Privacy Policy

Information you give us:

• Account — your email address and a password, which is hashed and stored by our authentication provider. We never see your password.
• Creator profile — niche, platforms, audience, goals, experience level, content pillars and tone, if you choose to fill them in.
• Your work — the prompts, scripts and transcripts you enter, and any ideas, scripts, hook and title sets, SEO sets, content plans and analyses you save.
• Thumbnails — the images Thumbnail Studio generates for you, and the text, fonts, colours and positions you set in the editor, so your design is still there when you come back.
• Reference images — any image you upload for Thumbnail Studio to copy a style from or to include (for example a photo of yourself, a product or a logo).

Font files you upload in the thumbnail editor stay in your own browser. They are never sent to us.

Information collected automatically:

• Usage records — which tool was used, how much of your allowance it used, and its approximate cost to us, so we can apply plan limits and keep the service affordable.
• How you found us — when you sign up we record where your first visit came from: the website that linked to us (for example YouTube or Google), or the campaign tag in the link you clicked. We use this only to understand which channels bring people to CraftX.
• Subscription status — your plan, renewal date, and cancellation state, received from our payment processor.
• Error and performance data — when something breaks, our monitoring tool records the error along with technical details such as browser, page, and a session identifier.
• Session replay — a sample of roughly one in ten sessions, and sessions where an error occurs, are recorded as a replay of on-screen activity so we can reproduce bugs. Replays capture what happens in the interface, including text you type into CraftX. They are retained by our monitoring provider and used only for debugging.

We do not collect or store your card details. Those go directly to our payment processor.

• To run the service — signing you in, generating output, and saving your work.
• To personalise results, using your creator profile and saved work as context.
• To apply plan limits and process your subscription.
• To find and fix faults, and to keep the service secure.
• To understand, in aggregate, which tools are used and what they cost, so we can improve the product and keep prices sustainable.
• To contact you about your account, billing, or material changes to the service.
• To send a few emails that help you use CraftX — a welcome note, a reminder if you haven't tried a tool yet, and a note when you've used up a free allowance. Every one has an unsubscribe link.

We do not send newsletters or third-party promotions, and we do not sell or rent personal data to anyone.

CraftX relies on a small number of providers. Each receives only what it needs to do its job.

• Resend — delivers CraftX emails (sign-in links, password resets and the emails described above). Receives your email address and the message.
• Supabase — authentication, database and file storage. Stores your account, profile, saved work, usage records, thumbnails and reference images. Hosted in the AWS Asia Pacific (Singapore) region. Images are kept in private storage that only our servers can read.
• DeepSeek — receives the prompt and relevant context for Idea Studio, Script Studio, Hooks & Titles, SEO Studio, Content Planner and Script Analyzer.
• fal — generates and edits images for Thumbnail Studio. Receives your thumbnail description and headline, and, when you use them, your reference image or the thumbnail you are editing, through a private link that expires after a few minutes.
• Anthropic — used only by Creator Coach, which is currently switched off. If it returns, it will receive the prompt and relevant saved context when you use it.
• Lemon Squeezy — merchant of record. Handles checkout, card processing, invoicing and tax, and sends us your subscription status.
• Sentry — error monitoring and session replay, as described above.
• Railway — application hosting, which processes requests as they are served.

Several of these are outside your country, so your data may be processed abroad. We may add or change providers as the product develops, and will update this list when we do.

We may also disclose data if required by law, or to protect the rights and safety of our users.

When you generate something, your prompt and any relevant saved context — and, in Thumbnail Studio, any image you chose to use — are sent to the AI provider handling that tool. We instruct providers not to use this content to train their models, and their business terms reflect that. Providers may retain the request briefly for abuse monitoring under their own policies.

Please avoid entering passwords, financial details, health information, or anything else sensitive into a prompt, and only upload images you have the right to use, including the permission of anyone shown in them.

• Account, saved work and thumbnails — until you delete the item, or delete your account.
• Reference images — deleted automatically within a day if they are never used to make a thumbnail, and within 30 days if they are.
• Usage records — retained so we can calculate allowances and support billing questions.
• Error data and session replays — retained by our monitoring provider on a rolling window, typically 90 days or less.
• Payment and invoice records — retained by Lemon Squeezy for as long as tax and accounting law requires.

• Access and correction — your profile and saved work are visible and editable in the app.
• Deletion — deleting your account from Settings removes your profile, saved work, thumbnails, uploaded images and usage records. This cannot be undone.
• Export — every tool lets you copy or download its output. If you want a full copy of your data, email us and we will send it.
• Objection — if you would rather not be included in session replay sampling, email us and we will exclude your account.

Depending on where you live you may have further rights, including to restrict processing or complain to a data protection authority. Email support@craftxapp.com and we will respond within 30 days.

Traffic is encrypted in transit. Passwords are hashed by our authentication provider and never stored in plain text. Every database query is scoped to the signed-in account, so one user cannot read another's work, and images are stored privately rather than at public addresses. No system is perfectly secure, and we will notify affected users promptly if a breach occurs.

CraftX is not intended for anyone under 16. We do not knowingly collect data from children. If you believe a child has created an account, contact us and we will remove it.

We use cookies that are necessary for the service to work — chiefly to keep you signed in, to remember an affiliate referral link you arrived through, and to note how you first found CraftX until you sign up. We do not use advertising or cross-site tracking cookies. See our Terms of Service for how the service itself operates.

We will post any update here with a new date, and email you if the change is significant. Questions go to support@craftxapp.com.