Craft Together for Android Privacy Policy

Effective date: September 23, 2026
Last updated: September 24, 2026

Colwood Craft, LLC, doing business as Craft Together ("Craft Together," "we," "us," or "our"), helps parents and caregivers find, plan, make, and save family-friendly craft activities. This Privacy Policy covers the Craft Together Android application, package app.crafttogether.android, and its supporting Android services. Our website and iPhone application are covered by the Craft Together website and iPhone Privacy Policy.

Craft Together is a parent and caregiver tool, not a service for children to use independently. Adults control family craft profiles, memories, purchases, shopping, sharing, and support requests. Children should not independently make purchases, contact support, or provide contact information.

1. Family Information Stored on Your Device

The Android app stores information you choose to enter or create, including:

• An optional parent or caregiver name, child nicknames, and broad age bands.
• Favorites, hidden crafts, supply inventory, shopping lists, plans, step progress, and completion history.
• Memory notes and photos.
• Local copies of craft ratings, issue descriptions, and their submission status. Section 5 explains when feedback is sent to Craft Together.
• Preferences and a timestamp recording adult confirmation during setup.

You do not need a Craft Together login, email address, or password to set up the Android app. We do not request a child's full date of birth. A local child profile is not a separate child account.

Family records are stored in the app's private files on your Android device. Age matching and family filters run on the device. Family names, age bands, memory notes, private photos, supply inventory, plans, and progress are not uploaded with catalog, security, or purchase requests.

The Android app does not provide family cloud sync, a server backup of family records, or family-data migration between iPhone and Android. Its private app data is excluded from Android cloud backup and device-transfer backup. The app keeps a previous local recovery copy for some storage problems; this is not an off-device backup.

Deleting app storage, uninstalling the app, or using its full local-data reset removes private family records and private memory photos. Reinstalling or restoring a purchase does not recover them from Craft Together. Device loss or storage failure can also cause data loss. Keep separate copies of photos or memories you do not want to lose.

2. Photos, Camera, Sharing, and Reminders

You can select photos using Android's photo picker or open the device's camera to take a photo. The app stores resized copies in its private storage and re-encodes photos without their original metadata. Private family photos and notes are not uploaded to Craft Together for image generation or used by Craft Together for advertising or AI training.

On supported devices, you can enable saving new camera captures to the device gallery. This setting is off by default. Gallery copies, original photos selected from elsewhere, and content shared outside the app are separate from the app's private files. Those copies can remain after an app reset or uninstall and may be handled by other apps or their backup settings. Use the relevant gallery, app, or service to manage them.

Sharing happens when you choose a sharing action and a destination through Android's share sheet. Sharing a memory includes its photo when available, craft title, date, and note. Sharing a craft includes craft text; sharing a shopping list includes item names and order-status markers. The receiving app or service handles its copy under its own privacy practices.

Planned-craft reminders use local Android scheduling and your notification settings. Craft Together does not use a remote push-notification provider for these reminders. You can change relevant permissions and preferences in the app or Android settings.

3. Catalog Delivery and Security Information

The app connects to dedicated Android services to download craft and material updates, permitted Pro content, preview cards, and craft artwork. Requests can include a randomly generated installation identifier, a session token, catalog update markers, and a random preview-session value. These requests do not include your private family records.

Our hosting provider, Cloudflare, processes network and request information, such as IP addresses, request paths, and times, to deliver content and protect the service. Installation identifiers and network information may be used for session verification, rate limits, troubleshooting, and abuse prevention.

We use Google Play Integrity to help verify the Android app, its signing certificate, Google Play license status, and device-security verdicts. Google processes relevant app and device information and provides an integrity result that our Android service verifies. We do not send family names, age bands, memory notes, or private photos in these integrity requests. See Google's Play Integrity information.

The random installation identifier is not an email address or child profile. It associates security sessions and Android purchase access with an installation. A family-data reset preserves this separate identifier. Clearing Android app storage or uninstalling removes the local identifier, but does not by itself delete information already held by service providers.

