us about anything in this policy, including any privacy request, at:

[email protected]

This policy explains what personal data we collect when you visit cryptotd.me (the website), whitepaper.cryptotd.me (the documentation), and app.cryptotd.me (the game), why we collect it, who we share it with, how long we keep it, and the rights you have over it.

2. The short version

There are no accounts with usernames, passwords, names, or email addresses in the game. You log in by connecting a Web3 wallet (MetaMask) and signing a message.
The core data we hold is your wallet address, your in-game progress and token balance, and technical logs from the servers that run the game.
Deposits and withdrawals happen on the Binance Smart Chain (BSC), not on our servers. Once a transaction is on-chain it is public and permanent, and neither we nor anyone else can delete or alter it.
We use Google Analytics (in consent mode, so no analytics cookies before you accept) and Cloudflare, and we show a cookie banner so you can accept or reject non-essential cookies.
We do not sell your personal data, and we do not use it for advertising profiles.
You can ask us for a copy of your data, correct it, or delete what we can delete — email [email protected].
The game is for adults (18+).

3. What we collect

3.1 Wallet and login data

Your public wallet address (e.g. 0x…) — this is the identifier that ties everything in the game to you.
The cryptographic signature you produce when you sign the login message. We use it to verify you control the wallet. It cannot be used to move funds.
Your game session identifier and login timestamps.

We never ask for, receive, or store your seed phrase, private key, or wallet password. Nobody from CryptoTD will ever ask you for them.

3.2 Gameplay and economy data

Your in-game progress: towers owned, tower attributes and auras, upgrades, placement history, match results.
Your in-game balance of $CCrown and any credits, and the record of amounts deposited, withdrawn, and earned through gameplay.
Anti-cheat and integrity signals (for example, whether actions are physically possible in the game).

3.3 Blockchain data (on-chain)

When you deposit or withdraw $CCrown, the transaction is executed by a smart contract on Binance Smart Chain. On-chain data — wallet addresses, amounts, timestamps — is public by design, visible to anyone with a block explorer, and cannot be deleted, corrected, or restricted by us, because it does not live on our servers. Your rights under Section 9 do not extend to data that exists only on-chain.

3.4 Technical, security, and connection data

IP address, connection timestamps, and the fact that you opened a real-time (SignalR) connection to our game servers — necessary to run the game and to prevent abuse.
Browser, operating system, device type, screen size, and referring URL, collected by our servers and by the analytics described below.
Server and security logs (error logs, rate-limit and abuse events). Our infrastructure is fronted by Cloudflare, which processes connection data on our behalf.

3.5 Cookies and analytics

Our website and game pages use cookies and similar storage:

Strictly necessary — the cookie-consent preference itself, and the session/security cookies needed to serve the pages.
Statistics — Google Analytics 4 (measurement ID G-EYL3NN89YT), which helps us understand how many people visit and how they use the site. It runs in Google Consent Mode, with all optional storage denied by default: before you accept, analytics can only send cookieless, non-identifying pings. The _ga and _ga_EYL3NN89YT cookies are set only after you accept statistics cookies. This applies to both the website and the game page at app.cryptotd.me.
Functional / third-party embeds — YouTube video embeds (only loaded after you accept marketing cookies) and Google reCAPTCHA, where used, for spam and abuse protection.

Our cookie banner lets you Accept All, Reject non-essential cookies, or choose categories individually. You can change your choice at any time through the Cookie Preferences panel on the site. A full list of cookies and their durations is in our Cookie Policy.

You can also block or delete cookies in your browser settings. Blocking strictly necessary cookies may prevent parts of the site or game from working.

3.6 Communications

If you email us (support, a legal request, or a privacy request), we keep that correspondence and your email address so we can answer you and keep a record of the request.

3.7 What we do not collect

We do not ask for your name, postal address, phone number, date of birth, or government ID.
We do not ask for your seed phrase or private keys — ever.
We do not knowingly collect data from anyone under 18.
We do not run advertising trackers or sell data to data brokers.
We do not collect special-category data (health, ethnicity, religion, political views, biometrics).

4. Why we use it, and our legal bases

Purpose	What it involves	Legal basis
Running the game and your account	Wallet address, gameplay data, balance	Performance of a contract with you
Deposits, withdrawals, and token accounting	Wallet address, transaction records	Performance of a contract; legal obligation (record-keeping)
Security, anti-cheat, anti-fraud, DDoS mitigation	IP address, connection and security logs	Legitimate interests (protecting the game and its players)
Diagnostics, stability, and improving the game	Error logs, aggregated gameplay statistics	Legitimate interests
Website analytics	Google Analytics cookies and identifiers	Consent
Embedded media (e.g. YouTube) and reCAPTCHA	Third-party cookies	Consent (marketing/functional)
Answering your emails and handling rights requests	Correspondence, email address	Legitimate interests; legal obligation
Complying with legal requests and enforcing our Terms	Relevant records	Legal obligation; legitimate interests

Where we rely on consent, you can withdraw it at any time (Section 9) without affecting the lawfulness of what we did before. Where we rely on legitimate interests, you can object — we will stop unless we have compelling grounds that override your rights.

We do not make decisions with legal or similarly significant effects about you by automated means. The randomised attributes that towers receive in-game are a game mechanic generated by chance, not profiling or an automated decision about you.

5. Who we share it with

We share personal data only with the service providers we need to run CryptoTD, and only for the purposes above. We do not sell personal data.

