Privacy Policy

• Account information. Your email address (provided when you sign up), and any account details you choose to add.
• Collection data. Records, plays, hearts, wantlist, and related metadata you import from Discogs or add manually. This data is yours.
• Optional integrations. If you connect Spotify or Last.fm, we receive only the data those services share under your authorization (e.g. recently played tracks). You can disconnect at any time.
• Usage data. Pseudonymous analytics about how you use CrateMate — pages viewed, features used, and similar — to improve the product. Collected on the basis of our legitimate interest.
• Location. If you grant permission, an approximate location used only to power weather-based recommendations. We do not store precise coordinates long-term.

• To run the Site, your account, and the features you choose to use.
• To send you service-related communications (sign-in, billing, account changes) and, if you opt in, occasional product updates. You can unsubscribe from non-essential emails at any time.
• To improve CrateMate based on aggregate, pseudonymous usage patterns.
• To comply with legal obligations and protect against abuse.

If we ever process your data on the basis of your consent, you can withdraw that consent at any time by contacting us.

We do not sell your personal information. We share it only:

• With trusted service providers who help us operate CrateMate — hosting, authentication, payments, email delivery, and analytics. These providers process data on our behalf under contractual safeguards.
• With third-party services you explicitly connect (such as Discogs, Spotify, or Last.fm), only as needed to provide the integration you requested.
• If required by law, in response to a lawful request, or to protect the rights and safety of CrateMate and its users.

The subprocessors we rely on today include Vercel (hosting), Clerk (authentication), Supabase (database), Stripe (payments), Resend (email), Sentry (error monitoring), and PostHog (product analytics and session replay). PostHog is configured to respect the Do Not Track browser setting and to only create person profiles for authenticated users. You can read PostHog’s own privacy policy at posthog.com/privacy.

Where CrateMate shows audio characteristics for a record (energy, mood, danceability, etc.), those features are looked up via the public ReccoBeats API based on the record’s title and artist. They are not generated from your personal listening — the lookup is the same for every user.

Your data is stored on secure infrastructure with reasonable technical and organisational measures to protect it from unauthorized access, alteration, or disclosure. We retain your information only as long as needed to provide the service or comply with legal obligations. You can request deletion at any time (see Your rights below).

You have the right to:

• Access the personal information we hold about you.
• Correct inaccurate or incomplete data.
• Request deletion of your account and associated data. Some information may be retained where we have a legal obligation to do so.
• Receive a copy of your data in a structured, machine-readable format (e.g. CSV or JSON).
• Object to or restrict certain processing.

To exercise any of these rights, email us at juan@cratemate.app. We may ask you to verify your identity before acting on your request.

CrateMate uses essential cookies and local storage to keep you signed in and remember your preferences. We may also use limited analytics to understand how the product is used. We do not use advertising cookies or share data with advertising networks.

We may update this policy from time to time. When we make material changes, we’ll let you know by email or in-app notice. The “Updated” date at the top of this page reflects the latest revision.

Questions, concerns, or requests? Email juan@cratemate.app.