4. Android Purchases and Subscription Information

Google Play processes Android Pro purchases. RevenueCat supports purchase verification, subscription status, purchase reporting, and restoration through our separate Android project. The app supplies its random installation identifier to RevenueCat. Purchase processing can include product identifiers, purchase history, entitlement status, trial status, renewal, cancellation, expiration, and related store and SDK information.

We use this information to provide paid access, restore eligible Android purchases, troubleshoot purchases, prevent fraud, and maintain necessary records. We do not receive your complete payment-card details or Google Play password. Google and RevenueCat also process information under their own applicable terms and privacy practices. See RevenueCat's Google Play data guidance.

The purchase service may connect when the app starts or checks access, before you open a purchase screen. We do not send family names, child age bands, private photos, or memory notes as RevenueCat customer attributes. Purchase and security services process the information described above separately from private family records.

Manage Android subscriptions through Google Play. Deleting the app or its family records does not cancel a subscription or erase records Google retains. Android purchases and family records are separate from the iPhone product; restoring Android purchase access does not restore family data or transfer an Apple purchase.

5. Ratings, Issue Reports, and Support Messages

When you choose to send a rating or issue report, the app sends that selected item to Craft Together. Each Send or Retry action applies only to that item. Opening or updating the app does not upload ratings or reports that were previously saved only on your device, and the app does not automatically send a backlog when a connection returns.

A rating submission includes the craft identifier, your rating or request to remove it, and references used to apply the latest change. It is associated with the random installation identifier used for authenticated requests, rather than a family profile or email address. We use ratings to produce aggregate counts for each craft. The service retains the latest rating or removal marker so a delayed retry cannot restore an older choice.

An issue report includes the craft identifier, the message you enter, a report reference, app version and build, operating-system version, and device model. It is associated with your random installation identifier and the security context of the request. The app does not attach your family profiles, private memory photos or notes, supply inventory, plans, or progress. Please avoid entering child names or other unnecessary personal or sensitive information in the report itself.

Submitted ratings and reports are handled in Craft Together's restricted administrative tools to review feedback and improve crafts. In-app submissions do not send notification emails. The app keeps a local copy and submission status; if receipt cannot be confirmed, you can deliberately retry that item. Deleting local app data does not recall or delete feedback that our service already received. Retention and deletion are described in Section 8.

If you separately contact support@crafttogether.app or privacy@crafttogether.app, we receive your message, the contact information you provide, and attachments you choose to send. Our email and support providers process those communications so we can investigate and respond. Please include only information needed for your request, and avoid sending child names, private family photos, payment credentials, or other sensitive information unnecessarily.

6. Optional Shopping and Affiliate Links

Amazon product links are optional. Starting with version 1.0.0 build 5, Amazon Shopping is on by default for new installations; an existing saved choice to turn it off is preserved. You can turn these links off in Settings. Showing a link does not open Amazon or make a purchase. Opening a link takes you to Amazon, which receives the link and normal network or browser information. The Android app's current shopping flow opens product links; it does not upload your shopping list to create a server-generated cart.

We do not send family profiles, memory notes, or private photos with a shopping link. Amazon's privacy notice and terms apply to your visit and any purchase. Craft Together does not receive your Amazon payment details or complete order history. We may earn a commission from qualifying purchases through affiliate links.

7. How We Use and Disclose Information

We use information to provide local family features, deliver craft content, verify paid access, restore eligible purchases, review feedback you submit, understand app engagement, improve crafts and usability, respond to requests, secure the service, comply with law, and protect users and our rights.

Information may be processed by:

• Google, for Android platform features, Google Play purchases, and Play Integrity.
• RevenueCat, for Android purchase verification, subscription status, purchase reporting, and restoration.
• Cloudflare, for dedicated Android service hosting, database and cache storage, image delivery, request security, and storage of ratings and issue reports you submit for review in our restricted administrative tools.
• TelemetryDeck, for app-usage measurements in a dedicated Android analytics project, separately from our iPhone app.
• Email and support providers, for messages you choose to send to our support or privacy contacts.
• Amazon and destinations you choose when sharing, when you open a retailer link or deliberately share content outside the app.

