Privacy Policy

This Privacy Policy explains how Crated (“Crated”, “we”, “us”) collects, uses, and protects your personal data when you use our app and website (the “Service”). Crated is operated by Oh My! Studio Limited (“OMI”), registered in England and Wales at 14a Parade, Leamington Spa, England, CV32 4DW, company number 09315320.

If you have questions about this policy, contact us at hi@ohmy.studio.

1. Who we are

Oh My! Studio Limited (“OMI”) is the data controller for the personal data described in this policy. We are based in the UK and process data in accordance with the UK GDPR and the Data Protection Act 2018.

2. What we collect

When you sign up and use Crated, we collect:

• Account data: name, email address, password (stored as a salted hash), and profile details you choose to add — including a handle, bio, and an optional profile photo (avatar).
• Collection data: the records you catalogue, including barcodes scanned, release/pressing details you select or confirm, notes, tags, and any images you upload.
• Usage data: device type, browser, IP address, pages viewed, and general interaction data, collected automatically to keep the Service secure and working properly.
• Support data: anything you send us directly, e.g. via email or an in-app support form.

We do not knowingly collect special category data (e.g. health, religion, biometric data) and ask that you don’t include it in notes or profile fields.

3. Where your data comes from

Most collection data originates from third-party music and release databases, primarily Discogs, with iTunes and MusicBrainz used as supplementary sources. When you scan a barcode or search for a release, we query these services and store the matched release information against your account. Some of this data is refreshed periodically to stay current with the source database. See our Terms of Service for the third-party providers we rely on and the accuracy limits of that data.

4. How we use your data

We use your data to:

• create and run your account and your record collection;
• operate core features such as barcode scanning, release matching, and search;
• maintain security, prevent abuse, and debug faults;
• respond to support requests;
• send essential service communications (e.g. password resets, security notices);
• with your consent, send optional product updates or marketing (you can opt out at any time).

We do not sell your personal data.

5. Legal basis for processing

We rely on:

• Contract — to provide the Service you’ve signed up for;
• Legitimate interests — to keep the Service secure, improve it, and understand usage at an aggregate level;
• Consent — for optional marketing communications, which you can withdraw at any time.

6. Third parties and data sharing

We share data only where necessary:

• Discogs, MusicBrainz, iTunes — we send barcode/search queries to these services to retrieve release data. We do not send your personal account details (name, email) to them; queries are limited to catalogue lookups.
• Infrastructure providers — we use Supabase to host our database, authentication, and file storage (including images you upload, such as your profile photo). Data is stored on their infrastructure under their own security and data processing terms.
• Legal requirements — we may disclose data if required by law, regulation, or valid legal process.

We do not share your personal data with advertisers or data brokers.

7. Public profiles and social features

Crated has social features. You can follow other people, publish reviews, and share a public profile. When your profile is public:

• your display name, handle, and profile photo (if you add one), your collection, any published reviews, and — where you enable it — your want list are visible to other users and to anyone who visits your public profile, including people who aren’t signed in;
• activity such as records you add or reviews you publish may appear in the activity feed of people who follow you, alongside your name and profile photo;
• your profile photo and other images shown on public pages are served from public URLs and may be viewable by anyone who has the link.

You decide what’s public. From your account and profile settings you can make your profile private (in which case it won’t be publicly visible and you won’t appear in search), hide individual items, keep reviews private, or remove your profile photo at any time.

8. International transfers

Our infrastructure providers may process data outside the UK. Where this happens, we rely on appropriate safeguards such as Standard Contractual Clauses or an equivalent adequacy mechanism.

9. Data retention

We keep your account and collection data for as long as your account is active. If you delete your account, we delete your personal data within 30 days, except where we’re required to retain it for legal or security purposes (e.g. fraud logs).

10. Your rights

Under UK GDPR, you have the right to:

• access the personal data we hold about you;
• correct inaccurate data;
• request deletion of your data;
• export your data in a portable format;
• object to or restrict certain processing;
• withdraw consent for marketing at any time.

To exercise these rights, contact us at hi@ohmy.studio. You also have the right to lodge a complaint with the UK Information Commissioner’s Office (ICO) at ico.org.uk.

11. Cookies and similar technologies

Our website and app use a small number of cookies and local storage entries to:

• keep you signed in;
• remember your preferences;
• understand aggregate usage (analytics).

We use only essential and analytics cookies at this time — no third-party advertising cookies. You can control cookies through your browser settings; disabling essential cookies may prevent parts of the Service from working.

12. Security

We use industry-standard measures (encryption in transit, hashed passwords, access controls) to protect your data. No system is completely secure, and we can’t guarantee absolute security.

13. Children

Crated is not directed at children under 16. We do not knowingly collect data from children under this age. If you believe a child has provided us with personal data, contact us and we will delete it.

14. Changes to this policy

We may update this policy as the Service evolves. We’ll post the updated version here and update the “Last updated” date above. Material changes will be flagged in-app.

15. Contact us

Oh My! Studio Limited (company no. 09315320)
14a Parade, Leamington Spa, England, CV32 4DW
hi@ohmy.studio