Skip to main content
Craftkite

Privacy Policy

Version 2026-10-09

This policy explains what personal data Craftkite collects, why, and your rights. The controller is Craftkite (privacy@craftkite.com).

What we collect

  • Account data: name, email address, password hash, language, two-factor settings, and sign-in accounts you link (Google, GitHub, Apple).
  • Project data: your descriptions, plans, generated files, versions, environment variables and secrets (stored encrypted), published app addresses and custom domains.
  • Usage and billing data: tasks, credits used, model and sandbox usage, plan and subscription status, invoices (payment card data is handled by Paddle, not by us).
  • Technical data: IP address, browser, request logs and error reports, kept for security and troubleshooting.
  • Sign-up device: when you create an account, we store a one-way keyed hash of a random device identifier kept by your browser or our app, together with your device's operating system type, only to limit how many Free accounts receive free credits on one device.
  • Messages: feedback, support requests and abuse reports you send us.
  • Consents: the versions of the terms and, where required, of the explicit consent you gave at sign-up, and your choice about marketing emails, with the date of each change.
  • Product analytics (only with your consent): pseudonymous page views and the steps of signing up, creating a project, publishing and checking out.

Your work belongs to you

Your projects, descriptions (prompts), plans, files, previews and the ideas in them are yours. Only you, and the members of your team workspace according to their role, can see or use them. Other members, the community and Craftkite staff cannot see, copy or use them.

  • Staff access only to solve a problem. Our team opens your content only when there is a problem to solve: a support request you made, an abuse report about one of your apps, a legal request, or a security investigation. Each access needs a stated reason, is limited in time (30 minutes by default) and to your account or one project, and everything read is recorded in our security audit trail. In our staff tools your email, name, IP addresses and device identifiers are masked unless a staff member with the right role reveals them, which is also recorded.
  • You can see every access. Account → Privacy lists when someone at Craftkite opened your data, the team they belong to and the reason. When the reason is your support request, we also tell you by email.
  • Previews are private. The preview of your app is shown only to you and your team. You can share a link to it that expires (one hour by default). Publishing an app is your choice to make it public: anyone with its address can open it.
  • Nothing is shared without your consent. Your app appears in the community gallery only if you submit it and tick the consent box; you can withdraw it at any time in Account → Privacy, and we then delete our copy. We never use your content in examples, templates, evaluations or analytics.

Why we use it (legal bases)

  • To provide the Service and your plan (contract).
  • To keep the Service secure, prevent abuse and enforce our policies (legitimate interests).
  • To send account emails such as verification, receipts and payment problems (contract), and onboarding tips you can unsubscribe from at any time (legitimate interests or consent where required).
  • To meet legal obligations such as tax records (legal obligation).
  • To send marketing emails, only if you opted in at sign-up or in your account (consent, which you can withdraw at any time).
  • To measure how the site and studio are used, only if you accept analytics cookies (consent).
  • For members in Türkiye, the processing and transfer abroad that KVKK makes subject to explicit consent is based on the explicit consent you give at sign-up, separately from the terms.

AI processing

To build your apps, your descriptions, attached images and project files are sent to AI model providers (Anthropic, OpenAI, Google). They process them only to answer our requests and may not use them to train models: we use their business APIs, which do not train on customer data, ask OpenAI not to store responses, and use only paid Gemini API access. We do not send your name or email address to them. Secrets and environment variable values are never sent to models. Neither we nor our providers use your content to train AI models. Questions you ask our support assistant are answered from our help articles and are not stored; we keep only that a question was asked, for cost accounting.

Sharing

We share data only with the processors listed in the subprocessor list, with Paddle as merchant of record for purchases, and with authorities when the law requires it. We do not sell personal data.

International transfers

Some processors are outside your country. Transfers rely on adequacy decisions or the EU Standard Contractual Clauses; for Türkiye, transfers follow KVKK Article 9.

How long we keep data

  • Account and project data: while your account exists. After you delete your account, everything is erased after 30 days (you can restore the account until then), except invoices and records we must keep by law.
  • Build activity logs: 365 days after a task finishes. Images attached to requests: 365 days. Test screenshots: 180 days (the latest of each project is kept while the project exists).
  • Model usage records (tokens and cost, no content): 2 years. Closed support tickets: 2 years. The log of emails sent to you: 180 days. The record of staff access to your data: 2 years.
  • Security audit trail (sign-ins, admin actions, staff access): about 13 months.
  • Server and error logs: up to 90 days.

Account → Privacy shows the periods that currently apply.

Your rights

You can access, correct, export (Account → Export my data — the archive contains your account, projects and their code, requests, files your apps' users uploaded, consents, notifications, sessions, support tickets, the notes our team keeps about your account and the log of staff access), and delete (Account → Delete account) your data, object to or restrict processing, and withdraw consent. California residents may opt out of any sale of personal information (we do not sell it). You can complain to your data protection authority (in Türkiye, the KVKK Board).

Cookies

We use cookies that are necessary to sign you in and keep the Service secure, and analytics cookies only if you accept them. See the cookie policy.

Error reports

When something breaks in the web or mobile app, an error report (technical details, browser or device type) may be sent to Sentry. We remove email addresses, IP addresses, cookies, request bodies (such as your descriptions and files) and form contents from these reports before they leave your device or our servers. Product analytics events never include your descriptions, project names or other content.

Changes

We will announce material changes in the studio or by email before they take effect.