Privacy Policy

Last updated: 23 April 2026. This is the short, honest version of what we store and why. The full legal text follows.

1. Who is the data controller?

The data controller is the CrimeCode operator (Italy, EU). For questions, privacy requests, or GDPR complaints, contact hello@crimecode.cc or @OpCrime1312 on Telegram.

2. What we collect and why

When you message our bot or sign in

• Telegram user ID (numeric) and username if set — used to identify your account and deliver messages back to you. Stored in the customers table. Legal basis: performance of contract (Art. 6(1)(b) GDPR).
• Device label (app name + hostname) at sign-in time — stored in auth_sessions so you can see which devices have an active session. You can revoke any session from the Account dialog.

When you place an order

• Order record: plan, status, amount, creation time, confirmation time. No KYC data.
• Wallet transaction hash once confirmed on-chain — this is public information by definition.
• License token signature (12 bytes) — NOT the full token. We never store the part that a customer pastes into the app.

When you use cloud sync

• Anything you explicitly push via /license/sync/<key> — currently the app uses two keys, client.settings (preferences JSON) and client.recent-projects (list of recent folder paths and names). You control what's pushed; we never scrape the rest of your filesystem.
• Max 64 KB per key. Stored unencrypted at rest on the server disk, but transmitted only over HTTPS.

When you create or join a team

• Team name, member list (customer IDs), roles, pending invite identifiers (Telegram handles or emails).
• Live-session metadata (title + small JSON state) for the duration of the session; cleared when you end it or after 90 seconds of no heartbeat.

When an error happens

• A stack trace + the HTTP path/method that triggered the error is sent to Sentry. Sentry is configured with sendDefaultPii: false, so we never forward your IP, cookies or user agent. You can see the exact capture code in packages/opencode/src/license/sentry.ts in our public repo.

3. Cookies and local storage

The website at crimecode.cc does not use tracking cookies. The web IDE and the desktop app use localStorage on your own machine for:

• The signed session JWT (crimecode.session).
• Your active workspace preference (client.active-workspace).
• Your settings snapshot and recent project list (also synced to the cloud when you're signed in).

No third-party analytics, no advertising, no fingerprinting.

4. Payment data

We do not touch payment cards or PayPal. Payments happen on-chain. The only data we see is the public blockchain transaction: from wallet, to wallet, amount, tx hash, timestamp. We record the tx hash against your order so you can trace it.

5. Who we share data with

• Fly.io (Delaware, USA — EU region Frankfurt) — hosts our server and database.
• Tigris Data (Delaware, USA, EU region) — S3-compatible backup storage, receives nightly encrypted copies of the database.
• Telegram Messenger LLP — delivers bot messages to you. Telegram sees the bot-chat content (the bot is how we get messages to you). Telegram has its own privacy policy at telegram.org/privacy.
• Cloudflare — CDN and DNS for crimecode.cc. Sees request metadata (IP, URL, timestamps) for the web app only. The desktop app talks to api.crimecode.cc directly.
• CoinGecko — USD→crypto exchange rate. We send them no user data; we just fetch the public rate.
• mempool.space, litecoinspace.org, etherscan.io, Blockcypher — block explorers queried by our on-chain payment poller. We only send wallet addresses and they see that our server is polling them; no user data leaves.
• Sentry (Delaware, USA — EU region Frankfurt) — receives error traces without PII.

We do not sell your data and never will. We do not share it with advertisers, governments, or other third parties outside of a valid legal request.

6. Retention

• Customer and license records: kept for as long as the license is active, plus 24 months after the last expiry, so we can honour reactivation requests.
• Auth sessions: 30 days from issue, automatically purged.
• Pending invites: kept until claimed or cancelled.
• Live-session metadata: kept for 30 days after the session ends, then purged.
• Audit log: 12 months.
• Backups: rolling 30 days on Tigris, then overwritten.

7. Your GDPR rights

If you are in the EU/EEA, you have the following rights under GDPR:

• Access — request a copy of everything we hold about you.
• Rectification — correct anything that's wrong.
• Erasure ("right to be forgotten") — delete your account and all its data.
• Restriction — pause processing while you investigate a concern.
• Portability — receive your data in a machine-readable format (JSON).
• Objection — object to processing that relies on legitimate interests.
• Complaint — file a complaint with your local supervisory authority (in Italy: Garante per la Protezione dei Dati Personali, gpdp.it).

To exercise any right, message @OpCrime1312 from the Telegram account you signed up with, or email hello@crimecode.cc. We respond within 30 days.

8. Children

CrimeCode is not directed at children under 16. We do not knowingly collect data from minors. If you believe a child has created an account, please let us know and we'll delete it.

9. International transfers

Although we host in the EU, some processors (Fly.io, Tigris, Sentry) are incorporated in the United States. Data transfers from the EU to the US rely on Standard Contractual Clauses (SCC) as approved by the European Commission in June 2021.

10. Security

We use HTTPS everywhere, HMAC-SHA256 signed session tokens, Basic Auth with SHA-256 hashed admin passphrase, at-rest encryption of Tigris backups, and automatic backups every 12 hours. The source of the backend is mostly open-source — you can audit exactly what we do at github.com/flamematch23-lgtm/CrimeCode-IDE.

11. Changes

We may update this policy occasionally. Material changes will be announced on this page with a new "last updated" date at least 14 days before they take effect. If the change expands the scope of data we process, we'll also message it to you via the Telegram bot.