Cribbage! Privacy Policy

Effective 18 August 2026. Last updated 5 September 2026.

This Policy describes how Citradox collects, uses, stores and discloses personal data in connection with the game Cribbage! and its online services, and the rights you have over that data. "We" means Citradox; "you" means the person playing.

1. Who is responsible, and how to contact us

1.1 Cribbage! is made by one person in the United States, working under the name Citradox. Citradox is a trading name and not a company. That person is the controller of the personal data described here.

1.2 For any question about your data, or to exercise any right in section 7, email support@citradox.com. Replies are written by hand, so please allow a few days.

2. What we collect, where it comes from, and why

2.1 Account data. Your Steam ID and display name, which Steam provides when you sign in. On platforms without Steam you choose the display name yourself. This identifies your account, keeps your progress, and is what your opponents see. Your Steam ID is personal data: it does not carry your name on its face, but it identifies one account and one person consistently.

2.2 Match data. For each online match played through matchmaking: the two players, whether it was casual or ranked, the result each side reported, the status of the match, the ratings held at the time, and when it took place. We also store your rating and a count of games played and won. This settles results and runs matchmaking and the leaderboard. Games against the computer, and games at a room browser table, produce no such record.

2.3 Currency, items and purchases. Your Pegs and Crowns balances and the cosmetic items you own, so that what you earned or bought is still there next time. When you buy Crowns we store a record of the order and of any refund or chargeback. Steam also tells us the country and currency of your account, which is what lets the store show the right price and decline a sale it cannot make; neither is stored.

2.4 Anti-abuse data. A log of the Pegs awarded to you, which is what caps the rate at which Pegs can be earned, and a per-opponent count of your recent wins, which is what stops two players trading wins back and forth to inflate their ratings. Both hold counts and timestamps and nothing about the play itself.

2.5 Spending log. A record of what you spent in-game, so that a question about where a balance went can be answered.

2.6 Support correspondence. If you write to us, your email address and whatever you put in the message, for as long as it takes to deal with it.

2.7 Technical data. Cloudflare receives your IP address when you connect to our services. Our server uses that address to limit request rates and protect the services against abuse. Cloudflare processes it as part of providing hosting and rate limiting. We do not add your IP address to your player profile or purchase records.

2.8 No tracking. The game contains no analytics, telemetry, advertising or fingerprinting, and sets no cookies. This page sets no cookies and loads nothing from any other site.

2.9 Whether you have to provide it. Playing online requires the data in 2.1 and 2.2, and owning cosmetics requires the data in 2.3: without them those features cannot work and are not available. Playing on your own against the computer requires none of it, though on Steam the game still reports that a game finished so that your Pegs reach your account.

2.10 Terms acceptance on your device. Versions with a terms acceptance prompt save the accepted terms version and the time of acceptance locally on your device, associated with your Steam account identifier when available or with the local installation otherwise. This record lets the game remember your choice. It is not sent to our servers or included in the game's Steam Cloud files. Removing it causes the game to ask again before online play or purchases.

3. Legal bases for processing

Nothing here rests on consent, so there is no consent to withdraw. Where the basis is legitimate interests you may object; see 7.4.

4. Who has access to data

4.1 Cloudflare, Inc. hosts the servers and database and processes this data on our behalf, under a data processing agreement, on our instructions and for no purpose of its own.

4.2 Valve Corporation operates Steam. It provides your Steam ID and profile name to the game and handles your payments and refunds, as an independent controller rather than on our behalf, under its own privacy policy. When you earn an achievement, the game asks Steam to record it against your Steam account. We keep no copy of it; Steam does, and shows it on your Steam profile, which is public unless your Steam privacy settings say otherwise. The game also asks Steam which achievements you have already unlocked, so that a card back earned with one is granted to you; the answer is used on your machine only and is never sent to us.

4.2a On Steam, three of the game's own files are copied to Steam Cloud so that your things follow you from one machine to another: your settings, your single-player record, and your profile, which holds your display name. Valve stores those copies under the same policy linked above. If you would rather they stayed on the machine you are playing on, Steam Cloud can be turned off for this game from its Properties in the Steam client.

4.3 Other players see your display name. The in-game leaderboard lists the twenty highest rated players by name and rating, and can be read by anyone running the game. It identifies those players by name and rank only; no account identifier is published with it.

