Craft Together Privacy Policy

Effective date: October 12, 2026

Last updated: October 12, 2026

Colwoodcraft LLC, doing business as Craft Together ("Craft Together," "we," "us," or "our"), helps parents and caregivers find, plan, make, and save family-friendly craft activities. This Privacy Policy explains how we collect, use, disclose, retain, and protect information when you use the Craft Together website, the Craft Together iOS application, and related services.

Craft Together is a parent and caregiver tool, not a service for children to use independently. Children should not create accounts, submit support requests, make purchases, use shopping features, or provide contact information directly. Parents and guardians control family craft profiles, memories, supplies, subscriptions, and sync choices.

1. Information We Collect

We collect information you provide, information created when you use features, information required for purchases and optional sync, and limited technical information needed to operate, secure, and improve Craft Together.

Parent, Account, and Consent Information

When you set up Craft Together, use Sign in with Apple, contact support, or enable account and sync features, we may collect:

Parent or caregiver name.
Parent or caregiver email address, including an Apple private relay address if selected.
The Apple account identifier provided through Sign in with Apple.
Craft Together install, account, session, device-security, or request identifiers.
Parent or guardian consent records, including the version and timestamp.

Child and Family Craft Information

When a parent or caregiver sets up and uses Craft Together, the application may store:

A child's first name, nickname, or profile name.
A child's age or broad age band used to personalize craft recommendations.
Favorites, hidden crafts, planned and completed crafts, step progress, and preferences.
Supply inventory, missing supplies, shopping lists, and material status.
Craft ratings, issue reports, and other feedback an adult chooses to submit.
Memory notes, craft photos, and videos an adult chooses to add.

Please do not add sensitive information to free-form memory notes, ratings, support messages, or issue reports.

Subscription and Purchase Information

Craft Together Pro subscriptions and free trials are processed by Apple and supported by RevenueCat. We may receive and store:

Subscription and entitlement status.
Product identifiers, trial status, renewal status, cancellation or expiration status, and Craft Together purchase history.
RevenueCat app-user identifiers associated with an app install or Apple sign-in.

RevenueCat receives device and technical information with subscription-related requests, including Apple's Identifier for Vendor (IDFV), application and build versions, operating-system version, device model, preferred languages, App Store storefront, and current App Tracking Transparency permission status. Subscription information may be refreshed when the application starts, before you make a purchase. We use subscription information to validate purchases, restore access, manage trials and Pro entitlements, prevent fraud, and understand subscription activity and revenue through RevenueCat's dashboard.

We have not enabled RevenueCat's optional advertising-attribution integrations, advertising identifier (IDFA) collection, AdServices attribution-token collection, or SDK diagnostic reporting.

We do not receive or store full payment-card numbers, App Store billing credentials, or other complete App Store payment details.

iCloud Sync Information

Sign in with Apple and iCloud sync are optional features for eligible Pro users. If you enable iCloud sync, Craft Together may sync family craft data, preferences, supplies, progress, photos, videos, and memories using your private iCloud database through Apple CloudKit.

If you do not enable Sign in with Apple and iCloud sync, project data generally remains local to your device, except where information is needed for catalog delivery, application functionality, purchases, support, ratings, issue reports, shopping handoff, security, or the other services described in this Policy.

Photos, Videos, Camera, and Memories

If you add photos or videos to craft memories, those files are stored for the features you choose to use. Depending on your settings, memory content may remain local to your device or sync through your private iCloud database.

The application requests camera or photo-library access only when you use a feature that needs it. Craft Together does not use private memory photos or videos for advertising or AI training.

Shopping and Amazon Cart Handoff

If you choose to open a shopping link or Amazon cart handoff, selected supply information and a short-lived cart token may be sent to our backend and then to Amazon so the shopping page can open.

Once you leave Craft Together, Amazon's privacy notice and terms apply. We do not receive Amazon payment details or your complete Amazon order history. We may earn a commission from qualifying purchases through affiliate links.

Support, Ratings, and Issue Reports

If you contact support, submit a rating, or report a craft issue, we may collect:

Your contact email address, if provided.
The craft, material, or feature involved.
Your written note, rating, or report.
Application version, build number, operating-system name and version, and device model.
Install, account, session, or request identifiers required to route, debug, and secure the request.

Issue reports may be stored in our backend and sent to our support email provider so we can investigate and respond.

