Privacy policy
Last updated 13 November 2026
The short version
- You can browse Cratepick without an account, and we don't use advertising or tracking cookies.
- What you type into the ask bar is stored without your name, device or IP address, and we strip out emails, phone numbers and links first.
- If you sign up, we keep your email, display name and what you post: votes, reviews, comments and launches.
- We don't sell your data or share it for advertising.
- You can download or delete everything from your account at any time.
Who we are
Cratepick ("we") runs this site. We're registering Cratepick as a business, and this section will name it as soon as that's done. We decide how your personal data is used, which makes us the controller under the EU and UK GDPR. Questions or requests: [email protected].
What we collect and why
| What | Why | Legal basis (EU/UK) | Kept for |
|---|---|---|---|
| Your email address and display name, when you sign in | To run your account, sign you in, and send emails you asked for | Contract | Until you delete your account |
| Votes, reviews, comments, launches, claims, listing edits, review credits and boosts | To run the features you use; reviews and comments are shown publicly under your display name | Contract | Until you delete them or your account |
| What you type into the ask bar, the tools shown and the links you click | To answer you, improve answers, and show makers which requests their tool came up for | Legitimate interests (a useful, improving directory) | 13 months |
| Your email, if you ask us to tell you when a tool is listed | To send one email when we find one. We confirm the address first. | Consent | Until that email, unsubscribe, or 12 months (7 days if never confirmed) |
| Business contact details of makers, from their own public website | To list their tool and contact them about the listing | Legitimate interests | While the listing exists, or until they object |
| Technical logs (IP address, browser, time) kept by our hosting and database providers | Security and keeping the service running | Legitimate interests | As set by those providers, usually days to weeks |
We don't knowingly collect sensitive data (for example health, religion or biometric data). Please don't put it in reviews, comments or the ask bar.
Reviews and automated checks
New reviews are checked for detail and first-hand use. If the automated check is switched on, the review text and star rating (not your email) are sent to an AI model provider, which scores it. A high score can approve a review automatically. A low or unclear score sends it to a person, who makes the final decision. If a review is rejected you can ask for it to be looked at again by writing to us.
Who processes data for us
We use these providers to run Cratepick. They only process data on our instructions:
- Supabase: Database and sign-in. Region chosen at setup (data may be processed in the US).
- DigitalOcean: Website hosting and delivery. Global edge network.
- Resend: Sending emails. United States.
- OpenAI: Checking review quality (only the review text and star rating are sent). United States.
We may also disclose data if the law requires it, or to protect people from harm or fraud.
International transfers
Some providers process data outside your country, including in the United States. Where data leaves the EU, the UK or another country with transfer rules, we rely on adequacy decisions or the standard contractual clauses those providers offer.
Cookies and storage on your device
We don't set advertising, analytics or tracking cookies. Your browser stores a few things that the site needs to work:
- Your sign-in session, if you sign in.
- Your light or dark theme choice.
- What you told the ask bar during this visit, so the next page can use it. It's cleared when you close the tab.
None of these is used to follow you across other sites.
Your rights
Wherever you live, you can:
- Get a copy of your data, in a file you can reuse: Account, then "Download my data".
- Delete your account and data: Account, then "Delete my account". Comments that others replied to stay as "[deleted]" so their replies still make sense.
- Correct your display name in your account, or ask us to fix anything else.
- Object to our use of data based on legitimate interests, or restrict it, by writing to us.
- Withdraw consent at any time, using the unsubscribe link in any email.
In the EU and UK you can also complain to your data protection authority. In California and other US states with privacy laws, you have the right to know, delete and correct your personal information. We don't sell or share personal information for cross-context behavioural advertising, and we don't use sensitive personal information. We won't treat you differently for using these rights. We reply within one month (45 days for US state requests). We may ask you to confirm your identity first, and an authorised agent can make a request for you.
Children
Cratepick is for people running or working in a business. You must be at least 16 to create an account. If you think a child has given us data, write to us and we'll delete it.
Security
Data is encrypted in transit, access to the database is limited to what each feature needs, and we don't store passwords for sign-in links. No system is perfectly secure; if a breach affects you, we'll tell you as the law requires.
Changes
If we change this policy in a way that matters, we'll update the date above and, for significant changes, tell signed-in members by email before they take effect.