Privacy Policy

Last updated: September 21, 2026

The short version

• We ask for your email address, because that's where your private link goes.
• Stripe handles payment. Your card details never touch this site and we never see your card number.
• We use privacy-focused Vercel Web Analytics to count visits and see which pages are useful. It does not use advertising cookies or follow you across websites.
• We don't sell your data. There is no advertising network here.
• Want your data, or want it gone? Email integritylanddevelopment@gmail.com.

Who is responsible for your data

crAppstore is operated by Alex Alexander, sole proprietor, contactable at integritylanddevelopment@gmail.com.

We have not appointed an EU or UK representative. For any privacy matter, email is the fastest route.

What we collect

Information you give us

• Email address — to send your private link, billing notices, and replies to your messages.
• Messages you send us — to answer your question or fix your bug.
• crApp Factory submissions (if you sell here) — to review, list, and pay out on your crApp.

Payment information

When you subscribe, you are handed to Stripe to pay.

• Your card number, expiry date, and security code go directly to Stripe.
• They are not stored on crAppstore's servers and we never see them.
• From Stripe we receive: whether your payment succeeded, your subscription status, the last four digits and card brand (for support), and the billing country or postal code Stripe collects for tax and fraud checks.

Stripe handles that data under its own privacy policy: https://stripe.com/privacy

Information collected automatically

• Server logs. Our hosting provider records basic request information such as IP address, browser type, and the page requested. This is standard hosting behavior and is used for security and troubleshooting.
• Vercel Web Analytics. We collect anonymous, aggregate page-view information: page path, time, referrer, approximate location, browser, operating system, and device type. Vercel identifies a daily visitor from a request-derived hash, does not use third-party cookies, and discards that visitor identifier after 24 hours. We use the totals to measure daily active visitors and improve the crApps.
• Download counting. Your browser creates a random crapp_visitor identifier. When you start a free checkout, it is sent to crAppstore and Stripe with the selected crApp and version so repeat checkouts can be counted as one person. It contains no name or email, remains in your browser until you clear local storage, and is not used for advertising.
• What we do not do: we do not build advertising profiles, we do not run third-party ad trackers, and we do not sell or rent your personal information to anyone.

Information inside a crApp

Some crApps store what you type on your own device, using your browser's local storage. That data stays on your device and is not sent to us unless a specific crApp says otherwise on its own page.

Every crApp on the shop does its work in your browser, and none of them send what you type to a third-party AI service. Two honest exceptions: a few store features (the UI Polisher and the mailing-list form, for example) send what you give them to this site's own server so they can do their job, and some crApps' Version 3 lets you paste your own AI key — anything sent then goes to that provider under your own account, and only when you choose to.

Why we use your data (legal bases)

If you are in a place with GDPR-style rules, here's the basis for each use:

• To provide the service (send your link, keep your subscription working) — because it's necessary to perform our contract with you.
• To take payment — necessary to perform our contract.
• To answer support email — necessary to perform our contract, or our legitimate interest in running a functioning service.
• To keep the site secure and working — our legitimate interest.
• To email you about new crApps, if you signed up for that — your consent, which you can withdraw at any time.
• To meet tax and accounting rules — legal obligation.

Who we share it with

We use a small number of service providers ("processors"). They handle data on our behalf and are not allowed to use it for their own purposes.

• Stripe — payments and subscriptions. Sees your card details, email, billing country, subscription history, and the random download-counting identifier when you start checkout.
• Supabase — the database. Holds your email, your key, and your subscription status. This is also where the mailing list lives.
• Vercel — website hosting, delivery, server logs, and privacy-focused aggregate Web Analytics.
• Email — mailing-list and support email is sent from an ordinary mailbox, not a marketing platform.

We may also share information if the law requires it, to respond to a valid legal request, to protect the service or someone's safety, or if the business is sold or transferred — in which case we would tell you.

We do not sell your personal information and we do not share it for cross-context behavioral advertising.

