Privacy Policy

Effective July 14, 2026

Omnicrafter collects as little as a multiplayer game can get away with. No ad-tech is baked into the game itself, there are no analytics trackers, and nothing is ever sold to anyone.

What we store

• Account: your username, hashed credentials (passwords are never stored in plain text; passkeys give us only a public key), and an optional recovery email you can remove any time.
• Gameplay: your cards, discoveries, combos, duels, trades, cosmetics, coin balance, and coin history.
• Abuse prevention: IP addresses, used for rate limits and daily budgets. Request logs keep IPs only in hashed form and rotate daily.
• Feedback: whatever you type into the feedback box, plus the contact you optionally attach.

Payments

• Coin packs are processed by Stripe (their privacy policy). Your card number goes to Stripe, never to us.
• We keep a record of each purchase — which pack, the price, the Stripe session id, and the account it credited — so support and refunds are possible.

Rewarded ads

• If you choose to watch an ad for extra discoveries, the ad is served by Google (H5 Games Ads). During the ad, Google may use cookies or device identifiers for serving, frequency capping, and fraud prevention — see how Google uses information from partners.
• Nothing ad-related loads until you press the watch-an-ad button; skipping ads means no ad network ever runs.
• We record which account watched an ad and when (for daily limits) — we don’t receive or store anything about you from the ad network.

Where it lives

• All game data lives in one SQLite database on our host (Render), continuously backed up. Traffic passes through Cloudflare.
• Card names, art, and lore are generated by third-party AI APIs; the only thing sent to them is the names of the cards being combined — never anything about you.

Your controls

• Delete your account any time from account settings — this removes your credentials and personal data. Purchase records are retained as required for accounting.
• Remove your recovery email any time.
• Guest accounts inactive for a long stretch are purged automatically.

Children

Guest play collects nothing beyond a nickname. Creating or securing an account requires confirming you are 13 or older; accounts found to belong to children under 13 are deleted along with their data.

Questions

Use the feedback link in the lobby footer — it goes straight to the person who runs this. Material changes to this policy will be flagged on the site.

See also the terms of service and the about page.