Privacy Policy

This Privacy Policy explains what information Craft MadeBy (“we”, “us”) collects, how we use it, who we share it with, and the choices and rights you have.

Craft MadeBy is the data controller for the personal data described here. You can reach us at support@craftmadeby.com.

Information we collect

Account information you provide:

• Email address and display name.
• Optionally, a profile photo and a short bio.
• If you sign in with Google or Apple, the basic profile they share with us (name, email address and, for Google, your avatar). Apple may give us a private relay address instead of your real email.

Content you create:

• Projects: title, story, photos, steps and notes, techniques, materials, tools and their costs, recorded time, dates and visibility.
• Reactions, connections, invite codes, groups, giveaways and gifts, Expert Panel reviews, and reports or blocks you submit.
• Gift conversations: the messages, hand-over choice and any delivery address you exchange with the other maker of a gift. Only the two of you can read them; a shared address is removed as soon as the gift is marked received.

Profile verification (optional):

• If you choose to verify that you are a real person, a face and smile check runs entirely on your device (Google ML Kit). The selfie is never uploaded or stored; we record only that the check succeeded.

Technical data:

• Your country, taken from your device's region setting, so the public feed can favour makers near you.
• Your app language, app version and device model.
• A push-notification token for your device, if you allow notifications.
• App-usage analytics (Google Firebase Analytics), linked to your account id, so we can see which features are used.
• Crash, error and performance reports (Sentry). They contain no screenshots and no personal identifiers beyond your account id.
• Your subscription status (RevenueCat), when Premium is available. We never receive your card details.

How we use it

We use the data listed above to run the app: to create your account, show your projects and feeds, deliver notifications, and run features such as connections, groups, giveaways, the Expert Panel and handmade certification.

We also use it to keep the community safe. Photos and text you upload — including gift conversations — are checked automatically for unsafe content (Google Cloud Vision and Natural Language APIs), and reports are reviewed by us. We read a conversation only when one of its two participants reports it.

Finally, we use it to keep the app reliable: to understand how features are used, to fix crashes, and to improve performance.

We also send you email. There are two separate kinds, and you control each one in Settings:

• Notification and lifecycle emails: a welcome message, an occasional nudge if you have not started a project, and milestones such as a piece being certified or a gift arriving. These accompany the service you signed up for.
• The newsletter: a monthly digest of craft tips, quizzes and pieces from other makers. You only receive it if you ask for it.

Under the GDPR our legal bases are: performing our contract with you (running the app), our legitimate interests (safety, reliability, understanding usage, and notification and lifecycle emails), your consent (push notifications, the newsletter, profile verification, promotion of your public work), and legal obligations.

We do not sell your personal data.

Who can see your work

You choose the visibility of every project when you create it, and you can change it at any time:

• Private: Only you.
• Connections: The makers you are connected with.
• Groups: The members of the groups you post it to.
• Public: Everyone using the app, with your display name and profile photo.

Projects you submit for handmade certification are shown to the Expert Panel reviewers who assess them. Your display name, profile photo, bio, honours and public projects form your public profile.

Promotion of the app

We may show the cover photo, title and maker name of Public projects, and tips you post in the Studio, in the app's own showcases and in our promotion of the app, for example on the app stores and social media. Your work is always credited to you, and never edited beyond cropping.

Private and Connections-only projects are never used. If you prefer that your public work is not featured, make the project non-public, delete the tip, or write to support@craftmadeby.com and we will exclude it.

Service providers

We use trusted processors to run the app:

• Supabase (database, authentication, file storage and account emails), hosted in the EU (Ireland).
• Brevo (email delivery for our notification, lifecycle and newsletter messages), a French company hosting your data in the EU.
• Sentry (error and performance monitoring), hosted in the EU (Germany).
• Google Firebase (push notifications and app analytics).
• Google Cloud Vision and Natural Language APIs (automatic content moderation).
• Google Sign-In and Sign in with Apple (optional sign-in methods).
• Apple, Google Play and RevenueCat (Premium payments and subscription status, when available). We never receive your card details.

Providers based outside the EU process data under the EU–US Data Privacy Framework or the European Commission's standard contractual clauses. We share data with authorities only when the law requires it.

Data security & retention

Your data is encrypted in transit and at rest. Access to our systems is limited to what each part of the app needs, and photos in storage can only be changed by the maker who uploaded them.

How long we keep it:

• While your account is active, so your projects, connections and history are there when you return.
• Unconfirmed sign-ups are deleted automatically after 7 days.
• Gift conversations stay with the gift they belong to, so both makers can look back at what was agreed; they are deleted together with the project or the account. A shared delivery address is removed as soon as the gift is marked received.
• When you delete a project, it and its photos are removed. When you delete your account, your login, profile, projects, photos, connections, reactions, notifications and device tokens are removed. Copies in backups expire within 30 days.
• Crash reports are kept for 90 days and analytics data for up to 14 months.

Your choices

In the app, without contacting us:

• Edit your profile, photo and bio.
• Change the visibility of any project, or delete it.
• Turn push notifications off in Settings or in your phone's settings.
• Turn email notifications off, and subscribe to or unsubscribe from the newsletter, in Settings. Every newsletter also carries a one-click unsubscribe link.
• Block or report makers and content.
• Delete your account: Settings → Delete account.

By email to support@craftmadeby.com:

• Ask for a copy of your data (access and portability).
• Ask us to correct or restrict the use of your data, or object to it.
• Withdraw a consent you have given.
• Ask us not to feature your public work.

We answer within one month. You can also complain to your local data protection authority, for example Datatilsynet in Denmark.

Children

Craft MadeBy is not directed to children under 13 (or the minimum age in your country). We do not knowingly collect data from children; if you believe a child has given us data, contact us and we will delete it.

Changes

The version number and date at the top of this page tell you which policy applies. When we make significant changes we also show a notice in the app. Earlier versions are available on request.