Privacy Policy

CrewPlay is developed and published by Epsilon Developers (“we”, “us”, “our”), based in India. This Privacy Policy explains how information is handled when you use:

• the CrewPlay app for Android (package name www.epsilon.crewplay), including every game in it and Crew Link; and
• this website, crewplay.epsilondevelopers.xyz.

It forms part of our Terms of Use. Our Data Safety page lists every kind of data in one table, and Children & Families answers the questions parents ask most.

Where a data protection law makes somebody responsible for information — a controller under the GDPR, or a Data Fiduciary under India’s Digital Personal Data Protection Act, 2023 — for CrewPlay that is Epsilon Developers. You can reach us at support@epsilondevelopers.xyz.

CrewPlay was built to work offline, with no backend at all. There is no CrewPlay account and no CrewPlay server for the app to send anything to. What the app needs to remember, it keeps on your device, in storage that Android sets aside for CrewPlay alone:

You can see all of it in the app, rename players in the Party tab, and delete every bit of it in Settings → Your data → Reset everything, by clearing CrewPlay’s storage in Android’s settings, or by uninstalling.

If your phone backs up its apps

Android can include app data in your phone’s own backup to your Google Account, if you have backup switched on, so a new phone can be set up with it. CrewPlay does not opt out of this, so your crew and scores may come back when you restore a phone. Those backups are made and stored by Google, in your Google Account; we cannot see or open them. You can manage or delete them in your phone’s backup settings, or in the Backups section of Google Drive.

We do not run a server, a database or an API for CrewPlay, and the app contains no code that sends information to us. We do not receive your player names, scores, coins, device identifiers, location, contacts or photos, or anything about how you play.

We receive personal information in three situations only:

What we never do

• sell or rent personal information, or share it for advertising;
• build profiles of players, or make automated decisions about you;
• ask, inside the app, for your real name, email address, phone number, date of birth, location, contacts or photos;
• use your camera, microphone, files, screen content or other apps.

Purchases

Purchases are made through Google Play’s billing system. You pay Google, and Google’s Privacy Policy and the Google Play Terms of Service apply to the payment.

When a purchase completes, Google Play hands the app a signed purchase record: the product, a purchase token and an order number. The app checks that record on your phone, to make sure it is a genuine, paid purchase for CrewPlay, and then remembers what you own. The app does not send any of it to us. Restore purchases in the Shop simply asks Google Play what your account already owns.

Updates

CrewPlay can ask Google Play whether a newer version exists, at most once a day and whenever you tap Check for updates in Settings. The question goes through the Play Store app on your phone, and Google Play answers it. An update never downloads or restarts the app during a match or while a Crew Link room is open.

Google’s role

Google provides these services as an independent company, under its own terms and privacy policy. We cannot see or change what Google holds; see section 12 for how to reach it.

When you start the Daily Challenge in Guess in 5, CrewPlay asks a free third-party word service, random-word-api.herokuapp.com, which runs on Heroku (a Salesforce service), for one four-letter word, over an encrypted HTTPS connection.

• The request carries nothing about you: no name, no player ID, no device or advertising ID, no account.
• Like any request over the internet, it does reveal your device’s IP address, and basic technical details such as the kind of software making the request, to that service and its host. We do not run that service, and we cannot see or control its logs.
• The word that comes back is checked against the app’s own dictionary and profanity filter before it is ever shown.
• If you are offline, or the service does not answer within five seconds, the app uses a word chosen from its built-in list by the date instead.

Crew Link lets up to eight people play one match with a phone each, over one player’s Wi-Fi hotspot or a shared Wi-Fi network. There is no server, relay or account involved: the phones connect directly to each other on the local network.

What the phones exchange

• each player’s display name, character and colour, and their random player ID, so a returning player gets their seat back and rivalries work across phones;
• a short room code, the game being played, who is ready, and the app version;
• the moves each player makes, and the state of the game as the host’s phone runs it;
• a random, single-use seat token, so that only you can reclaim your seat if your phone drops out. It is kept in memory and forgotten when the app closes.