Optional app-usage measurements

Starting with version 1.0.0 build 5, the app uses TelemetryDeck to understand whether features work well and where people need a better experience. Usage sharing is on by default and can be turned off with Share anonymous usage in Settings. It is separate from the purchase, security, and feedback services described above.

Usage events describe actions such as opening a screen, starting or completing a craft, saving a memory, using supplies, viewing Pro, and purchase or restore outcomes. Parameters are limited to predefined categories, success or failure states, true/false values, and broad count ranges. For example, an event may indicate that a saved memory has a photo, but it does not include the photo or its contents.

TelemetryDeck receives app version and build, operating-system and SDK information, device brand, model, product and architecture, event timing, and a random session reference. Analytics uses its own random installation reference, hashed before transmission; it does not reuse the installation reference used for purchases or feedback. TelemetryDeck describes additional hashing on its servers in its anonymization documentation.

We do not attach family names, child profiles or age bands, photos, notes, search text, report messages, email addresses, shopping-item contents, craft titles or identifiers, purchase identifiers, or raw error messages to analytics events. We do not use an advertising identifier or combine this Android analytics project with iPhone identities.

Unsent events are held only in a limited in-memory buffer. Turning usage sharing off stops new event collection and clears that buffer; an already-started network request may still finish. Closing the app process also loses unsent events. Turning sharing back on starts with new activity, without uploading earlier family records or unsent activity from a previous session. Turning it off does not delete events already received by TelemetryDeck. See Section 8 for retention.

Resetting family data or restoring a local recovery copy preserves your current usage-sharing choice. If that choice cannot be read because local storage is damaged, recovery and reset keep sharing off.

The app does not include an advertising SDK. Craft Together does not sell personal information or use personal information for cross-context behavioral or targeted advertising.

Some general craft artwork may be generated or supplemented using artificial intelligence. These are catalog illustrations, not private family memories. Private family photos and notes are not submitted by the Android app to image-generation services.

We may disclose information when required by law or valid legal process; when reasonably necessary to investigate abuse or protect rights and safety; or in connection with a merger, acquisition, financing, reorganization, or sale of assets. Where required, we provide notice and require an acquiring party to protect information consistently with applicable law.

8. Retention and Deletion

We retain information only for as long as reasonably necessary for the purposes described in this Policy, unless a longer period is required or permitted by law. Retention depends on the type of record, whether it is still needed to provide a requested service, security and troubleshooting needs, and applicable legal obligations.

• Private family records, memory photos, and local feedback copies remain on your device until removed through app controls, app-storage deletion, uninstall, or another device action. Deletion controls also clear relevant local recovery copies. Separate gallery copies, original photos, and shared copies require separate deletion. Removing local data does not delete ratings or reports already received by our service.
• Submitted issue reports are scheduled for automatic deletion from our feedback database after 365 days. The provider-backup and necessary-preservation exceptions below still apply.
• Submitted ratings retain the latest rating or removal marker for each craft and random installation reference, along with its revision. A removal marker does not count as a rating; it is retained to prevent a delayed or repeated request from restoring an older rating. These latest-state records do not have an automatic expiry. Contact privacy@crafttogether.app for help with a deletion request.
• Subscription and entitlement records are retained as needed to provide access, restore eligible purchases, prevent fraud, reconcile subscription events, resolve disputes, and meet applicable recordkeeping obligations. Google and RevenueCat may retain records under their own practices and obligations.
• App-usage measurements already received by TelemetryDeck may remain in its event storage and aggregate reports after you disable sharing, reset local family data, or uninstall. TelemetryDeck currently describes no fixed deletion schedule for its anonymized cold-storage events; dashboard query limits are not a deletion deadline. See its privacy and retention information, or contact privacy@crafttogether.app for help. We cannot promise to identify an individual person's events from these anonymous records.
• Security challenges, sessions, cache entries, rate-limit records, and operational logs are retained for limited periods based on their security, delivery, and troubleshooting purposes. Expiration of a session or cache entry does not mean that every related provider log or backup is erased at that same time.
• Support and privacy communications are retained as needed to investigate and respond to requests, maintain relevant correspondence, resolve disputes, and meet legal obligations. You can contact us to request deletion, subject to applicable exceptions.

