Privacy Policy.
Last updated: 2026-04-05
Data Controller: privacy@cratr.app
We believe in transparency and data sovereignty. This document outlines exactly how we handle and protect your information.
1. The 'No-Tracking' Promise
We use Cloudflare Web Analytics. We do not track you across the web. We do not use advertising pixels or third-party behavioral trackers. We see traffic, not people. Your browsing habits remain entirely your own.
2. The 'Right to be Forgotten'
You have control over your digital vault. If you decide to leave Cratr, you can delete your entire collection, settings, and account instantly from the App settings menu. Upon erasure, your data will be deleted from our primary systems subject to applicable backup and retention processes and any sub-processor policies.
3. Third-Party Sub-processors
To provide our services reliably and securely, we utilize enterprise-grade infrastructure. We only partner with specific, leading services that meet our strict privacy capabilities:
Cloudflare
Zero-Log InfrastructureHandles our edge firewall (WAF), secure asset hosting (R2), and privacy-first web analytics. Our Zero-Log Proxy and Identity Guard are designed to never record user IP addresses or API session data.
Supabase
Database & AuthenticationProvides encrypted, secure PostgreSQL database storage and secure user authentication protocols.
4. Token Sovereignty & Local-First Credentials
Cratr follows a Local-First credential policy. Your third-party authentication tokens (Discogs PAT, OAuth access tokens, Google Cloud secrets) are stored exclusively in your browser's secure database (IndexedDB).
These credentials are never transmitted to Cratr's servers for storage, nor are they included in our cloud-sync backups. Responsibility for these tokens remains entirely with the vault owner, and they must be re-entered should the local data be cleared.
* Note: While primary data erasure is immediate upon request, complete removal of data from all system backups and sub-processor logs may take up to 30 days depending on provider-specific retention cycles and legal/operational requirements.