Who can see it

• Everybody in the room sees the names, characters and moves in the match, just as they would round one phone.
• Anybody on the same Wi-Fi network with CrewPlay open can see that a room exists, the host’s display name, which game it is and how many are in it. So pick a name you are happy for people on that network to see, and prefer your own hotspot to public Wi-Fi.
• Crew Link traffic stays on the local network and is not encrypted. It carries nothing but game information, but somebody in control of the same network could see it.

What is kept afterwards

When a match ends, each phone saves the result to its own local history, including the other players’ player IDs and scores, exactly as a shared-phone match is saved. Nothing is kept anywhere else, and the room is forgotten the moment it closes.

The permission it may ask for

On Android 13 and later, Crew Link asks for the Nearby devices permission, which Android requires before an app may look for other phones on a local network. CrewPlay declares that it never uses this permission to work out your location, and it never asks for a location permission.

• Sharing a result. CrewPlay draws a score card (or, for Guess in 5, a grid of coloured squares) on your phone and opens Android’s share sheet. The picture is kept briefly in the app’s temporary files to hand it over.
• Export stats (Settings → Your data) builds a file with your players’ names, games played, wins, coins and personal bests, and hands it to the share sheet.

You decide where it goes. Once shared, the app or person you chose has a copy, under their own privacy policy. We are not told what you shared, or where.

CrewPlay currently shows no advertising to anybody.

The app still contains Google’s Mobile Ads software, dormant, so that advertising can be designed again one day without rebuilding the app. In the current version it is never started and never asks for an ad, and the app is built without the permission to read your advertising ID: Android’s AD_ID permission and the related Privacy Sandbox permissions are removed from it.

If we ever introduce advertising, we will update this policy and our Data Safety declarations on Google Play before a version with advertising is released, explain what any advertising partner collects, and ask for your consent wherever the law requires it. CrewPlay Premium, a one-time purchase, keeps your copy of CrewPlay free of advertising for good.

CrewPlay includes Google’s Firebase libraries, not set up and never started: the app has no Firebase project configuration, so the libraries have nowhere to connect to, and analytics collection is also switched off in the app’s build. Push messaging is not set up either, and CrewPlay sends no notifications.

If we ever want analytics or crash reporting, we will update this policy and our Data Safety declarations before that version ships.

Separately, Google Play collects statistics about installs, crashes and performance for every app, from phones whose owners have agreed to share usage and diagnostics with Google. That is Google’s processing; we only see the results, aggregated and de-identified.

The full list, with the technical names, is on our Data Safety page.

CrewPlay is a party game for friends and families, and children often play it, usually together with the adults and older children around them. We built it with that in mind:

• no chat, no messaging, no accounts, and no way to contact strangers;
• no advertising and no analytics in the current version;
• a profanity-filtered word list, and friendly words everywhere: nobody is ever told they lost;
• every purchase goes through the Google Account holder’s own Google Play checkout.

We do not knowingly collect personal information from children; in the app we collect none from anyone. If a child emails us, we use the message only to reply, may ask a parent or guardian to contact us instead, and delete it once we have helped.

A “child” means someone under 18 under India’s DPDP Act, under 13 under the US COPPA Rule, and someone between 13 and 16 in the EEA and UK depending on the country. We do not process children’s personal data, do not track or monitor children’s behaviour, and do not direct advertising at them. Our Children & Families page is a practical guide for parents.

Depending on where you live, you may have the right to know what personal information is held about you and to get a copy; to have it corrected or deleted; to object to or restrict how it is used; to withdraw consent; to nominate someone to act for you; and to complain.

On your phone, straight away

• See it: everything CrewPlay stores is visible in the app: the crew, their stats, your coins and your settings.
• Correct it: rename or change any player in the Party tab.
• Take a copy: Settings → Your data → Export stats.
• Delete it: Settings → Your data → Reset everything; or clear CrewPlay’s storage in Android’s app settings; or uninstall. Remove old Android backups in your phone’s backup settings or in Google Drive.

