Last updated: October 3, 2026
This policy explains how Koha-Tech sp. z o.o. handles personal data for Corsair Tides, including play on CrazyGames and on our own clients. It is the policy for corsairtides.com.
1. Who we are
The controller is:
Koha-Tech sp. z o.o. (KOHA-TECH)
Nowy Świat 33/13, 00-029 Warszawa, Poland
KRS: 0001183713
NIP: 5253054129
REGON: 542256381
Privacy: [email protected]
2. Why this notice exists
CrazyGames already receives its own SDK events (loading, gameplay start and stop, mute, and room presence). Corsair Tides also keeps a game account on our servers. That account is additional personal data, so this notice is shown to players. Continuing to play is enough. We do not ask you to accept a blocking popup before the harbor loads.
3. What we collect
CrazyGames play
- Your CrazyGames user id and username, taken from the signed user token the CrazyGames SDK gives the game. We store a hash of the user id, not the raw token.
- The username as your captain name, shown to other captains in your lobby and match.
- Game progress tied to that account: gold, experience, ships, fittings, champions, crew, chests, materials, and the newest match results (placement, kills, extraction, gold, and experience).
Our own Windows or browser client, when you are not signed in through CrazyGames
- A random device identifier created on that device and a display name (the default is “Captain”). We store a hash of the device identifier. The identifier and your session stay in local game storage on that device so the same captain can be resumed.
Every online client
- A session token. We store only a hash of it. A session lasts 30 days, and we keep at most eight recent sessions for an account.
- Your IP address, only in memory, to limit abusive request rates. We do not add it to your captain profile.
- Voyage inputs needed to run the shared sea: steering, sails, movement, and combat actions. We do not accept client-claimed positions, damage, or rewards as truth.
What we do not collect on CrazyGames
- Email address, phone number, postal address, or payment card data.
- Real-money checkout. Captain’s Vault purchases through Stripe are refused for CrazyGames accounts.
- Our own advertising profile or a separate analytics SDK.
If real-money checkout is later offered on a Koha-Tech client outside CrazyGames, Stripe processes the card payment. We would store the order id, product, price, and paid or expired state, bound to the captain account. We would not store the card number.
4. Why we use it
| Purpose | Legal basis (GDPR) |
|---|---|
| Create and resume your captain, save progress, and run matches you join | Contract, Art. 6(1)(b) — providing the game you chose to play |
| Show your captain name to the other people in that lobby or match | Contract, Art. 6(1)(b) |
| Rate-limit requests, reject invalid sessions, and keep the service available | Legitimate interest, Art. 6(1)(f) |
| Keep a record if a real-money purchase is ever completed outside CrazyGames | Legal obligation and contract, Art. 6(1)(c) and 6(1)(b) |
We do not use this data for our own marketing, and we do not sell it.
5. Who else receives it
- CrazyGames, when you play on that portal. Their SDK and your CrazyGames account are covered by CrazyGames’ own privacy policy. We only receive the user id and username inside the signed token.
- Other players in the same lobby or match see your captain name and the actions your ship takes.
- Our host, which runs the game API and database for us.
- Stripe, only for a real-money purchase on a non-CrazyGames client, and only if that checkout is enabled.
Game data is stored for Koha-Tech sp. z o.o. We do not transfer it outside the European Economic Area for our own account service. CrazyGames and Stripe publish their own transfer terms for data they process.
6. How long we keep it
We keep the captain account, progress, and settlement records while the account exists. Session tokens expire after 30 days. Rate-limit entries expire within about a minute and are not written to the account database.
You can ask us to delete the account. We delete or irreversibly unlink the captain, progress, and sessions unless a narrow legal duty requires a payment record to be kept. CrazyGames can still hold the portal account under their policy.
7. Children
Corsair Tides is not directed at children under 16. We do not ask for age or a parent’s contact details. On CrazyGames, the portal account is CrazyGames’ account. If you believe a child has a captain account with us outside that portal, write to [email protected] and we will delete it.
8. Your rights
If GDPR applies, you can ask for access, correction, deletion, restriction, portability, or object to processing based on legitimate interest. To use these rights, email [email protected]. You may also complain to the Polish supervisory authority, UODO, at uodo.gov.pl.
9. Changes
We will change the “Last updated” date when this policy changes. The current text is published at https://corsairtides.com/privacy.