Crab Attack privacy policy

Last updated 28 October 2026

In short: Crab Attack sends gameplay and technical information, tagged with a random install ID, to our own server. We use it to understand how the game is played and to fix problems. We don't ask for your name, email or account. We don't show ads in the game. We don't sell or share your information with anyone, and we don't track you across other companies' apps or websites.

What the game saves on your device

To remember your progress, the game saves these settings on your device:

your best score and best round for each difficulty
the stars you've earned in each round
the difficulty you picked
whether sound is muted
the towel you picked

Deleting the app, or clearing the website's data in your browser, removes them.

What we collect on our server

When the game is online, it sends the following to our own server, which runs on Cloudflare:

Information	Examples
Gameplay events	Games started and finished, rounds reached, scores, stars, difficulty and towel picked, and session length
Device and app information	Device model, iOS or browser version, app version, and errors or crashes
IP address and approximate location	Your IP address, which our server receives with every request. We use it to work out your approximate country or region. We never use GPS or your precise location.
An install ID	A random ID created when you first open the game, so we can tell sessions from the same install apart. It isn't your Apple Account, your name or an advertising identifier.

How we use it

To understand how people play, such as which rounds are too hard, and to improve the game
To find and fix crashes and bugs
To keep the service running and secure

We only use this information ourselves. We don't sell it, share it or use it for advertising, and we don't combine it with information from other companies.

What the game doesn't do

There are no accounts or sign-in of our own.
There's no advertising in the game, no advertising identifier, and no third-party analytics or tracking tools.
It doesn't track you across other companies' apps or websites.
It doesn't access your contacts, photos, camera, microphone or precise location.

How long we keep it

We keep gameplay and diagnostic information for up to 24 months. We keep IP addresses in server logs for up to 90 days. After that, we delete the information or make it fully anonymous.

Ad measurement

We sometimes advertise Crab Attack. To find out which ads lead to downloads, the iOS app uses Apple's privacy-preserving ad attribution (SKAdNetwork). Apple tells us only that an ad led to an install, as a delayed count with no information that identifies you or your device. The app doesn't use the advertising identifier (IDFA), and it doesn't ask for permission to track you.

In-app purchase

In the iOS app, you can buy the full game once. Apple handles the purchase and payment under Apple's privacy policy. We don't receive your name, payment details or Apple Account. The app asks the App Store whether you own the full game and doesn't save that anywhere else.

Game Center

If you're signed in to Game Center on your iPhone, the iOS app sends your scores and achievements to Apple's Game Center. That's how they appear on the leaderboard and in your Game Center profile. Apple handles this under Apple's privacy policy, and we don't receive your name or Apple Account. You can turn Game Center off in Settings at any time.

Website and TestFlight

The web version is served by Cloudflare, which handles standard web requests to deliver the page. If you test the iOS app through TestFlight, Apple shares crash reports and any feedback you choose to send with the developer, under Apple's privacy policy.

Children

Crab Attack is for players of all ages. We don't ask for names, emails or any other information that identifies a person. The information we collect is limited to the gameplay and technical details described above, linked only to a random install ID.

Your choices and rights

Under the New Zealand Privacy Act 2020, you can ask what information we hold, ask us to correct it, or ask us to delete it. Because we don't know who you are, include the approximate date and time you played and your device model, so we can find the right records. We'll respond within 20 working days. If you're not happy with our response, you can contact the Office of the Privacy Commissioner at privacy.org.nz.

Questions

For privacy questions or support, email [email protected] or visit the support page.