Browsing the website does not require an account. Account and Steam identity, collection and transaction records support online gameplay; access logs support operations and security. Game servers are in Hong Kong, China. We do not sell personal data or serve behavioral advertising on these pages, and do not request contacts, precise location, microphone or camera access.
01Scope and legal grounds
This policy covers ccrgame.com, CCR clients and related online game services. Steam, Discord and other external platforms apply their own policies to their independent processing. Data we receive from those platforms and process ourselves remains covered here.
We process data only on grounds permitted by applicable law, such as performing the game service you request, meeting legal duties or obtaining consent when required. Where permitted, necessary service security and fraud prevention may rely on balanced legitimate interests. This does not replace consent or other legal conditions required elsewhere.
Browsing public pages does not require a game account. Refusing optional information does not prevent other basic services. Without information essential to authentication or item settlement, we cannot provide the relevant online feature.
02Data and purposes
Accounts and authentication: player ID, internal CCR account identifier, email and password hash for email sign-in, or Steam user identifier, authentication result, linking relationship and registration status for Steam. These support account creation, sign-in, recovery, security, duplicate prevention and merges you request. We do not ask for your Steam password.
Sessions and preferences: session identifiers, hashed refresh credentials, expiry, status and last activity, plus your chosen language, avatar, country/region, titles, favorite Relic and display preferences. These keep you signed in, display profiles and save settings. A self-selected region is not precise device location.
Gameplay and economy: level, experience, Energy, currency, cards, Relics, draw and forging results, Vault, achievements, operation identifiers, asset and wallet ledgers, auction listings, bids, settlements, in-game mail and claim status. These preserve collections, execute requests, reconcile transactions, investigate errors and prevent fraud.
Access and security: IP address, time, request path, response status, referring page and browser/client request headers received by the server, along with error, performance and unusual-operation records where generated. These deliver content, diagnose problems and protect services, without extracting contacts or private files.
Support and feedback: your sender email, message and necessary order references, screenshots or evidence you choose to provide. These allow replies, identity checks, troubleshooting and appeals. Avoid sending irrelevant sensitive information.
Purchase processing applies only if the feature is offered and you make a purchase. Platforms handle payments; we receive necessary order, delivery and refund status as relevant, without asking for payment passwords or full card information. New identity checks, advertising, platform sign-ins or SDKs require actual-use disclosures and applicable procedures before introduction; reserved database fields do not mean data is collected.
03Information other players may see
Player ID, game avatar, selected region, titles, favorite Relic and some collection or ranking information may appear in clearly provided leaderboards, auctions and player detail views. Rankings may include Gold, collection totals and Cosmic Power; auctions show item and bidding status needed for trading.
Do not put real names, emails, phone numbers or other private details in player IDs or displayed profiles. Email addresses, password hashes, session credentials and internal security logs are not public player profile fields. Where particular public disclosure requires consent or other conditions, we must meet them separately; this policy alone does not replace them.
Necessary aggregate statistics may help us understand service operation, collecting and trading. Data that can still identify an account remains protected personal data; merely removing a name is not anonymization.
04Cookies, local storage and permissions
The homepage, Wiki and legal pages published in this release use static content and a first-party language-switching script, without advertising tracking cookies or third-party behavioral analytics scripts. Requests still generate server logs. External platform links open only when you follow them, and those websites may use their own cookies.
The game client stores settings, resource caches and sign-in session information locally. Some credentials use operating-system protection or device binding, depending on platform capability. Other users of a shared device may access a signed-in game; secure your device and sign out when needed.
These pages do not request contacts, camera, microphone or precise location. Before adding optional storage, analytics or permissions, we will explain purpose, scope and choices and obtain consent where needed.
05Providers, platforms and disclosure
Tencent Cloud provides infrastructure hosting in its Hong Kong region for the website, API and database. Providers should process hosted data only within necessary instructed purposes and appropriate confidentiality and security requirements.
Steam / Valve provides downloads, platform identity verification and available order services. Steam sign-in sends necessary verification information to Steam and receives identity validation results. You choose whether to visit community links such as Discord; these pages do not embed their tracking components.
