Privacy Policy
Last updated: February 21, 2026
Privacy policies are usually walls of text nobody reads. We want to do better than that. This policy explains how Crafta handles your information, written in plain language, because you deserve to actually understand it.
If anything here is unclear, email us at privacy@crafta.app. We genuinely want you to feel good about how we treat your data.
1. Information We Collect
The gist
We collect what you give us (name, email, what you type or say) plus basic technical stuff to keep things running. We keep it minimal.
Information you provide directly:
•
Account info: your name and email address when you sign up
•
Your descriptions: what you type or say when describing creations you want to build
•
Your creations: what you build and publish to the gallery
•
Payment info: processed by Stripe, our payment provider. We never see or store your full card number
Information collected automatically:
•
Device and browser type: so the app works well on your device
•
Usage patterns: which features you use, how often, error logs
•
Cookies: only essential ones for keeping you logged in (see Section 6)
2. How We Use Your Information
The gist
We use your data to build your creations, keep the service running, and make Crafta better. We do not sell your information to anyone.
•
To build and host the creations you describe
•
To improve how Crafta generates creations: your descriptions, prompts, and created content are used for prompt refinement, model fine-tuning, and training future AI capabilities. Paid users can opt out of AI training by emailing privacy@crafta.app. Free-tier users contribute this data as part of using the free service
•
To process Spark purchases
•
To keep things secure: detecting fraud, abuse, and technical problems
•
To communicate with you about your account, important updates, or if something needs your attention
We do not sell, rent, or trade your personal information to third parties. Period.
3. Why We Can Process Your Data
The gist
Under European privacy law, we need a legal reason to handle your data. Here are ours.
•
Contract: when you sign up, we need your data to provide the service you asked for
•
Consent: you choose to give us voice input and creation descriptions; you can stop anytime
•
Legitimate interest: we use anonymous usage data to improve Crafta, balanced against your privacy rights
•
Legal obligation: we keep payment records as required by tax law
4. Where We Store Your Data
The gist
Your data lives on secure servers in the US. Voice recordings are deleted after we turn them into text. We do not keep audio files.
We use Supabase (built on AWS) for our database and authentication, and Cloudflare for hosting and content delivery. Both provide industry-standard encryption at rest and in transit.
We take security seriously: automated daily backups, row-level access controls, encrypted connections everywhere, and sandboxed execution for generated apps. That said, no system is perfectly secure. If we ever discover a breach affecting your data, we will notify you promptly.
Voice input is transcribed and then deleted. We do not store raw audio after processing is complete.
5. Who Else Touches Your Data
The gist
A few trusted services help us run Crafta. We share only what they need, nothing more.
•
Anthropic, OpenAI, Google: AI providers that help generate your creations. They receive your descriptions but not your account details. These providers may use data sent to them according to their own data policies
•
Supabase: handles authentication and database storage
•
Cloudflare: hosts your published creations and provides CDN
•
Stripe: processes payments. They have their own privacy policy and are PCI-DSS compliant
Each service operates under its own privacy policy. We share only the minimum information needed for them to do their job.
6. Cookies
The gist
We use only essential cookies to keep you logged in. No tracking cookies, no ad cookies, no creepy stuff.
Crafta uses a single essential cookie: your authentication session token from Supabase. This keeps you logged in so you do not have to sign in every time you visit.
We do not use third-party tracking cookies, advertising cookies, or analytics cookies. If that ever changes, this policy will be updated accordingly.
7. How Long We Keep Your Data
The gist
We keep your data while your account is active. Delete your account and we delete your data within a reasonable timeframe, with a few exceptions.
•
Account data: kept while your account is active, deleted after a deletion request
•
Voice input: deleted immediately after transcription
•
Published creations: you can unpublish before deleting your account; any still published may remain in the gallery (see our Terms of Service for details)
•
Payment records: retained as required by tax law
•
Usage logs: anonymized or deleted periodically
8. Your Rights
The gist
It's your data. You can see it, change it, take it with you, or ask us to delete it.
Wherever you live, you have the right to:
•
Access: see what personal data we hold about you
•
Correction: fix anything that is wrong
•
Deletion: ask us to delete your account and data
•
Portability: get a copy of your data in a standard format
•
Opt out: unsubscribe from non-essential emails anytime
If you are in the European Economic Area, you also have the right to restrict processing, object to processing based on legitimate interest, and lodge a complaint with your local data protection authority.
If you are in California, you have the right to know what data we collect and why, to request deletion, and to opt out of the sale of personal information (though we do not sell it). We will not discriminate against you for exercising these rights.
To exercise any of these rights, email privacy@crafta.app. We will respond within 30 days.
9. International Data Transfers
The gist
Our servers are in the US. If you are outside the US, your data crosses borders, and we have safeguards in place for that.
Crafta is based in Bellevue, Washington and our data is stored in the United States (AWS us-east-1 via Supabase). If you are accessing Crafta from outside the US, your data will be transferred to and processed in the US.
For transfers from the EEA, UK, or Switzerland, our service providers maintain appropriate safeguards including Standard Contractual Clauses approved by the European Commission.
10. Children's Privacy
Crafta is not designed for children under 13. We do not knowingly collect personal information from anyone under 13. If we learn that we have, we will delete it promptly.
Users between 13 and 18 may use Crafta with parental or guardian consent. Parents or guardians can contact us at privacy@crafta.app to review, update, or delete their child's information.
11. Changes to This Policy
We may update this policy as Crafta evolves or as laws change. The "last updated" date at the top always reflects the most recent version. We encourage you to check back occasionally.
12. Contact Us
Questions, concerns, or just want to say hi? We are happy to talk about any of this.
Email: privacy@crafta.app
Crafta Bellevue, WA