Privacy Policy
Last updated: 15 October 2026
This policy explains what personal data Alpha Crews HQ collects, why, how long we keep it, and your rights. We collect as little as we can. We don't ask for your real name, we don't use advertising or analytics trackers, and we never sell your data.
1. Who is responsible for your data
Alpha Crews HQ is the controller of your personal data. For privacy questions, or to use any of your rights below, contact us on Telegram through the "Contact us on Telegram" link at the bottom of every page of our websites.
2. What we collect and why
| Data | When | Why (lawful basis) | Kept for |
|---|---|---|---|
| Username, password (stored only as a one-way Argon2id hash), date you joined, the Terms version you accepted | You create an account | To provide your account (contract) | Until you delete your account |
| Display name | You create an account (or change it) | Shown to others where you take part (for example posts) (contract) | Until you delete your account |
| Email address | You create an account (or change it) | Account recovery and security alerts only. Never shown to others or sold (contract, legitimate interests) | Until you change it or delete your account |
| Date of birth | You create an account | To confirm you are 18 or over (legal obligation, legitimate interests) | Until you delete your account |
| Two-factor secret (encrypted) and recovery codes (stored only as hashes) | You turn them on | To secure your account (contract, legitimate interests) | Until you turn them off or delete your account |
| Passkeys: the public key your device creates (never the private key), the name you give it, and when it was added and last used | You add a passkey | To let you sign in with it (contract, legitimate interests) | Until you remove it or delete your account |
| Active session records: time, IP address, browser/device description | Each sign-in | To keep you signed in and let you see and end your sessions (contract) | Until the session ends, then up to 30 days |
| Sign-in history: each sign-in with time, IP address, the country the IP belongs to (from Cloudflare), and a short device summary (operating system and browser, read from your browser and shown to you in Account > Security) | Each sign-in | Security, fraud prevention, abuse investigation and dispute handling (legitimate interests, legal obligation) | 2 years, then deleted |
Recognised browsers: a one-way hash of the random value in the __Host-dev cookie, with when it was first and last used and a short device summary |
You sign in | To warn you by email when your account is used from a browser it hasn't used before (legitimate interests) | Until it is unused for 1 year, or you delete your account |
| Other security events (for example failed sign-ins, password changes, admin actions), with time and IP address | When they happen | Security, fraud prevention, dispute handling (legitimate interests, legal obligation) | 2 years, then deleted |
| If you use "Sign in with Google": your Google account ID (a number that identifies your Google account to us), the email address on it and, only to suggest a display name, your Google profile name. We never receive your Google password and we don't access anything else in your Google account | You sign in with Google or link it | To let you sign in with Google (contract) | Until you unlink Google or delete your account |
| Telegram user ID, and the Telegram name shown when you linked | You link Telegram | To recognise you when you message us on Telegram, to reply to you there, and service messages. Our contact bot keeps a list of linked members (Telegram ID, username, display name and membership status) only so that our team can see who is writing (contract, legitimate interests) | Until you unlink or delete your account |
| Website chat: the messages you and our team write in the chat bubble, and your account if you are signed in | You use the chat | To answer your questions (legitimate interests) | 90 days after the last message, then deleted. Messages are also delivered to our team on Telegram |
| Donations: membership period, amount, currency, payment method, provider reference, status, dates, the statements you agreed to when donating | You donate | To provide your Plus membership and keep accounting records (contract, legal obligation) | 6 years (the legal period for business and tax records), even if you delete your account (then without a link to your username) |
We do not collect your real name, postal address, card numbers or wallet private keys. Our sign-in history records only the country of your IP address (not a precise or continuous location), and a basic device summary; we do not fingerprint your device.
3. Who we share data with
We share data only with service providers who help us run the Services, under contracts that protect it, and only as far as needed:
- Cloudflare (security, content delivery and our secure tunnel). It processes your IP address and request details when you visit our sites.
- Our hosting providers (Oracle Cloud, whose servers in France run our websites, database and encrypted backups).
- Our email provider (Oracle Email Delivery sends our account and security emails).
- Our payment service provider (it processes payment details when you donate).
- Google (encrypted backup storage for service records; and, only if you choose it, "Sign in with Google", where Google confirms your identity to us under Google's own privacy policy).
- Telegram (if you link your account or use our chat, messages pass through Telegram to and from our team).
We may disclose data if required by law (for example a valid court order), or where necessary to protect our rights, our users or others from fraud or serious harm. We check that such requests are lawful before responding.
4. Embedded content
PC Crew and Tech Crew embed videos from YouTube in its privacy-enhanced mode. YouTube may collect data when you play a video, under Google's privacy policy. Links to other platforms (Twitch, Kick, TikTok, Facebook, Telegram) take you to services with their own privacy policies.
5. International transfers
Our websites, database and backups run on servers in France (EU), in Oracle Cloud's Paris region. Some providers (such as Cloudflare and Google) may process data in other countries, including the United States. Where this happens we rely on recognised safeguards such as adequacy decisions or standard contractual clauses.
6. How we protect your data
Security measures include:
- encrypted connections everywhere;
- passwords stored only as salted Argon2id hashes;
- new and signed-in passwords checked against a public list of passwords leaked from other websites (Have I Been Pwned, "Pwned Passwords"). Only the first 5 characters of a one-way hash of the password leave our servers; the password and its full hash never do, so the service can't learn it;
- encryption of two-factor secrets and backups;
- strict access controls, with two-factor sign-in required for staff;
- no inbound access to our servers from the open internet;
- audit logging;
- minimal data collection.
No system is perfectly secure, but we work hard to protect what we hold, and we will tell you and the regulator about a breach where the law requires it.
7. Your rights
Depending on where you live, you may have the right to:
- access your data: use "Download my data" on your account page, or ask us;
- correct it;
- delete it: use "Delete account" on your account page. Some records must be kept for the periods above;
- restrict or object to certain processing;
- data portability;
- complain to a data protection authority. In the UK this is the Information Commissioner's Office (ico.org.uk). Elsewhere it is your local authority.
We reply to requests within one month.
8. Cookies
We use only the cookies strictly needed to sign you in and keep forms secure. See our Cookies page.
9. Children
The Services are for adults aged 18 and over. We do not knowingly collect data from children.
10. Changes
If we change this policy we will update the date above, and for significant changes we will tell you through our websites or Telegram.