Privacy Policy Your data, handled with care.

This notice describes the current website account service and distinguishes it from the planned Android and Windows game. The data controller is Cyrazz Digital Solutions, a sole proprietorship (eenmanszaak), at Loolaan 41-76, 7314AD Apeldoorn, The Netherlands. Dutch Chamber of Commerce (KVK): 42001435. VAT ID: NL005425491B66. Cyrazz Studio's and A State of Cult are the credited creators. Complete app disclosures still need to be finalised; this is not yet a complete launch privacy notice.

For privacy questions, account deletion or other data requests, contact info@midnightcrownseries.com.

The website account service processes:

• Your email address, username, email-verification status and a salted password hash, not a readable password.
• Your selected voice preference, ranking points, tournament registrations and reminder preferences.
• Authentication sessions, verification and password-reset records.
• The accepted Code of Conduct version and server timestamps of your conduct acknowledgment and self-declared confirmation that you are 18 or older; these are not independent age verification.
• IP addresses and, for some requests, email addresses used to limit abusive requests, plus technical request and error records.
• Information you choose to include when contacting support.

Your username and ranking points can appear on the public leaderboard. Choose a username you are comfortable making public; your account email and password are not leaderboard fields.

The complete app data inventory still needs confirmation, including whether progress, hand histories, virtual balances, voice or chat, private-room invitations, purchases and diagnostics remain on your device or are sent to online services. A voice preference is not itself an audio recording.

• Account creation, sign-in, password recovery, requested preferences and tournament registration: performance of the account agreement, where necessary to provide those services.
• Conduct acknowledgment and adult self-declaration records: performance of the account agreement for eligibility checks, and legitimate interests in demonstrating which rules were accepted and resolving disputes. This is not consent to unrelated processing or independent age verification.
• Security logs and request limits: legitimate interests in preventing unauthorised access and abuse and maintaining a secure service, subject to balancing those interests against your rights.
• Support: performance of the agreement for account-related help, or legitimate interests in answering other enquiries.
• Handling data-rights requests and legally required records: compliance with applicable legal obligations.

A verified purpose and legal basis for public ranking publication, including applicable objection or visibility arrangements, must be confirmed before launch. This notice is not blanket consent to unrelated processing. If an optional activity relies on consent, it must be requested separately and be withdrawable without affecting earlier lawful processing.

The registration fields are needed to create and secure an account; if you do not provide them, an account cannot be created. This does not require you to provide unrelated personal information.

The account service stores a sign-in token in local storage for persistent sign-in, or session storage for the browser session. Signing out removes that token from this browser. Server sessions are valid for one day, or up to 90 days for persistent sign-in; an expired token may remain in browser storage until it is cleared.

The website also requests externally hosted fonts. A full inventory of hosting diagnostics, external recipients, cookies and app SDKs still needs confirmation. We therefore do not make a blanket promise that the complete website and app never use tracking. Any non-essential tracking requiring consent must not run before valid consent, and refusal must remain possible.

Providing online accounts involves hosting and database services. Font delivery, technical diagnostics, support and any future email, payment or app-store services can involve additional recipients. Those recipients may act as processors or independent controllers depending on their role.

The actual provider inventory, locations and contractual safeguards have not yet been verified. Before launch, this notice must specify the relevant recipients or categories and, if data is transferred outside the EEA, the applicable adequacy decision or other lawful safeguards and how to obtain information about them. No claim that all processing stays within the EU is made here.

Active account information is used while the account is maintained. Verification and reset codes expire after 30 minutes; expiry is not the same as deletion. The current service opportunistically cleans expired sessions, unverified accounts older than seven days and rate-limit entries older than one hour during certain requests; these are not guaranteed timed deletion deadlines.

To request account or personal-data deletion, send an email yourself to info@midnightcrownseries.com. Support and privacy requests use this email channel, not an automated website contact form; no self-service deletion button is currently provided. Requests must be assessed under the GDPR, including any lawful retention exceptions. A complete retention schedule for support correspondence, technical logs, backups, rankings and app data, and the procedure for fulfilling deletion requests, still need confirmation before launch.

Subject to the GDPR’s conditions, you may request access, correction, erasure, restriction and data portability. You can object to processing based on legitimate interests, and withdraw consent for any activity that actually relies on consent. You may complain to the Autoriteit Persoonsgegevens or another competent supervisory authority, without contacting us first.

Send requests to info@midnightcrownseries.com, preferably from your account email. Identity verification must be proportionate; do not send an identity document unless a justified, secure process is explained. Responses are normally due within one month; a permitted extension of up to two further months must be explained within the first month. Requests are normally free, subject to the GDPR’s limited exceptions.

The current account implementation uses salted password hashes, hashed session tokens, expiring verification codes and request limits. These measures do not guarantee absolute security. Transport protection, access controls, log handling and the complete app and online-table infrastructure require production verification. Never share passwords or verification codes with support or other players.

Accounts are restricted to people aged 18 or older, with explicit self-declaration at registration. The service is not offered to children; this declaration is not independent age verification. AI-controlled poker opponents are gameplay features, not in themselves GDPR Article 22 decisions. Any profiling or solely automated decision with legal or similarly significant effects must be assessed and disclosed separately, with safeguards where required.

We may update this policy from time to time. The latest version is always published on this page.