Legal draft · Updated 11 August 2026
This is a pre-launch draft. Public account registration remains closed until the individual operator is identified here.
CrackMac Creative Studios is an unregistered, non-commercial personal project. Public account registration remains closed. The individual operator's legal name must be inserted here before registration can open. Contact: [email protected].
When you create an account we store your email address, chosen profile name, password hash, verification state, accepted terms version, account dates, signed-in device labels, session dates, security events and, when available, your claimed product library. Your profile name may be an alias. Passwords and active session tokens are not stored in readable form. Application security events use only an approximate network prefix and do not store your full IP address or browser user-agent. If you turn on CrackNote sync, we also store an encrypted copy of your CrackNote tasks, notes and projects, sealed on your device with a passphrase only you know; we cannot read it, and it is erased with your account or from CrackNote's settings.
We process core account, profile, session, library and service-email data because it is necessary to provide the account service and take the steps you request under the terms. We process rate-limit and security records for our legitimate interest in preventing abuse, protecting accounts and diagnosing security incidents. We may retain or disclose limited records where a legal obligation requires it. Account data is not used for advertising or sold.
An email address, profile name, password and acceptance of the current terms are required to create an account; without them the account cannot be provided. The profile name does not need to be your real name. A future claimed-product library is optional until you choose to claim something. The service does not profile you or make decisions with legal or similarly significant effects. Automated rate limits may temporarily delay repeated requests to protect the service.
Cloudflare provides the account Worker and D1 database. Resend, operated by Plus Five Five, Inc., receives the destination email address, display name and verification or reset-message content needed to send account email. Processing may occur outside the European Economic Area under the providers' data-processing terms and transfer safeguards, including standard contractual clauses where applicable. Copies of or questions about those safeguards can be requested at [email protected].
Your profile and library remain while the account is active. Verification links expire after 24 hours, password-reset links after 30 minutes and launcher authorization codes after 2 minutes. Website sessions expire after 14 days and launcher sessions after 30 days; old expired or revoked session records are removed after 30 days. Rate-limit records are removed after 2 days and application security events after 30 days. Deleting the account removes its profile, sessions and library from the live account database, subject to provider backup expiry and any legal preservation duty.
The account page lets you correct your profile name, review and revoke devices, download a machine-readable copy of your account data and permanently delete the account. You may also ask for access, correction, erasure, restriction, portability or object to processing by contacting [email protected]. Requests are normally free. We may need to confirm your identity before acting.
Contact [email protected] first so we can investigate a privacy request or concern. You also have the right to lodge a complaint with the Dutch supervisory authority, the Autoriteit Persoonsgegevens, at autoriteitpersoonsgegevens.nl, or with another competent supervisory authority.
