Privacy notice

What we store

• Account — your email address, display name, a password hash (never the password), and an avatar if you set one.
• Projects — the designs you save, so they are there when you come back.
• Billing reference — a Paddle customer and subscription id, your plan and its renewal date. No card details.
• Sign-in link — if you use Google or Facebook, the provider’s account id so we can recognise you next time.

What we do not do

• No advertising trackers and no third-party session recording.
• We do not sell or rent your data, to anyone, ever.
• We do not train anything on the artwork you upload.
• Card numbers never touch our servers — Paddle holds them.

Who it is shared with

Only the processors needed to run the service:

• Paddle — merchant of record. Handles checkout, cards, invoices, refunds and tax. They receive your email address to issue receipts.
• Our hosting and database providers — store the data above so the service can run.
• Our email provider — sends verification and account email. Receives your address and the message.
• Google / Facebook — only if you choose to sign in with them, and only the identity they return to us.

Cookies

A session cookie to keep you signed in, a short-lived cookie during a social sign-in to prevent request forgery, and a preference for light or dark theme. No advertising or cross-site tracking cookies, which is why there is no consent banner to dismiss.

How long we keep it

Your account and projects are kept while the account exists. Delete the account and both go with it, permanently and without a recovery window. Billing records are kept by Paddle for as long as tax law requires them, independently of us.

Your rights

You can access, correct, export or delete your data. Projects export in open formats from inside the app on every plan, and account deletion is self-service in settings. For anything else — a copy of what we hold, or a correction — email hello@cricutcraft.com and we will respond within 30 days.

If you are in the UK or EU, you also have the right to complain to your data protection authority. We would rather you told us first so we can fix it.

Children

The service is not aimed at children under 13, and we do not knowingly collect their data. If you believe a child has created an account, tell us and we will remove it.

Changes

If this notice changes materially we will say so in the app and by email before it takes effect. See also the terms of service and the refund policy.