Last updated: June 2026 · Effective upon account creation
Crafted On is built on the principle of data minimalism. We collect and retain only what is necessary to operate the platform. We do not sell your data. We do not use your data for advertising. We do not retain buyer data under any circumstances.
| Data | Purpose | Retention |
|---|---|---|
| Square merchant ID | Identifies your Square account | Until account deletion |
| Encrypted Square OAuth tokens | Enables Crafted On to process payments on your behalf | Until account deletion or token revocation |
| Subscription status and billing dates | Determines whether your sticker URLs are active | Until account deletion |
| Stripe customer and subscription IDs | Manages your platform subscription billing | Until account deletion |
| Sticker IDs and assignment records | Maps your stickers to items buyers will see and pay for | Until account deletion |
| Shipping address | Fulfilling sticker orders — postal delivery only | Deleted when shipping label is generated — within 48 hours of order |
| Phone number (optional) | Subscription renewal and lapse SMS notifications | Until account deletion or removal |
| FCM device token (optional) | Push notifications for subscription events | Until account deletion or removal |
We do not collect: your business name, address, or location; payout bank account details (held by Square); Square sales history or transaction records (held by Square); any personal identification beyond what Square has already verified.
We collect no buyer data. Buyer payment information — card numbers, expiry dates, CVV — is tokenized client-side by Square's Web Payments SDK before any network call reaches Crafted On infrastructure. We never see this information. We retain no record of any buyer identity, contact information, or payment details.
When you order stickers with postal delivery, we collect your shipping address to fulfil the order. This address is stored temporarily in our database and is permanently deleted in the same database operation that records your tracking number — within 48 hours of your order being placed. If you choose in-person delivery, no address is collected.
We do not use your data for analytics, advertising, or any purpose beyond operating the platform.
| Service | Purpose | Privacy Policy |
|---|---|---|
| Stripe | Platform subscription billing | stripe.com/privacy |
| Supabase | Database hosting | supabase.com/privacy |
| Twilio | SMS delivery | twilio.com/legal/privacy |
| Firebase (Google) | Push notifications | policies.google.com/privacy |
| Cloudflare | Edge infrastructure and DNS | cloudflare.com/privacypolicy |
| Sentry | Error monitoring | sentry.io/privacy |
| Pirateship | Shipping label generation | pirateship.com/privacy |
All OAuth tokens are encrypted at rest using AES-256-GCM before being written to the database. Decryption keys are stored separately from the database and are never logged. Session tokens are signed JWTs with a 30-day expiry.
You can delete your account at any time from the Account screen in the Crafted On app. Account deletion is permanent and irreversible. Upon deletion:
After deletion, no trace of your account remains in Crafted On's database. Your sticker URLs stop resolving immediately.
Depending on your jurisdiction, you may have rights to access, correct, delete, or receive a portable copy of your data. Account deletion — which removes all data — is available directly in the app. For any other requests, contact us through the Crafted On website.
Crafted On is not intended for users under 18 years of age. We do not knowingly collect data from minors.
We may update this policy at any time. We will notify you via in-app notice of material changes. Continued use of the platform after notice constitutes acceptance of the updated policy.
For privacy-related questions or requests, contact us through the Crafted On website.