Privacy policy

Last updated 26 September 2026

HUSHCRASHER (60 rue François 1er, 75008 Paris, France) is the controller of the personal data processed on hushcrasher.com and its tools. This policy explains what we collect, why, for how long, and your rights under the GDPR and French law. Data protection contact: [email protected].

What we process and why

  • Using the tools. The figures you enter (team size, game features, prices) are processed to compute results and are not stored with any identifier. No account is needed.
  • Signing in. Your email address, a hashed one-time code valid 10 minutes, and a session cookie valid 30 days. If the address isn't subscribed, we send it an email explaining how to subscribe, instead of a code. Purpose: give newsletter subscribers access to every field of the tools. Legal basis: performance of the service you request.
  • Checking access. We check your email against our copy of the Hushcrasher newsletter subscriber list, kept in sync with Substack, to give you access to the tools. While you're signed in, this check runs on each visit, so unsubscribing ends the access. Legal basis: performance of the service you request.
  • Security log. For each sign-in attempt: email, time, IP address, browser user agent, outcome. Purpose: detect abuse and support you. Legal basis: our legitimate interest in securing the Service.
  • Contact form. Name, email and message, sent to us by email. Purpose: answer you. Legal basis: our legitimate interest in responding to requests.
  • Newsletter. Managed by Substack under its own privacy policy; we see subscriber emails and payment status. Legal basis: consent.
  • Analytics. We use GoatCounter, a privacy-friendly tool that counts page views without cookies and without building profiles. Legal basis: legitimate interest in measuring audience.
  • Anti-bot protection. Cloudflare Turnstile checks that form submissions come from humans and may process technical data such as IP address and browser characteristics. Legal basis: legitimate interest.

We do not sell personal data and we do not use it for advertising.

Who receives the data

  • Cloudflare, Inc. (United States): hosting, database, anti-bot protection, network security.
  • Mailgun Technologies, Inc. (email sent from its EU region): delivery of sign-in codes and contact messages.
  • Substack, Inc. (United States): newsletter hosting and subscriptions.
  • GoatCounter (Netherlands): audience statistics.

Transfers outside the European Economic Area rely on the EU-US Data Privacy Framework where the recipient is certified, or on the European Commission's standard contractual clauses.

How long we keep it

  • One-time codes: 10 minutes, then overwritten or deleted.
  • Session cookie: 30 days, renewed while you use the Service.
  • Security log: 12 months.
  • Contact messages: 12 months after our last exchange.
  • Audience statistics: aggregated, without personal data.

Cookies

The Service sets one strictly necessary cookie, named "session", set after you enter a code, that keeps you signed in for 30 days. Cloudflare Turnstile may set a technical cookie on forms it protects. We set no advertising or cross-site tracking cookies, and GoatCounter works without cookies, so no consent banner is required.

Your rights

You may access, rectify and erase your data, restrict or object to processing, ask for portability, and withdraw consent at any time without affecting past processing. Write to [email protected]; we answer within one month. You may also lodge a complaint with the CNIL (www.cnil.fr) or the authority of your country of residence.

Security

Data travels over HTTPS, sign-in codes are stored hashed, sessions are signed tokens, and access to production systems is limited to the two company officers. No system is perfectly secure; tell us at [email protected] if you notice a problem.

Children

The Service is intended for professionals and is not directed at children under 16.

Changes

We update this policy when our processing changes and indicate the date at the top.