Cookies and local storage

• Essential storage. The site and your crApps may use cookies or browser local storage to keep you signed in to your link and to remember basic preferences. Without these, the service doesn't work.
• Payment. Stripe sets its own cookies during checkout for fraud prevention. That's part of taking a card safely.
• Analytics. Vercel Web Analytics does not use analytics or advertising cookies. The site also keeps small pieces of data in your browser's own storage, including your key, cart, and random download-counting identifier. The identifier leaves your device only when you choose to start checkout, as explained above.

You can block or clear cookies in your browser settings. If you block the essential ones, your private link may stop working.

How long we keep things

• Email address and account record — while your subscription is active, then 12 months after it ends, unless you ask us to delete it sooner.
• Payment and invoice records — as long as tax and accounting law requires, typically 7 years.
• Support emails — 24 months.
• Server logs — 30 days.
• Vercel's daily visitor identifier — discarded after 24 hours; aggregate traffic totals remain available.
• Random download-counting identifier — remains in your browser until you clear local storage and in the checkout record under the same retention rules as that record.
• Newsletter sign-ups — until you unsubscribe.

Your rights

Depending on where you live, you may have the right to:

• See what personal data we hold about you.
• Correct it if it's wrong.
• Delete it ("right to be forgotten").
• Get a copy in a portable format.
• Object to or restrict certain uses.
• Withdraw consent for marketing email, at any time.
• Not be discriminated against for exercising any of these rights.

How to ask: email integritylanddevelopment@gmail.com with "Privacy request" in the subject line. Use the email address on your subscription, or be ready to confirm it another way — we have to be sure it's really you.

We aim to respond within 30 days.

If you delete your account data, your private links stop working and cannot be restored.

If you're in the EU or UK and you're unhappy with how we handled a request, you can complain to your local data protection authority.

International transfers

Our providers (Stripe, Supabase, Vercel) may process data in the United States and other countries. Where required, they rely on approved transfer mechanisms such as Standard Contractual Clauses. Our database (Supabase) is hosted in the United States (us-east-1).

Children

crAppstore is not for children under 13, and we do not knowingly collect personal information from them. If you are in the EU or UK, the digital-consent age where you live (13–16) applies.

If you believe a child has given us personal information, email us and we will delete it.

Security

We take reasonable steps to protect your data: payments are handled by Stripe so we never hold card numbers, the site runs over HTTPS, and access to the database is restricted.

No system is perfectly secure, and we're not going to claim otherwise. If a breach affects your personal data, we will tell you and any required regulator as the law requires.

Changes to this policy

If we change this policy, the "Last updated" date changes. If the change is significant, we'll email active subscribers.

Contact

Privacy questions, requests, or complaints:

integritylanddevelopment@gmail.com — subject line "Privacy request".

Junk Mail, the newsletter

If you sign up for Junk Mail, your address is stored for one purpose: to send the newsletter — the beta ending, a new crApp landing, and news about the bigger project behind the shop. It is never sold, swapped or rented. Every email carries an unsubscribe link, and unsubscribing removes your address from the list.

Do Not Track and browser privacy signals

No cross-site tracking happens here, so there is nothing to opt out of. A privacy signal sent by your browser is honoured by default.

State privacy rights

If you live in California, Texas, Colorado, Virginia or a state with a similar law, you may ask to know what is held about you, get a copy, have it corrected, or have it deleted, and you will not be treated worse for asking. No personal information is sold, and none is shared for cross-context behavioural advertising. Sensitive categories are not collected on purpose. Email the address above with the subject Privacy request; the target is an answer within 30 days.

If there is a breach

If a breach affects your information you get an email saying what happened, what was exposed and what to do, within the time the law requires.

Automated decisions

No profiling, and no automated decisions that have a legal effect on you.

Complaints

If an answer does not satisfy you, you can complain to your state attorney general, or, in the UK or EU, to your supervisory authority.