Cloudflare — CDN, DNS, DDoS protection and traffic filtering; processes IP addresses and request metadata.
Google — Google Analytics (statistics cookies, consent-gated) and reCAPTCHA where deployed. Google may also act as an independent controller for some of its own processing; see Google’s privacy policy.
Hosting and infrastructure providers — our virtual private servers (currently Contabo) and the database infrastructure that stores game state, located in the providers’ data centres.
YouTube / Google (embeds) — only loaded if you accept marketing cookies.
Domain registrar and email provider — for the domain and for [email protected].
Blockchain infrastructure — public BSC nodes and RPC providers used to read and broadcast transactions. Anything you broadcast on-chain is public to the entire network.
Wallet providers — MetaMask and similar wallet software operate independently of us; their handling of your data is governed by their own policies.
Legal and safety disclosures — we may disclose data if required by law, court order, or a lawful request from a competent authority, or where necessary to investigate fraud, abuse, or a threat to someone’s safety.

Some of these providers are processors acting on our instructions under contract; others (like Google and MetaMask) act as independent controllers for parts of their processing.

6. Where your data goes

Our servers and providers are located mainly in the European Union and the United States. Where personal data is transferred outside your country (including out of the EEA/UK), we rely on appropriate safeguards such as the European Commission’s Standard Contractual Clauses and, where applicable, an adequacy decision or the EU–US Data Privacy Framework, together with the providers’ own transfer mechanisms.

On-chain data is inherently global: a BSC transaction is replicated to nodes worldwide. Because it is public and decentralised, we cannot restrict where it is accessible.

7. How long we keep it

Wallet, gameplay, balance and transaction records: for as long as your wallet is active in the game, and then up to 24 months after your last activity, after which they are deleted or anonymised.
Server, security and access logs: typically up to 90 days.
Analytics data (Google Analytics): retained for up to 14 months, aggregated and consent-gated.
Support and rights-request correspondence: up to 24 months from the last message.
On-chain transaction data: permanent and outside our control.
Where a longer period is required by tax, accounting, or anti-fraud obligations, or because a dispute or legal claim is live, we keep the relevant records until that obligation ends. Where possible we keep only what is necessary and limit access to it.

We may keep aggregated or anonymised statistics (for example, total towers sold) indefinitely, because they no longer identify you.

8. How we protect it

Encryption in transit (HTTPS/TLS) for the website, the game client, and the dashboard, with certificates auto-renewed.
Server access restricted to key-based SSH logins, hardened configurations, and firewall/Cloudflare filtering in front of public services.
Databases are not exposed to the internet and are reachable only from the servers that need them.
Access to production systems is limited to the operator; administrative interfaces are password-protected and not publicly indexed.
Logs are used to detect cheats, abuse, and intrusion attempts.

No system is perfectly secure. If a breach affects your personal data, we will notify you and the relevant authorities as required by applicable law. Remember the most important rule of self-custody: we will never ask for your seed phrase or private key, and anyone who does — including someone claiming to be us — is trying to steal from you.

9. Your rights

We give everyone the same rights, wherever you live (this satisfies the EU/UK GDPR and similar regimes, and covers the essentials of the CCPA/CPRA for California residents):

Access — get a copy of the personal data we hold about you.
Rectification — have inaccurate data corrected.
Erasure — have data deleted where we have no overriding reason to keep it.
Restriction — ask us to limit how we use it while a question is resolved.
Portability — receive data you gave us in a structured, machine-readable format.
Objection — object to processing based on our legitimate interests.
Withdraw consent — turn off analytics and other optional cookies at any time via the cookie preference panel, or by emailing us.
Complain — lodge a complaint with your local data-protection authority (in the EU/UK, the authority where you live or work).

To exercise any of these, email [email protected] from the address you’re contacting us with, and tell us your wallet address so we can find your records. We will respond within 30 days; if we need longer we will tell you why.

Two honest limits:

We cannot authenticate a request without something that ties you to the wallet — otherwise anyone could ask for, or delete, your data. Depending on the request we may ask you to sign a message with the wallet to prove control. We will not accept a request to delete or disclose another person’s data.
We cannot delete on-chain transactions. If your wallet appears on BSC, that record stays public forever. Deleting our own records does not remove it.

California residents: we do not sell or share your personal information for cross-context behavioural advertising as those terms are defined by the CCPA/CPRA, and we do not use it for those purposes. You have the rights listed above plus the right not to be discriminated against for exercising them.

Do Not Track / Global Privacy Control: we do not respond to browser Do Not Track signals, because there is no agreed standard for them. You control optional cookies directly through our cookie preference panel, which also honours Global Privacy Control signals where the browser sends them.

10. Children

CryptoTD involves blockchain transactions, and is intended only for adults aged 18 or over. We do not knowingly collect personal data from anyone under 18. If you believe a minor has used the game or given us data, contact [email protected] and we will delete what we can and deactivate the wallet’s access.

11. Changes to this policy

We may update this policy as the game and our infrastructure change — for example when tokenomics, the token contract, or new features such as staking or a marketplace go live. The current version always lives at cryptotd.me/privacy-policy and whitepaper.cryptotd.me/support/privacy-policy, with the effective date and version number at the top. If a change materially affects your rights, we will make that prominent on the website and in the game before it takes effect.

12. Contact

Privacy and data requests: [email protected]
Support and general questions: the social channels at https://linktr.ee/cryptotd

We aim to answer every privacy request within 30 days.

CryptoTD — https://cryptotd.me · https://app.cryptotd.meEffective date: 16 October 2026 · Version: 1.0