Website and Website Analytics Information

The website update published on October 12, 2026 disables optional Base44 usage analytics, including automatic initialization, heartbeat, session-duration and page-view events and custom App Store, Google Play and blog interaction events. It also removes remotely loaded Google Fonts and uses fonts available on your device. An already-open page may continue running the earlier website code until it is reloaded.

Base44 and our website hosting providers still process information in connection with serving pages and images, retrieving published blog content, supporting authentication where used, securing requests, and delivering messages you choose to submit. This may include IP address, browser and device details, requested resources, timestamps, and name, email address and message content submitted through the contact form. The updated public blog, website-settings and contact requests do not add a persistent anonymous browser identifier or the full page URL through Base44 SDK headers. Authentication or administrative features, where used, still rely on the Base44 SDK and may attach browser identifiers and page URLs; authentication storage also remains. A previously stored analytics identifier may remain in your browser but is not used by the updated public requests. These changes do not erase information previously received by Base44, Google Fonts or hosting providers. Retention and deletion for those records require separate provider review.

Craft Together does not use third-party advertising pixels on the website, sell website visitor information, or use website information to target advertising across other companies' websites or applications.

Application Usage Analytics and Earlier Versions

iOS 1.2.1 (build 39) removes the former app-usage analytics client and usage-event collection. That release does not send app launches, feature views, onboarding steps, purchase outcomes or performance samples to the retired analytics service. On launch, it attempts to remove the retired client’s pending event cache and analytics-only preferences from the device. Local performance diagnostics remain on the device; purchases, support, catalog delivery, shopping handoff and backend security use the separate services described in this Policy.

Earlier installed versions included feature-use events, technical app/device metadata and a hashed installation identifier. They may still contain the retired client and attempt to send usage events until updated. We retired the former app-usage analytics organization on October 12, 2026; see Section 7. Install iOS 1.2.1 or a later release without that client to remove it from your device.

2. Information We Do Not Sell or Use for Targeted Advertising

Craft Together does not sell personal information. We do not use personal information for cross-application or cross-website targeted advertising, and we do not use third-party advertising SDKs in the iOS application.

3. How We Use Information

We use information to:

Provide and personalize craft recommendations, plans, supplies, progress, and memories.
Set up and manage parent and child profiles.
Process subscriptions, free trials, restores, and Pro entitlements.
Provide optional Sign in with Apple and iCloud sync.
Save and sync family craft data when sync is enabled.
Prepare optional shopping lists and cart handoffs.
Respond to support requests, ratings, and issue reports.
Maintain security, verify sessions, prevent fraud and abuse, enforce rate limits, and protect our backend.
Understand website delivery and reliability through operational information, support reports and historical website usage records, and improve application reliability through local diagnostics and support reports. Earlier application versions also used the usage analytics described in Section 1.
Comply with legal obligations, enforce our Terms and Conditions, and protect our rights and users.

4. How We Disclose Information

We disclose information only as needed to operate Craft Together, provide a feature you request, comply with law, or protect rights and safety.

Service Providers and Platform Partners

Limited information may be processed by:

Apple, for App Store purchases, Sign in with Apple, iCloud and CloudKit sync, device permissions, notifications, and Apple platform services.
RevenueCat, for subscription status, purchase history, trial status, restores, and Pro entitlements.
Cloudflare, for our backend, databases, storage, image delivery, security controls, rate limits, and operational logs.
Base44 and website hosting providers, for website delivery, published content, contact and authentication features, request security, remaining platform processing, and historical website usage records as described in Section 1.
AI service providers, such as OpenAI or another provider we use, for creating or supplementing general craft images displayed in the application.
Amazon, when you choose to open an Amazon link or cart handoff.
Email and support providers, such as Resend or our support inbox provider, for support messages, issue reports, and operational notices.

These providers process information for the services they provide to us and are subject to contractual, legal, and security obligations appropriate to their role.

Legal, Safety, and Business Transfers

We may disclose information when required by law, legal process, or a valid government request; when reasonably necessary to protect the rights, safety, and security of Craft Together, our users, or others; or in connection with a merger, acquisition, financing, reorganization, or sale of assets. Where required, we will provide notice and require an acquiring party to handle personal information consistently with applicable law.

5. Children's Privacy

Craft Together is built for parents and caregivers to use with their families. Children should not independently create accounts, submit support requests, make purchases, use shopping handoffs, or provide contact information.

