Privacy Policy

Your account details — email address, display name and username — which come from Clerk, our authentication provider. We never see or store your password.

The files you upload, and the information you attach to them: titles, artist names, versions, ISRCs, tags, comments, publishing splits and contributor details.

Technical records needed to run the service: request logs, storage totals and error reports.

We do not use advertising trackers, and we do not sell data to anyone, for any purpose, ever.

Files are transmitted over TLS and stored with Cloudflare R2, which encrypts objects at rest with AES-256.

Your files are never served from a public URL. Every byte is delivered through an authenticated route that checks, on each request, that the file belongs to your space and that your credentials permit that action.

Storage keys are generated by our servers, never accepted from a browser, and are scoped to your space.

Responses carry private, no-store caching so files are not retained by intermediate caches.

Being specific about the limit: we do not yet apply our own per-file encryption layer on top of the provider’s. That is planned, and this policy will be updated when it ships rather than before. We would rather understate this than overstate it.

You, and anyone you explicitly grant access to. Nobody else.

Our staff do not browse customer catalogs. Access to production systems is limited to what is needed to operate the service and to respond to a support request you have made.

We will not disclose your files to a third party except where compelled by law, and where we are permitted to tell you, we will.

Files are stored with Cloudflare R2. Account and catalog records are stored in Postgres hosted by Supabase. The application runs on Vercel. These providers process data on our behalf under their own security commitments.

Your files and records are kept for as long as your account is active.

You can delete individual items at any time. To delete your whole account, contact us and we will remove your files, catalog records and account data.

Backups may retain deleted content briefly before they age out.

You can ask for a copy of your data, correct it, or have it deleted. Write to us and we will act within 30 days.

Questions, requests or complaints: hello@trycrate.net.