Your collection,
precisely cataloged.

Last updated: April 18, 2026

This Privacy Policy describes how Cratelog ("we", "us", or "the app") collects, uses, and protects information when you use the Cratelog mobile application. By using Cratelog, you agree to the collection and use of information in accordance with this policy.

1. Information We Collect

Cratelog collects only the minimum information necessary to provide its features:

• Discogs Account Information — When you connect your Discogs account via OAuth, we receive your Discogs username and OAuth access tokens. We do not receive or store your Discogs password.
• Camera Images — When you use barcode scanning or label identification, images captured by your device camera are processed to identify music releases. Images are transmitted securely to our backend service for processing.
• PDF Invoices — When you use the invoice import feature, text is extracted from uploaded PDF files and processed to match purchases to catalog entries.
• Subscription Purchase Tokens — When you subscribe to Collector Mode, a purchase token issued by Google Play or the Apple App Store is sent to our backend to verify your entitlement. We store the token, product identifier, and entitlement status. We do not receive or store credit card numbers, billing addresses, or any payment credentials.

2. How We Use Your Information

• Authentication — OAuth tokens are used to authenticate requests to the Discogs API on your behalf.
• Release Identification — Camera images and extracted text are sent to our secure backend, which forwards the request to OpenAI as our AI processing provider. Data sent to the AI model is used solely for the requested identification task and, per OpenAI’s API data usage policy, is not used to train OpenAI models.
• Collection Management — Your Discogs collection data is accessed directly through the Discogs API to provide browsing, searching, and management features.

3. Third-Party Service Providers

Cratelog uses the following third-party services:

• Discogs API — For catalog data and collection management. Subject to Discogs’ Privacy Policy.
• OpenAI — For image and text recognition, accessed through our secure backend proxy. Subject to OpenAI’s Privacy Policy and OpenAI API Data Usage Policy. API requests are not used to train OpenAI’s models.
• AWS (Amazon Web Services) — Our backend proxy and billing services are hosted on AWS Lambda / API Gateway. AWS only acts as infrastructure; it does not see your data outside of routing requests to OpenAI. Subject to AWS Privacy Policy.
• Google Play / Apple App Store — Subscription purchases are processed entirely by the respective platform. We do not receive or store payment information.

4. Data Storage & Security

• Authentication tokens are stored using secure platform mechanisms (Android Keystore / iOS Keychain) via encrypted storage.
• All network communication uses HTTPS/TLS encryption.
• We do not store camera images or PDF content on our servers after processing is complete.
• Cached release metadata is stored locally on your device.

5. Data We Do NOT Collect

Cratelog does not collect:

• Location data
• Contact information
• Device identifiers or advertising IDs
• Usage analytics or crash reporting data
• Financial or payment information
• Email addresses or phone numbers

6. Data Retention

• Camera images and PDF text are processed in real-time and are not retained after the identification request is complete.
• OAuth tokens are stored locally until you disconnect your Discogs account or uninstall the app.
• Cached metadata is stored locally and can be cleared by clearing app data or uninstalling.
• Subscription entitlement data (purchase token, product ID, and status) is retained on our backend for the duration of your subscription. It is permanently deleted when you delete your account through the app.

7. Data Deletion

You may request deletion of your data at any time. See our Data Deletion section below for instructions.

8. Children's Privacy

Cratelog is not directed at children under 13. We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, please contact us at the address below.

9. Changes to This Policy

We may update this Privacy Policy from time to time. Changes will be posted on this page with an updated "Last updated" date. Continued use of the app after changes constitutes acceptance of the revised policy.

10. Contact Us

If you have questions about this Privacy Policy, please contact us at:
support@cratelog.app

Last updated: April 18, 2026

By downloading, installing, or using Cratelog, you agree to these Terms of Service. If you do not agree, do not use the app.

1. Description of Service

Cratelog is a mobile application for cataloging vinyl records. It provides barcode scanning, release identification, and integration with the Discogs platform for collection management.

2. Account & Authentication

Certain features require connecting your Discogs account via OAuth. You are responsible for maintaining the security of your Discogs account credentials. Cratelog does not store your Discogs password.

3. Subscriptions & Purchases

• Some features may require a paid subscription.
• Subscriptions are processed and managed through Google Play or the Apple App Store.
• Billing, renewal, and cancellation are governed by the policies of the respective platform.
• We do not process payments directly.

4. Acceptable Use

You agree not to:

• Use the app for any unlawful purpose
• Attempt to reverse-engineer, decompile, or extract source code from the app
• Abuse the Discogs API through the app beyond normal usage
• Distribute, resell, or sublicense the app or its features

5. Third-Party Services

Cratelog integrates with third-party services (Discogs, OpenAI, AWS). Your use of these services through the app is also subject to their respective terms of service and privacy policies. Cratelog is not affiliated with, endorsed by, or sponsored by Discogs, OpenAI, or Amazon.

6. Intellectual Property

Cratelog and its original content, features, and functionality are owned by the developer and are protected by applicable intellectual property laws. Discogs® is a registered trademark of Zink Media, Inc.

7. Disclaimer of Warranties

Cratelog is provided "as is" and "as available" without warranties of any kind, either express or implied. We do not guarantee the accuracy of identification results, catalog data, or the availability of third-party services.

8. Limitation of Liability

To the maximum extent permitted by law, the developer shall not be liable for any indirect, incidental, special, consequential, or punitive damages resulting from your use of the app.

9. Changes to Terms

We reserve the right to modify these terms at any time. Changes will be posted on this page. Continued use of the app constitutes acceptance of the updated terms.

10. Contact

For questions about these Terms of Service, contact us at:
support@cratelog.app

Last updated: April 18, 2026

In compliance with Google Play and Apple App Store requirements, you can request deletion of your data at any time.

How to Delete Your Data

Option 1: In-App (Recommended)

• Open Cratelog and tap the gear icon in the header to open Settings.
• Under Account, tap Delete Account & Data to permanently delete your server-side session, entitlements, subscription data, and all data associated with your account.
• If you have an active subscription, cancel it first in your device’s subscription settings (Google Play or App Store) to stop future charges.
• Optionally, uninstall the app to remove all remaining locally stored data (preferences, cached metadata).

Option 2: Disconnect Only

• Tap Disconnect in the header to remove authentication tokens and cached collection data from your device without deleting server-side data.

Option 3: Email Request

To request deletion of any data that may exist on our servers, send an email to support@cratelog.app with the subject line "Data Deletion Request". Include your Discogs username so we can locate any associated data. We will process your request within 30 days and confirm deletion by email.

What Gets Deleted

• Authentication tokens — Removed from your device (in-app disconnect) and invalidated on our backend.
• Session data — Any server-side session associated with your account is permanently deleted.
• Subscription & entitlement data — Purchase tokens, product identifiers, and entitlement status stored on our backend are permanently deleted. Note: deleting your account does not automatically cancel an active Play Store or App Store subscription; you must cancel it separately.
• Cached metadata — Removed when you clear app data or uninstall.

What We Do NOT Store

Camera images, PDF invoice content, and identification results are processed in real-time and are not stored on our servers after processing. There is no persistent image or document data to delete.