Privacy Policy

This Privacy Policy explains how Crated (“Crated”, “we”, “us”) collects, uses and protects your personal data when you use our app and website (the “Service”). Crated is operated by Oh My! Studio Limited (“OMI”), registered in England and Wales at 14a Parade, Leamington Spa, England, CV32 4DW, company number 09315320.

If you have questions about this policy, contact us at hi@ohmy.studio.

1. Who we are

Oh My! Studio Limited (“OMI”) is the data controller for the personal data described in this policy. We are based in the UK and process data in accordance with the UK GDPR and the Data Protection Act 2018.

2. What we collect

When you sign up and use Crated, we collect:

• Account data: name, email address and profile details you choose to add — including a handle, bio, an optional profile photo (avatar) and, if you add it, your Discogs username. There’s no password: you sign in with a one-time link we email you.
• Collection data: the records you catalogue and want, including release/pressing details you select or confirm, your private notes and acquisition details (when, where and what you paid), ratings, reviews, lists and any images you upload.
• Usage data: device type, browser, IP address, pages viewed and general interaction data, collected automatically to keep the Service secure and working properly.
• Setting-up steps: the first time you reach each step of setting up your crate (for example seeing the welcome page, opening search or opening the import page), so we can see where new members get stuck. We never record what you search for or type.
• Support data: anything you send us directly, e.g. via email or the in-app “Report a bug” form.

We do not knowingly collect special category data (e.g. health, religion, biometric data) and ask that you don’t include it in notes or profile fields.

3. Where your data comes from

Most collection data originates from third-party music and release databases, primarily Discogs, with iTunes and MusicBrainz used as supplementary sources. When you search for a release or import your Discogs export, we query these services and store the matched release information against your account. Some of this data is refreshed periodically to stay current with the source database. See our Terms of Service for the third-party providers we rely on and the accuracy limits of that data.

4. How we use your data

We use your data to:

• create and run your account and your record collection;
• operate core features such as search, release matching and import;
• maintain security, prevent abuse and debug faults;
• see where people get stuck setting up, so we can make it easier;
• respond to support requests;
• send essential service communications (e.g. sign-in links, security notices);
• send a small number of emails about using Crated — a welcome, a check-in a few days after you join and, if you’ve been away for a while, one reminder. Each has a one-click unsubscribe;
• with your consent, send optional product updates or marketing (you can opt out at any time).

We do not sell your personal data.

5. Legal basis for processing

We rely on:

• Contract — to provide the Service you’ve signed up for;
• Legitimate interests — to keep the Service secure, improve it, understand usage at an aggregate level and send the few emails about using Crated described above;
• Consent — for optional marketing communications, which you can withdraw at any time.

6. Third parties and data sharing

We share data only where necessary:

• Discogs, MusicBrainz, Cover Art Archive, iTunes and Spotify — we send these services search queries (artist and record names) to retrieve release data, sleeves and artist images. We do not send them your personal account details (name, email); queries are limited to catalogue lookups.
• Infrastructure providers — we use Supabase to host our database, authentication and file storage, including images you upload such as your profile photo. Netlify hosts and serves the app, so it processes your IP address and browser details when you visit. Data is stored on their infrastructure under their own security and data processing terms.
• Loops — sends your sign-in emails and the emails about using Crated described above. It receives your email address and sign-up date, plus simple signals such as whether you’ve added a record yet or have been away for a while. It never sees your collection, notes or reviews. If you delete your account, we remove you from Loops too.
• GitHub — if you use “Report a bug”, your report is filed as an issue in our private GitHub project, together with your email address, the page you were on and your browser details, so we can follow up.
• Plausible Analytics — we count page visits with Plausible, a privacy-friendly analytics service based in the EU. It sets no cookies, doesn’t collect personal data or track you across sites. It only gives us aggregate numbers.
• Sentry — when something breaks, a technical error report goes to Sentry, hosted in the EU, so we can fix it. It holds the page address (without anything after a “?”), your browser and device type and the technical details of the error. It doesn’t include your name, email address, IP address or anything you’ve written.
• Legal requirements — we may disclose data if required by law, regulation or valid legal process.

We do not share your personal data with advertisers or data brokers.

7. Public profiles and social features

Crated has social features. You can follow other people, publish reviews and share a public profile. When your profile is public:

• your display name, handle and profile photo (if you add one), your collection, any published reviews and — where you enable it — your want list are visible to other users and to anyone who visits your public profile, including people who aren’t signed in;
• activity such as records you add or reviews you publish may appear in the activity feed of people who follow you, alongside your name and profile photo;
• your profile photo and other images shown on public pages are served from public URLs and may be viewable by anyone who has the link.

You decide what’s public. From your account and profile settings you can make your profile private (in which case it won’t be publicly visible and you won’t appear in search), hide individual items, keep reviews private or remove your profile photo at any time.

8. International transfers

Our infrastructure providers may process data outside the UK. Where this happens, we rely on appropriate safeguards such as Standard Contractual Clauses or an equivalent adequacy mechanism.

9. Data retention

We keep your account and collection data for as long as your account is active. If you delete your account, we delete your personal data (and remove you from our email provider) within 30 days, except where we’re required to retain it for legal or security purposes (e.g. fraud logs).

10. Your rights

Under UK GDPR, you have the right to:

• access the personal data we hold about you;
• correct inaccurate data;
• request deletion of your data;
• export your data in a portable format;
• object to or restrict certain processing;
• withdraw consent for marketing at any time.

To exercise these rights, contact us at hi@ohmy.studio. You also have the right to lodge a complaint with the UK Information Commissioner’s Office (ICO) at ico.org.uk.

11. Cookies and similar technologies

Our website and app use a small number of cookies and local storage entries to:

• keep you signed in;
• remember your preferences;
• understand aggregate usage (analytics).

We use only essential and analytics cookies at this time — no third-party advertising cookies. You can control cookies through your browser settings; disabling essential cookies may prevent parts of the Service from working.

12. Security

We use industry-standard measures (encryption in transit, passwordless sign-in, access controls) to protect your data. No system is completely secure so we can’t guarantee absolute security.

13. Children

Crated is not directed at children under 16. We do not knowingly collect data from children under this age. If you believe a child has provided us with personal data, contact us and we will delete it.

14. Changes to this policy

We may update this policy as the Service evolves. We’ll post the updated version here and update the “Last updated” date above. Material changes will be flagged in-app.

15. Contact us

Oh My! Studio Limited (company no. 09315320)
14a Parade, Leamington Spa, England, CV32 4DW
hi@ohmy.studio