With us

Email support@epsilondevelopers.xyz with the subject “Privacy request”, or use the contact page. We confirm we have your request within 48 hours and answer within 30 days, sooner where the law requires. We may ask something to make sure a request really is yours, such as the order number of a purchase. It costs nothing, and we will never treat you differently for using your rights.

With Google

For your Google Account, Google Play purchases and reviews, use Google’s tools at myaccount.google.com. We cannot access or change what Google holds.

• Everything CrewPlay sends over the internet uses encrypted HTTPS connections: Google Play, the word service and this website.
• On your phone, CrewPlay’s data sits in Android’s private app storage, which other apps cannot read on a normal, unmodified phone, and which modern Android encrypts.
• Purchases are verified on your device against Google Play’s signed records, and only a genuine, paid purchase unlocks anything.
• Everything that arrives over Crew Link is treated as untrusted and checked before it is used, and a seat can only be reclaimed with its secret token.
• Crew Link traffic on the local network is not encrypted (see section 6).

No system is perfect. If we ever learn of a breach affecting personal information we hold, we will tell the people affected, and the authorities, as the law requires; in India that includes the Data Protection Board. Found a problem? Our Security & Disclosure page explains how to tell us safely.

We are based in India, and the small amount of personal information we hold, emails and order records, is handled from India using our email provider and Google’s services, which may store it in other countries. Google processes Play information worldwide under its own safeguards, including the European Commission’s Standard Contractual Clauses. The Daily Challenge word service runs on Heroku, which uses servers in the United States and Europe. Where the law requires it, we rely on appropriate safeguards for international transfers.

• No cookies, analytics, trackers, advertising or forms.
• No third-party requests: the fonts, scripts and images are all served from this site.
• The only thing the site stores is your reading choice, the short version or the full text, in your browser’s session storage. It is deleted when you close the tab and is never sent anywhere.
• Our hosting provider processes standard server logs (IP address, browser type, the page asked for, and the time) to deliver the site and protect it from abuse, and keeps them only briefly. We do not use them to identify or follow visitors.
• Links to other sites, such as Google’s policies, are governed by those sites’ own policies.

We update this policy when CrewPlay changes in a way that affects your information, and always before a version that would send more information anywhere, such as one with advertising or analytics. The date at the top shows the last change, and the history below says what changed. For significant changes we will also tell you in the app or on this site before they take effect.

Epsilon Developers
Email: support@epsilondevelopers.xyz
Website: crewplay.epsilondevelopers.xyz

Grievance Officer. For a complaint about how your information is handled, write to support@epsilondevelopers.xyz with the subject “Grievance”. We acknowledge it within 48 hours and resolve it within 30 days. Our Contact & Grievances page lists every way to reach us and how to escalate a complaint. Our postal address is published with CrewPlay’s developer contact details on Google Play.

Personal information

Information about an identified or identifiable person, such as a name, an email address, or an ID that could be linked to someone. Also called personal data.

Controller

Under the GDPR, the organisation that decides why and how personal data is used, and is responsible for it.

Data Fiduciary

Under India’s DPDP Act, the person or organisation that decides the purpose and means of processing personal data. It is the Indian equivalent of a controller.

Purchase token

A random string Google Play creates for each purchase, so an app can confirm with Google that a purchase is real. It does not contain your name or payment details.

IP address

The number your internet connection uses to send and receive data. Every website or service you connect to sees it, and it can hint at your general area.

Advertising ID

A resettable ID that Android offers to apps for advertising. CrewPlay is built without the permission to read it.

Player ID

A random code CrewPlay creates on your phone for each player you add, used to keep that player’s scores together. It is not linked to you, your phone or your Google Account.

Local network

The Wi-Fi network or hotspot that phones in the same room are connected to. Traffic on it does not go out to the internet.