Information may remain temporarily in provider backups under their normal retention schedules. We may preserve relevant records longer when necessary to comply with law, respond to a legal claim, investigate abuse, protect safety, or honor a legal hold.

Our support team cannot recover or remotely delete private family records that remain only on your device. Use the app's controls or Android's app-storage controls for those records. To request help with information held by our services, contact privacy@crafttogether.app. We may need a purchase reference, installation reference if available, or other reasonable information to locate records and verify your authority. Do not send passwords or full payment-card details.

A request to delete remote information is separate from deleting local files and canceling a Google Play subscription. Each action has its own controls and effects.

9. Children's Privacy and Adult Controls

Craft Together is designed for adults to use with their families. Parents and guardians choose what child-related information to enter and can review, edit, or delete local profiles and memories through the app. Children should not independently submit information, contact support, make purchases, or use shopping features.

We do not knowingly collect personal information directly from a child under 13 without appropriate parental authorization. If you believe a child provided personal information directly to us, contact privacy@crafttogether.app so we can investigate and take appropriate action.

10. Security

We use reasonable administrative, technical, and organizational safeguards designed to protect information. These include Android private app storage, encrypted network connections, access controls, session checks, rate limits, and app-integrity verification. No transmission or storage system is completely secure.

You are responsible for securing your device and the Google account used for purchases. If you believe information has been accessed without authorization, contact privacy@crafttogether.app.

11. International Processing and Your Privacy Rights

Craft Together is operated from the United States. Information handled by our online services may be processed in the United States or other countries where our providers operate. Those countries may have privacy laws different from those where you live. This does not mean that the private family records described in Section 1 are uploaded to those services.

If the laws of the European Economic Area, United Kingdom, or Switzerland apply, Colwood Craft, LLC is the controller of personal information processed for Craft Together, except where a provider acts independently under its own notice. Depending on the activity and applicable law, our legal bases include providing a requested service or subscription, legitimate interests in operating and securing the service where not overridden by your rights, consent when requested and applicable, and legal obligations. Cross-border processing is subject to any safeguards required by applicable law. Contact privacy@crafttogether.app for information about processing and safeguards relevant to your information.

Depending on where you live and subject to applicable exceptions, you may have rights to:

• Confirm whether we process your personal information and receive a copy.
• Correct inaccurate information or request deletion.
• Receive portable information in an appropriate format.
• Restrict or object to certain processing.
• Withdraw consent for future processing where consent is the legal basis.
• Appeal a decision about a privacy request where local law provides an appeal right.
• Use an authorized agent where permitted and receive equal service when exercising your rights.

Residents of the European Economic Area, United Kingdom, and Switzerland may also have the right to complain to the relevant data-protection authority. Other regional rights may apply. This Policy does not waive rights provided by applicable law.

Send requests or appeals to privacy@crafttogether.app. Explain the request and provide only information reasonably needed to locate relevant records. We may verify your identity and authority. Verification information is used for that process. We will respond within the period required by applicable law and explain any reason we cannot fulfill a request and available appeal or complaint options.

12. Other Services and Policy Changes

Google, Amazon, services you choose through Android's share sheet, and other independent third parties have their own privacy notices. Our controls do not delete copies you have placed with those services. Use of the Craft Together website is covered by our website Privacy Policy.

We may update this Policy to reflect changes in the Android app, providers, law, or privacy practices. We will update the "Last updated" date. If a change materially affects how we handle personal information, we will provide additional notice or request consent when required by law.

13. Contact Us

Questions, requests, or complaints about the Android app's privacy practices may be sent to:

Colwood Craft, LLC d/b/a Craft Together
Privacy email: privacy@crafttogether.app
Support email: support@crafttogether.app
Website: crafttogether.app