Parents and guardians control child profiles and family craft data. Child-related information is used to provide features such as age-appropriate recommendations, craft history, supplies, progress, and memories an adult chooses to save.

Parents and guardians can review, update, or delete child profiles, memories, and other project data through application settings. You may also contact privacy@crafttogether.app for help reviewing or deleting information associated with a family account.

We do not knowingly collect personal information directly from a child under 13 without appropriate parental authorization. If you believe a child provided personal information directly to us, contact us so we can investigate and take appropriate action.

6. Your Choices and Controls

Depending on the features you use, you can:

Use Craft Together without Sign in with Apple.
Choose whether to enable eligible iCloud sync features.
Add, edit, and delete child profiles, photos, videos, memories, supplies, favorites, hidden crafts, plans, and progress.
Manage camera, photo-library, and notification permissions in iOS Settings.
Manage or cancel a subscription through Apple Account subscription settings.
Manage Sign in with Apple and iCloud through Apple settings.
Delete local project data through Craft Together settings.
Delete an eligible Craft Together account record associated with Sign in with Apple.
Install iOS 1.2.1 or a later release without the retired app-usage analytics client to remove it from your device.
Contact us to request access, correction, deletion, or other privacy assistance.

If you use Craft Together without Sign in with Apple, we may need information such as a support email, issue-report identifier, install identifier, or other details you provide to locate backend records not linked to an Apple account.

iOS 1.2.1 (build 39) adds a recoverable account-deletion process that asks you to authorize Sign in with Apple again when needed to revoke the application's Apple authorization. It sends a one-use authorization code, identity token and nonce to our backend for verification and token revocation with Apple. The backend does not store those Apple codes or grant tokens in its database. Limited deletion and revocation records contain the Apple account identifier, request identifier, proof and session hashes, verified token-issuance cutoff, expiration and completion state so an interrupted deletion can be resumed and an older identity token cannot recreate a deleted account. Account-only deletion preserves family project data and private iCloud project records; use the separate project-data deletion control to erase those records.

Deleting a Craft Together account record does not cancel an App Store subscription, delete Apple's purchase records, delete information Apple maintains under its policies, remove photos saved separately to the Photos application, or necessarily remove local-only data from another device.

7. Data Retention

We retain information only for as long as reasonably necessary for the purposes described in this Policy, unless a longer period is required or permitted by law.

Local project data remains on a device until you delete it, reset project data, uninstall the application, or the device removes it.
iCloud-synced project data remains associated with your private iCloud database until it is deleted through Craft Together or applicable iCloud controls, subject to Apple's backup and retention practices.
Craft issue reports are retained in our backend for up to one year. Copies sent to a support inbox or email provider may remain until deleted under our support retention practices or a valid deletion request.
Account and consent records are retained while an account is active and for a limited period afterward when needed for security, legal compliance, dispute resolution, or operational records.
Account-deletion recovery and revocation records in the update expire 30 days after the corresponding request and are then removed by scheduled cleanup. A subsequent revocation request can renew its limited security cutoff record for a further 30 days. They contain limited recovery/security information rather than Apple authorization codes, identity tokens, access tokens or refresh tokens. Cleanup timing depends on the backend job completing successfully.
Subscription and entitlement records are retained as needed to provide access, process restores, prevent fraud, reconcile webhook events, and comply with legal or accounting obligations.
Ratings may remain until removed, replaced, or deleted with an associated eligible account record.
Security sessions, challenges, rate-limit records, and operational logs are retained for limited periods based on their security and troubleshooting purpose.
Historical website analytics and remaining website platform records are handled by Base44 and website hosting providers according to their applicable retention practices. Disabling optional website usage events or removing application analytics does not delete information already received. The retention and deletion of these records require separate provider review.
Former app-usage analytics: the organization used for our former app-usage analytics service was deleted on October 12, 2026. The provider’s organization-deletion confirmation states that this permanently deletes all analytics data belonging to that organization. This is separate from purchase, support, website-platform and security records described elsewhere in this Policy.

We may retain information longer when reasonably necessary to comply with law, respond to a legal claim, investigate abuse, enforce an agreement, protect safety, or preserve records subject to a legal hold. Information may remain temporarily in encrypted or restricted backups until those backups are overwritten according to normal schedules.

