Legal
This Privacy Policy describes how Crowded Kingdom Studios, Inc. ("CK," "we," "us," or "our") handles personal information about players: people with a Crowded Kingdoms account, and players we sign in to the games we run ourselves. It goes with the Player Terms of Service (the "Player Terms"), and uses the words that document defines. For the personal information this Policy describes, CK is the controller.
It does not cover:
2.1 Account Information. When you create an account, we collect your email address, your gamertag or display name, your password (stored in hashed form), your date of birth, of which we keep only the year and month, and your country. If you are under 18, we also record your confirmation at sign-up that your parent or guardian has agreed. We record which terms you accepted, when, and whether you accepted them on a CK page or in a game. If you sign in with Google, we receive the account identifier, name and email address Google returns. A game CK runs that signs you in another way says what it receives in its addendum.
2.2 Age and Country. From your date of birth we work out your age group (13 to 15, 16 to 17, or 18 and over) and when it next changes. For a Crowded Kingdoms account, when you sign up and each time you sign in, we also look up the country of your connection's IP address in a geolocation database (IP geolocation by DB-IP, used under the Creative Commons Attribution 4.0 license), and we refuse sign-in from a place where we do not offer the Services (Player Terms Section 1.7). For a player a host signs in, the host gives us the player's age in years and country, and we apply the same rules to them.
2.3 Gameplay and Technical Data. We collect data generated as you play, including game progress, in-game actions, session data, and technical data such as IP address, device type, operating system, and game client version.
2.4 Your Last-Known IP Address. For a Crowded Kingdoms account, we keep the most recent IP address you signed in from, and when, for 90 days. We use it only for safety and legal purposes, such as a report to the National Center for Missing & Exploited Children ("NCMEC") or a response to valid legal process.
2.5 Server Logs. Our servers keep logs of their own operation, which can include the IP address a request came from. We keep them for 30 days and then delete them.
2.6 Communications and Content. Your chat, voice and video travel through our servers to the players you are talking to. We do not store them, except in the safety log (Section 2.7), in a report (Section 2.10), or where a game stores them for its own features, such as mail. We store the content you create in games, such as builds, custom items (where supported) and screenshots ("Your Content," as described in Player Terms Section 5).
2.7 The Safety Log. A game on Crowded Kingdoms can record what its players' game clients send to it, and every game that admits players under 18 must (Player Terms Section 4.6). While a game records, we record the inputs your client sends, with the time each arrived and the session it belongs to: your movement and actions, your text chat and messages, and, only where the game's administrators turn that on, your voice and video. When voice or video is recorded, the game tells you before recording starts and shows you when it is on. Recording is best-effort, so a recording can have gaps. Who can read it:
For a game CK runs, this Policy governs the recording. For any other game, the recording is made for that game's developer, whose own privacy notice governs it, and CK handles it for the developer under Section 6 of the CK Spatial Fabric API Terms of Service.
2.8 Contacts, Blocks and Settings. We keep your contacts and contact requests, the players you block, and your voice and video settings, in each game where you set them. For a player under 18, we also keep whether a parent or guardian has consented to voice or video, for which, and when. To ask for that consent, we send the parent's email address to Kids Web Services, a parental consent service run by Epic Games, which contacts the parent and verifies their consent under its own privacy policy.
2.9 Safety and Moderation Data. We collect reports you submit, reports that concern you, and records of moderation actions relating to your account.
2.10 What a Report Preserves. When someone files a report, we copy into a secure store, with restricted access and a record of every access: the safety-log records of the players involved from shortly before the reported moment until the report was filed; both players' account records; the reported player's last-known IP address, if we hold one; and what the game's servers on Crowded Kingdoms hold about them. We use that copy only to handle the report, to protect children, and to meet our legal obligations, including reporting apparent child sexual exploitation to NCMEC. We do this for ourselves, including for players a host signs in.