4.4 We will disclose data where legally required, for example in response to a valid legal demand, and where necessary to establish, exercise or defend a legal claim.

4.5 Nobody else receives your data. It is never sold, rented or shared for advertising, and there is no marketing list.

5. How long we store data

5.1 Account data, meaning your profile, balances, items and match records, for as long as you have an account or until you ask us to erase it. It is deliberately not expired on a timer, because that would take away cosmetics you paid for while you were away.

5.2 The log of Pegs awarded: thirty days.

5.3 The spending log: two years.

5.4 Records of real-money purchases, including refunds and chargebacks: seven years. These are financial records and tax and accounting law requires them to be kept even after an account is erased. See 7.3.

6. How we protect data

6.1 You have no password with us, and no payment details ever reach this game. Steam vouches for who you are, and buying Crowns happens entirely inside Steam's own payment window; all that returns to us is confirmation that an order succeeded.

6.2 Every request that reads or changes an account is proved with Steam before it is answered, and a request that merely claims to be an account is refused. All traffic between the game and our servers uses HTTPS. The database is reachable only by the game's own server code, and the keys that code uses are held as secrets, never published with the game or its source.

6.3 If a breach occurs that is likely to put you at risk, we will notify the players affected and the relevant supervisory authority within the deadlines the law sets.

7. Your rights, and how to exercise them

These rights come from the GDPR and the UK GDPR. We extend all of them to every player, wherever you live.

7.1 Access. Ask for a copy of everything we hold about you: profile, balances, items, purchases, the spending and Peg logs, and your match records. Your opponents are not named in it, because who they were is their information rather than yours.

7.2 Rectification. Have inaccurate data corrected. In practice the only field you choose is your display name: on Steam it is your Steam persona name, so changing it in Steam changes it here; on other platforms it is changed on the Profile screen.

7.3 Erasure. Ask us to erase your account, and your profile, balances, items, spending log and Peg log are deleted. Be certain before you ask: it cannot be undone and it includes cosmetics you paid for. Two things do not go. Records of real-money purchases are kept for the reason in 5.4, which is the exception the GDPR makes for a legal obligation. Match records are anonymised rather than deleted, because a match record belongs to two players and the other one's copy is theirs; your identifier is replaced and nothing links those records to you afterwards.

7.4 Objection. Object to anything done on the basis of legitimate interests, which here means the anti-abuse data in 2.4, the spending log in 2.5, and the rate limiting in 2.7.

7.5 Restriction. Ask us to stop processing your data while a dispute about its accuracy, or about our basis for holding it, is resolved.

7.6 Portability. The copy provided under 7.1 is machine readable, so you may keep it or give it to someone else.

7.7 How to ask. Email support@citradox.com from an address at which you can be reached, and say which Steam account it concerns. There is no form and no fee. We answer within one month, the deadline the GDPR sets, and usually within a few days. Nobody is treated worse, charged more, or given a lesser game for exercising a right.

8. Children

This game is not directed to children under 13 and we do not knowingly collect personal data from them. The Steam version uses a Steam account, and Steam requires its users to be 13 or older. Other versions can be played without Steam; the features available depend on the version. If you believe we have collected personal data from a child under 13, contact us at support@citradox.com so we can investigate and delete it.

9. Changes to this Policy

If this Policy changes in a way that matters, the dates at the top change and the new version appears here. This page is always the current version, and it is the only place this Policy is published.

10. Users in the EEA, the UK and Switzerland

10.1 Our servers are operated by Cloudflare and your data may be processed in the United States. Where personal data is transferred out of the United Kingdom or the European Economic Area, that transfer is made under the Standard Contractual Clauses in Cloudflare's data processing agreement.

10.2 You have the right to lodge a complaint with your supervisory authority. In the United Kingdom that is the Information Commissioner's Office. We would rather you told us first, at the address in 1.2, but you are not obliged to.

11. Users in California

11.1 We do not sell personal information and we do not share it for cross-context behavioural advertising, and we never have.

11.2 California residents have the rights to know, to delete, to correct, and to opt out of sale or sharing, together with the right not to be retaliated against for exercising them. Section 7 describes how each is handled here and applies to you.