Privacy Policy

Effective October 25, 2026

Omnicrafter stores account and gameplay data to run the game. The website also uses Google advertising services and the Meta Pixel for measurement. This policy explains those uses and your account controls. An email address is not required to play; a recovery email is optional.

What we store

• Account: your username, hashed credentials (passwords are never stored in plain text; passkeys give us only a public key), and an optional recovery email you can remove any time.
• Gameplay: your cards, discoveries, combos, duels, trades, cosmetics, coin balance, and coin history.
• Abuse prevention: IP addresses, used for rate limits and daily budgets. Request logs keep IPs only in hashed form and rotate daily.
• Feedback: whatever you type into the feedback box, plus the contact you optionally attach.

Payments

• Coin packs are processed by Stripe (their privacy policy). Your card number goes to Stripe, never to us.
• We keep a record of each purchase — which pack, the price, the Stripe session id, and the account it credited — so support and refunds are possible.

Google advertising

• The website loads Google's advertising script when you open the game, before you choose whether to watch a rewarded ad. Skipping rewarded ads does not prevent that script from loading.
• Google advertising services, including H5 Games Ads for rewarded ads, may use cookies or device identifiers for ad serving, measurement, frequency capping, and fraud prevention. See how Google uses information from partners.
• We record rewarded-ad sessions and their outcomes against your account to grant rewards and enforce daily limits.

Meta Pixel measurement

The main game website at omnicrafter.io loads the Meta Pixel when the game opens. We use the events it sends to understand how people find and use the game and to measure and improve advertising campaigns. The Pixel sends Meta these events from your browser:

• Page view when the game opens, and ViewContent when the game board loads.
• Gameplay milestones: your first craft (sent twice, as "FirstCraft" and "first_craft"; the second also says you are a new player and, if you arrived from one of our ad links, the campaign name from that link), reaching five crafts, and each world-first card you discover ("card_created").
• Return visits: a "ReturnVisit" event when this browser comes back on a later day.
• CompleteRegistration when a guest account becomes a full account (by email code, password, or passkey), including which of those methods you used.
• InitiateCheckout when you start buying a pack, and Purchase when the purchase completes. These carry the price (value and currency, US dollars) and the pack's id. Your card details are never included.

Each event also carries a random event id so duplicate copies can be matched up. Meta may use cookies or similar identifiers and receive browser and device information through the Pixel, including the address of the page (which can include campaign parameters from an ad link). See Meta's Privacy Policy for how Meta uses this information. The Pixel is separate from rewarded ads and does not wait for you to watch an ad. It is disabled in the CrazyGames portal build.

Meta Conversions API

We may also send some of these events to Meta directly from our server through Meta's Conversions API. This is switched off today. When it is turned on, our server can send:

• the first craft, registration, and world-first card events described above, after checking them against your account;
• Purchase, when Stripe confirms a payment: the price, currency, and pack id from our purchase record, and the Stripe checkout session id as the event id;
• "return_d1", when an account makes its first craft on the day after it was created.

With these server events we send your username in hashed form (SHA-256, never the username itself), plus your IP address, your browser's user agent, and Meta's own first-party cookies (_fbp/_fbc) if your browser has them. We do not send your email address (hashed or otherwise), your password, or your card details to Meta. Gameplay events from the CrazyGames portal are never sent, and nothing is sent for accounts that first arrived through CrazyGames.

Where it lives

• Our account and gameplay data lives in one SQLite database on our host (Render), continuously backed up. Traffic passes through Cloudflare.
• Card names, art, and lore are generated by third-party AI APIs; the only thing sent to them is the names of the cards being combined — never anything about you.

Your controls

• Delete your account any time from account settings — this removes your credentials and personal data. Purchase records are retained as required for accounting.
• Remove your recovery email any time.
• Guest accounts inactive for a long stretch are purged automatically.
• To limit Meta ad tracking, block third-party cookies or Meta's script in your browser (for example with a content blocker), or play through the CrazyGames portal, where the Pixel is off. Browser blocking does not stop server-side Conversions API events once those are turned on. You can also manage how Meta uses activity from other websites in your Meta account's activity off Meta technologies settings and ad preferences.

Children

Guest play creates an account and uses the data practices described above. Creating or securing an account requires confirming you are 13 or older; accounts found to belong to children under 13 are deleted along with their data.

Questions

Use the feedback link in the lobby footer — it goes straight to the person who runs this. Material changes to this policy will be flagged on the site.

See also the terms of service and the about page.