2.11 Purchases and Your Wallet. If you buy virtual currency or items, or fund your player wallet (Player Terms Section 6.8), our payment processor handles your payment details, including any card you save for auto-recharge. CK receives transaction records — such as what was purchased or topped up, the amount, the timestamp, and the compute charges drawn from your wallet — but does not receive or store full payment card numbers.
2.12 Support. If you contact us for support, we receive the information you provide and the contents of your message.
2.13 Modifications You Create or Run. Where a game supports player modifications ("Mods," Player Terms Section 5.6), we collect the Mod itself, records of who created it and who ran it, and technical records of how it behaved — including resource use, errors, and any security or abuse signals it generates.
2.14 Player-to-Player Transactions. Where you buy, sell, trade, or charge other players under Player Terms Section 6.9, we collect records of the transaction — the items or access involved, the accounts on each side, and the time — together with any dispute, chargeback, fraud, or account-compromise signals arising from it. CK is not a party to those transactions; we hold these records to operate the Services, enforce our terms, and prevent fraud.
2.15 Mods Can See Nearby Players. A client-side Mod you choose to trust runs on your device and can read the usernames, identifiers, and positions of players near you in the game. Mods other players trust can read yours in the same way when you are near them.
2.16 AI Tools. If you use the AI agent in Crowdy Studio, the code, files, screenshots, and game observations it works with are sent through CK's model endpoint to our AI model provider to generate a response. We send these requests with zero-data-retention and no-data-collection settings, and do not route them to providers that cannot honour those settings.
We use the information above to: (a) operate and provide the Services, including accounts, sign-in, and multiplayer features; (b) check your age and country, and apply the settings and limits for your age group and country; (c) keep players safe, including the safety log, reports, moderation, anti-cheat, and reports to NCMEC; (d) enforce the Player Terms; (e) process purchases; (f) provide support; (g) analyze and improve the Services; (h) operate and secure player modifications and player-to-player transactions, and investigate fraud and abuse arising from them; and (i) comply with applicable legal obligations.
Where the GDPR, UK GDPR, or a comparable law applies to you, our lawful bases are: performance of our contract with you for (a), (e), and (f); our legitimate interests in a safe, secure, working service for (b), (c), (d), (g), and (h); and legal obligation for (i) and for what the law requires of us under (b) and (c). Where we rely on legitimate interests you may object, and where we ever rely on consent you may withdraw it at any time, in each case at hello@crowdedkingdoms.com.
We also produce de-identified and aggregated data from activity on the Services — such as population, performance, economy, and world-activity statistics that do not identify, and cannot reasonably be linked to, you or any other individual. We may use that data for any business purpose, including research, benchmarking, and publication, as described in Section 4, and as reflected in Player Terms Section 5.5. We take reasonable measures to ensure that data cannot be associated with you or your household, we maintain and use it in de-identified form, and we do not attempt to re-identify it.
We share information with service providers acting on our behalf — including hosting, payment processing, moderation and anti-cheat, analytics, infrastructure and performance monitoring, AI model providers for Crowdy Studio's agent, and communications providers. A current list is at crowdedkingdoms.com/subprocessors.html. We also share information:
We may disclose the de-identified and aggregated data described in Section 3 to third parties, including in published research and reports; where we disclose it to an identified recipient rather than publishing it, we contractually require that recipient to maintain it in de-identified form and not to attempt re-identification. We do not sell or share personal information.
Games on Crowded Kingdoms are multiplayer. Certain information — including your gamertag, presence, in-game activity, and any chat or content you share in multiplayer or community features — is visible to other players. Do not share information in these features that you wish to keep private. If you are under 18, your voice and video reach only your contacts, once a parent or guardian has turned them on (Player Terms Section 4.9).
CK may monitor, review, and moderate chat, communications, and content, and may act on player reports, as described in Player Terms Section 4. Reports about a child's safety come first. We may retain communications, content, and moderation records as reasonably necessary to enforce our terms, maintain player safety, and comply with applicable law.
