Privacy Policy
Last updated 29 October 2026
This policy explains what personal data Crib Club holds, why, and what you can do about it. Crib Club is run by Oarsman Software Ltd, company number 16652196, registered office Unit 82a, James Carter Road, Mildenhall, Bury St. Edmunds, England, IP28 7DE. We're the controller of the personal data described here, registered with the Information Commissioner's Office under number ZC089111. Contact us at hello@cribclub.co.uk.
- We collect only what's needed to run games, chat, clubs and memberships. We don't ask for your email address.
- No advertising, no analytics and no tracking cookies. We never sell your data.
- Other players see your name at the table, your games and your chat messages.
What we collect and why
| What | Whose | Why | Lawful basis |
|---|---|---|---|
| Username, name at the table and password (stored only as a secure hash), when you joined and when you last signed in | Everyone with an account | Your account, signing in, and showing your name to other players | Contract |
| Login sessions (stored only as a secure hash) and when they expire | Everyone with an account | Keeping you signed in | Contract |
| Games: the tables you open or sit at, the cards, the scores and the game log | Players | Running the game | Contract |
| Chat messages, with who sent them and when | Members who chat | Table chat | Contract |
| Clubs: the club’s name, description, colours and logo, its members’ names, and the results of their games | Club members, including people a manager adds who don’t use Crib Club | Running the club, its results and its leaderboard | Contract; for people added by a manager, the club’s legitimate interests in keeping its records |
| Membership: Stripe’s references for your subscription and customer record, and whether it’s active; or the date any free membership ends | Members | Knowing who has a membership, and handling refunds | Contract |
| Notifications: your choice of what to be told about, and for each device you turn them on for, the address its browser gave us for sending to it | Players who turn notifications on | Telling you when a game needs you | Contract |
| Server logs: IP address, browser type, pages requested and time; and a record of payments and of what admins change | Everyone | Keeping the service secure, limiting repeated failed sign-ins, and fixing faults | Legitimate interests |
We don't store your card details or, unless you email us, your email address. Stripe holds those when you pay.
Who sees what
- Only people who are signed in can see tables. They see the list of tables, with the names of the players sitting at them.
- At a table, everyone, including people watching, sees the players’ names, the scores, the game log and the chat. Each player sees only their own cards until the show. If whoever opens the table allows it, people watching without a seat see every hand.
- A club’s pages are only shown to its members.
- Other players see your name at the table, never your username.
Cookies
We use one cookie, called crib_session. It keeps you signed in for up to 30 days, or until you sign out, and the service can't work without it. We don't use analytics or advertising cookies.
Our pages load their fonts from Google Fonts, so your browser connects to Google, which receives your IP address. See Google's privacy policy.
Who at Crib Club can see it
A small number of Oarsman Software staff are admins. They can see account details and every club so they can help with support, payments and reports of misuse, and everything they change is recorded.
Who we share data with
- Stripe takes payments for membership on its own checkout page, and runs the page where members manage or cancel. Stripe receives your card details and email address directly, and we never see your card number. See Stripe's privacy policy.
- Hetzner Online GmbH hosts our server in Germany.
- Google serves our fonts, as above.
- Your browser's notification service (Google for Chrome and Android, Apple for Safari and iPhones, Mozilla for Firefox, Microsoft for Edge on Windows) delivers notifications, if you turn them on. Each one is encrypted so that only your device can read it.
- Nobody else, unless the law requires it or it's needed to prevent fraud or protect people's safety.
Hetzner's data centres are in Germany, which UK law recognises as giving adequate protection. Stripe and Google may process data in other countries, including the United States, under their own legal safeguards.
How long we keep it
- Accounts: until you ask us to close yours.
- Login sessions: 30 days, or until you sign out.
- Games: until the table is closed by the player who opened it or by an admin.
- Chat: the last 100 messages at each table, until the table is closed. You can remove your own messages at any time, and closing your account deletes them all.
- Clubs: until the club is deleted. When you leave a club or close your account, the club’s records keep your name and results, unless you ask the manager or us to remove them.
- Notifications: a device's address until you turn notifications off on it, sign out on it, or its browser tells us it's no longer used.
- Payment records: Stripe keeps them for six years after the end of the financial year they belong to, because tax law requires it.
- Server logs: about 30 days.
Your rights
You can ask us to give you a copy of your data, correct it, delete it, restrict or object to how we use it, or send it to you in a portable format. Email hello@cribclub.co.uk with your username. We'll reply within one month, and it's free in almost all cases. We may need to check it's really you before we act.
If a club has added you to its members list, you can also ask its manager to change or remove your entry.
Children
You must be 13 or over to have a Crib Club account. If you think a child under 13 has an account, tell us and we'll delete it.
Keeping data safe
Crib Club only works over an encrypted connection (HTTPS). Passwords are stored as one-way hashes, so nobody, including us, can read them, and only people who run the service can access the server.
Complaints
If you're unhappy with how we've handled your data, please tell us first at hello@cribclub.co.uk. We'll acknowledge your complaint within 30 days and tell you the outcome as soon as we can. You also have the right to complain to the Information Commissioner's Office, the UK's data protection regulator: ico.org.uk/make-a-complaint or 0303 123 1113.
Changes to this policy
If we change this policy, we'll update the date at the top. If a change significantly affects how we use your data, we'll show a notice on the site before it applies.
See also our Terms of Service.