8. Security

We use reasonable administrative, technical, and organizational safeguards designed to protect information. These may include Apple platform security, Keychain storage, private CloudKit databases, encrypted network connections, access controls, rate limits, application-integrity checks such as App Attest, and backend security monitoring.

No transmission or storage system is completely secure. If you believe information may have been accessed without authorization, contact us promptly at privacy@crafttogether.app.

9. International Processing and Legal Bases

Craft Together is operated from the United States. Information may be processed in the United States, the European Union, or other locations where our service providers operate. Those locations may have privacy laws different from the laws where you live.

If the laws of the European Economic Area, United Kingdom, or Switzerland apply, Colwoodcraft LLC is the controller of personal information processed for Craft Together, except where a provider acts as an independent controller under its own notice.

Depending on the processing activity, we rely on one or more of the following legal bases:

Performance of a contract, when processing is necessary to provide a feature, subscription, account, requested support, sync, or shopping handoff.
Legitimate interests, such as securing and operating the Services, preventing fraud and abuse, troubleshooting, understanding general feature performance, improving Craft Together, and protecting our users and rights, where those interests are not overridden by your rights.
Consent, when we specifically request consent for an optional activity and applicable law treats consent as the appropriate basis. You may withdraw consent prospectively through available controls or by contacting us.
Legal obligations, when processing is necessary to comply with law, respond to valid legal process, maintain required records, or protect legal rights.

When personal information is transferred from the European Economic Area, United Kingdom, or Switzerland to a country that has not been recognized as providing adequate protection, we use a lawful transfer mechanism where required. Depending on the provider and transfer, this may include an adequacy decision, the European Commission's Standard Contractual Clauses, the United Kingdom's approved transfer addendum or agreement, or another mechanism permitted by applicable law. You may contact privacy@crafttogether.app for more information about safeguards relevant to your information.

10. State and Regional Privacy Rights

Depending on where you live and subject to applicable exceptions, you may have rights to:

Confirm whether we process your personal information.
Access or receive a copy of personal information.
Correct inaccurate personal information.
Delete personal information.
Receive portable information in an appropriate format.
Restrict or object to certain processing.
Withdraw consent for future processing where consent is the legal basis.
Appeal a decision we make about a privacy request where local law provides an appeal right.
Use an authorized agent to submit a request where permitted.
Receive equal service and not be discriminated against for exercising a privacy right.

Craft Together does not sell personal information or use it for cross-context behavioral or targeted advertising. We therefore do not currently provide a sale or targeted-advertising opt-out for the Services described in this Policy.

Residents of the European Economic Area, United Kingdom, and Switzerland may also have the right to lodge a complaint with the data-protection authority where they live, work, or believe a violation occurred. We encourage you to contact us first so we can try to resolve the concern.

To submit a request or appeal, email privacy@crafttogether.app. Describe the request and the account, device, support email, report identifier, or other information reasonably needed to locate the relevant records. We may verify your identity and authority before completing a request. Verification information will be used only for the verification and request process.

We will respond within the period required by applicable law. If we cannot fulfill some or all of a request, we will explain the reason and any available appeal or complaint option.

11. AI-Generated Craft Images

Some general craft images shown in Craft Together are generated or supplemented using artificial intelligence. Relevant craft details—such as a title, description, steps, and materials—may be sent to our backend and an AI image provider to create these images. Generated images and operational records may be stored so the images can be displayed, reviewed, and protected against abuse.

We do not intentionally send child profile details, parent contact information, private memory notes, or private family photos or videos for AI image generation. Private family photos and videos are not used to train AI models by Craft Together.

AI-generated images are illustrative references rather than photographs or guarantees of a finished result and may contain inaccurate or unrealistic details.

12. Other Services and Links

Craft Together may link to Apple, Amazon, or other third-party websites and services. Their privacy notices govern information they collect independently. Review those notices before providing information or using an external service.

13. Changes to This Privacy Policy

We may update this Policy to reflect changes in the Services, vendors, law, or privacy practices. We will update the "Last updated" date when we make a change. If a change materially affects how we handle personal information, we will provide additional notice or request consent when required by law.

14. Contact Us

Questions, requests, or complaints about this Policy or Craft Together's privacy practices may be sent to:

Colwoodcraft LLC d/b/a Craft Together

Privacy email: privacy@crafttogether.app

Support email: support@crafttogether.app

Website: crafttogether.app