When you email ccr@ccrgame.com, sending and receiving mail providers process necessary addresses, content and attachments to deliver and store mail. Email is not a channel for passwords, verification codes or full identity documents.
We do not sell personal data or provide it to advertisers for cross-site behavioral advertising. We do not disclose it to unrelated parties except as you request or authorize, as needed for instructed services, lawful authority requests or necessary protection of legitimate rights.
For a business transfer involving personal data, we will identify the recipient and contact details and require continued safeguards. Changed purposes or methods require fresh consent where applicable. Independent third-party disclosure, public disclosure or processing requiring separate consent will receive the necessary additional notice and procedures.
06Storage and international transfers
The principal website and game servers and database are currently hosted in Tencent Cloud’s Hong Kong, China region. Using services elsewhere involves transmitting information to Hong Kong. Steam authentication and email delivery may also involve processing in platform or mail provider locations.
Hong Kong’s data protection rules may differ from mainland China and other locations. This location notice is not separate transfer consent and does not itself complete any required transfer procedure. Where applicable law requires assessments, contractual safeguards, certification, separate consent or other measures, we must meet them before the relevant processing, or restrict that processing or service if we cannot.
07Retention, deletion and backups
Account information and progress are generally retained while the account exists and they are needed to provide the service. Session information is managed according to validity, security and revocation needs. Transaction and asset ledgers may be needed for settlement, reconciliation, fraud prevention, disputes or legal duties; closure is not a promise to erase all ledgers immediately.
Website access logs currently rotate daily with up to 10 rotated files plus the active file: approximately 10–11 days under normal daily rotation, depending on requests and rotation operation. This is not the retention period for game ledgers, support email or backups.
Other game security logs, support material and backups are kept for the shortest reasonable period required for their purposes, with periodic review. Disputes, investigations or legal requirements may justify longer retention limited to those purposes.
Data no longer needed or legally subject to deletion is deleted or anonymized. When immediate removal from backups or other systems is impracticable, it should be isolated from further use except storage and necessary security, then removed when backup replacement or deletion becomes feasible.
08Security and incidents
We use HTTPS, password hashing, session validation, necessary access controls, server-side transaction checks and audit records to protect information. No measure eliminates all risk; we continue addressing identified issues.
If a personal data incident occurs, we will take remedial steps, assess impact and notify affected users and authorities as required by applicable law. Email us if you suspect exposure, account theft or unusual data access.
09Your rights and requests
Available game settings let you view or correct some information. For matters without a self-service option, email ccr@ccrgame.com with “Privacy request” and a brief account reference and request. Account closure, export and deletion are currently handled by manual request; these pages do not claim a one-click feature exists.
Depending on applicable law, you may have rights to information, access, copies, correction, completion, deletion, closure, withdrawal of consent, restriction, objection and portability. You may request an explanation or complain to a competent regulator. Withdrawal does not affect lawful processing before withdrawal.
We verify that a request comes from you or an authorized representative, asking only for necessary evidence and never your password. We respond within applicable statutory deadlines after verification. We explain any lawful extension, retained records, third-party rights or other limitations and available remedies. Ordinary reasonable requests are generally free.
Deletion or closure may affect sign-in, collections, unsettled auctions or other entitlements; we explain consequences beforehand and do not impose unreasonable barriers. Clearing a local cache or uninstalling the client does not delete your server account.
10Children and guardians
The service is not specifically directed to children. We follow applicable age, guardian and data protection requirements. Where mainland China law applies, personal data of children under 14 is sensitive personal information and requires lawful processing conditions and necessary guardian consent and safeguards.
This policy does not claim that identity or age verification has already been implemented. General-audience positioning does not replace child protection duties. On learning of child data without required authorization or safeguards, we will investigate, restrict processing and delete it or take other appropriate legal steps. Guardians can request access, correction or deletion by email.
11Updates and contact
This version is published and effective on 31 October 2026. Material changes to purposes, data categories, recipients or rights will be clearly explained through the website, game notices or another effective channel, with new consent where required.
Responsible operator: Nan. Service and privacy contact: ccr@ccrgame.com. Include only information needed to investigate your request and avoid unrelated sensitive material.