We retain personal information for as long as reasonably necessary to provide the Services and maintain your account, and afterwards as needed for the purposes described in this Policy or as required by applicable law. Some periods are fixed:
| What | How long we keep it |
|---|---|
| Safety-log records (Section 2.7) | 7 days, then deleted within about an hour. The index that lists them (your user ID, when each recorded session ran, and how many inputs of which kinds it held) is deleted about two days later, and copies of the index in our database backups expire within about two months |
| What a report preserves (Section 2.10) | Until the report is resolved or, where we report to NCMEC, one year after we do; longer where the law or a legal hold requires |
| Your last-known IP address (Section 2.4) | 90 days |
| Server logs (Section 2.5) | 30 days |
| Records of who read another player's safety log | For as long as the game exists on Crowded Kingdoms |
In setting other retention periods we consider how long we need the information to provide the Services, whether it is needed to enforce our terms or investigate abuse, whether it relates to a payment or transaction record we must keep for tax or accounting purposes, and whether a dispute or legal claim is live or reasonably anticipated. Moderation records, transaction records, and security logs are generally kept longer than ordinary gameplay data for those reasons.
When you close your account (Player Terms Section 3.3), we remove your email address, password and gamertag from it at once, and shortly afterwards erase your content in the games you played: the projects, libraries and mods you authored, your characters, avatars and saved state, your access to those games, and your team and channel memberships. We also ask the servers of each game you played on Crowded Kingdoms to erase what they hold about you; a game whose servers cannot do that yet, or that keeps data on servers of its own, handles it under its developer's privacy notice. Your builds remain in the game worlds under an identifier that no longer leads to you, and we remove a build that contains your personal information if you ask. Safety-log records remain until their 7 days are up. While a report about you is open, we keep your account's identity and the report until the report is resolved, and what a report preserved is kept as the table above says. We delete or de-identify the rest of your personal information within a reasonable period, except where continued retention is required for legal, safety, dispute-resolution, or fraud-prevention purposes, or by a legal hold.
We use commercially reasonable measures to protect personal information handled through the Services. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.
CK is a U.S. company and processes player data on U.S.-based infrastructure. If you are located outside the United States, your information will be transferred to and processed in the United States.
Depending on where you live, you may have rights to access, correct, delete, port, or object to the processing of your personal information, including rights under laws such as the CCPA. To make a request, email hello@crowdedkingdoms.com from the address on your account, or tell us how to identify your account; we may ask you to confirm it is yours before we act. We will respond within the period the applicable law allows. A parent or guardian can make a request for a player under 18. If you are under 18, you can also ask us to remove content you posted publicly on the Services. While they are kept, you can read the inputs you sent to a game that records them (Section 2.7) yourself, through the Crowded Kingdoms API with your account, while you can sign in to that game; otherwise, ask as Section 2.7 says. We will not discriminate against you for exercising any of these rights. Some information may be kept after a request where Section 7 says so, such as material a report preserved.
Under 13. The Services are not directed to, and CK does not knowingly collect personal information from, children under 13, or anyone under the minimum age for their country (Player Terms Section 1.8). If we learn that we have, we close the account or end its access and delete the personal information, except what the law requires us to keep.
13 to 17. Players under 18 sign up only with a parent's or guardian's agreement. Their voice and video stay off until a parent or guardian consents through Kids Web Services, and then reach only their contacts; direct messages start off; and every game that admits them keeps a safety log. A parent or guardian can ask us to see or delete their teen's information, and can withdraw a consent at any time, through Kids Web Services or by writing to hello@crowdedkingdoms.com.
Where we offer the Services. We do not offer the Services to players in the places Player Terms Section 1.7 lists.
We may update this Policy from time to time. Changes take effect when posted and are reflected by an updated Effective Date at the top of this Policy. We may also notify you in a game or by email.
Crowded Kingdom Studios, Inc.
2410 Mesa Glen Dr, Arlington, TX 76001
hello@crowdedkingdoms.com
For a child-safety concern, see Safety or write to abuse@crowdedkingdoms.com.
© 2026 Crowded Kingdom Studios, Inc. All rights reserved.