Privacy Policy

Last updated: August 8, 2026 · Effective: August 8, 2026

Short version: the Crate desktop app processes your files locally on your machine — we don't see your audio and the app works offline. If you use Crate Send, your files do pass through our servers: encrypted, temporarily, scanned for malware, then deleted on schedule. The website uses standard analytics, and it asks for your email address in exactly one place — the form that emails you the download links, if you want them. The details of everything are below.

Who we are (data controller)

The data controller for the processing described in this policy is:

Fluxcode Studio LLC
Westerville, Ohio, USA (postal address available on request via legal@fluxcode.studio)
Privacy requests: privacy@fluxcode.studio · Legal notices: legal@fluxcode.studio

1. What Crate (the desktop app) collects

The desktop app runs entirely on your computer. When you pack, restore, and verify locally, your audio files, session data, and .crate packages never leave your machine through us — your audio is never uploaded, never profiled, and the app works fully offline. (The one exception is when you explicitly use Crate Send to transfer files — see Section 2.)

The desktop app makes these kinds of network requests:

• Update check — an optional request to our download server (dl.crate.fluxcode.studio) to see if a newer version is available. Contains only the app version string in the User-Agent header — no personal data.
• Pseudonymous usage analytics (on by default; opt out anytime in Settings → Privacy → Usage analytics) — to understand how Crate spreads and where to improve it, the app sends fire-and-forget events tagged with an opaque, randomly-generated install identifier (a UUID): app opens, packs, unpacks, free-pack and license activations. Each event carries the app version, OS, and a coarse country derived from your IP at our server and then discarded — the IP itself is never stored. No filenames, no audio, no names, no account, no precise location, and nothing that directly identifies you. These events are stored in our own database, which is hosted by Neon in the United States. With analytics off, nothing leaves the device. We rely on legitimate interest (GDPR Art. 6(1)(f)) for this pseudonymous, low-impact processing; see also our crash-reporting note below.

1a. Crash & error reporting (beta)

During the beta, when Crate hits a genuine bug (a fault in our code, not a problem with your computer or files), it sends us a small report so we can fix it. Problems caused by your environment — running out of disk space, a missing or blocked component, a wrong passphrase, a damaged package — are shown to you and never reported.

A bug report contains: a pseudonymous install identifier (the same random UUID described above), the app version, your operating system, a short error code and message, and a trailing snippet of the app's own log. Before anything is sent, file paths are stripped — every path becomes the placeholder <path> — so no filenames, folder names, audio data, or other personal content leaves your machine. Reports are sent over an encrypted connection to our service on Fly.io and emailed to our team through Resend.

Lawful basis (GDPR): legitimate interest — keeping the app stable and correct during the beta. Retention: reports are deleted after 90 days. Your control: crash reporting is on by default and you are shown a notice on first launch; you can turn it off at any time in Settings → Crash reports. To request deletion of reports tied to your install, email privacy@fluxcode.studio (we locate them by install identifier).

1b. Testimonials you choose to send

When Crate unlocks for you through the free first-pack offer, the app asks once whether you want to say what it saved you. It is a short note, a place to put a name or @handle if you want to be credited, and a checkbox that says we may share the note with that name. Skip sends nothing, the question is never asked twice, and leaving the note blank sends nothing either.

If you do send one, we store the text (up to 1,000 characters), the name or handle if you gave one, whether you ticked the sharing box, the app version, a coarse country, the date, and the same pseudonymous install identifier described above. The checkbox is what makes a quote publishable — without it, the note stays internal and is only read to decide what to build next. Lawful basis (GDPR): consent for publishing your words and name; legitimate interest for the feedback itself. Where it lives: the same database at Neon in the United States. Your control: to withdraw the permission to publish, or to have the note deleted entirely, email privacy@fluxcode.studio — we will stop using it and remove it from anywhere we have put it.

2. Crate Send & Receive (the transfer service)

The desktop app's local-only story above changes when you use Crate Send — that's the point of the service: your files travel through our infrastructure to reach the recipient. Here is what that involves:

• Files transit and are temporarily stored encrypted on our infrastructure (currently Cloudflare for storage and delivery, Fly.io for processing) only as long as needed to complete the transfer.
• Scanning — transferred files may be automatically scanned for malware and unlawful content. Scan results are used to protect recipients and to enforce our Terms; they are not used for advertising or profiling.
• Deletion — transfers are permanently deleted on the retention schedule shown for your transfer or plan (and when they expire). After deletion they cannot be recovered by anyone, including us.
• Account and transfer metadata — to operate the service we process your subscription identity (email), transfer metadata (sizes, timestamps, delivery status), and recipient addresses you provide. We don't open, listen to, or analyze the content of your files beyond the automated scanning above.

Lawful basis (GDPR): performance of a contract (delivering your transfers) and legitimate interest (malware scanning, abuse prevention).

If you received a transfer: a sender gave us your email address so we could deliver it. We use that address only for the delivery itself and its retention notices — nothing else. To object, contact privacy@fluxcode.studio.

3. What the website collects

This website (crate.fluxcode.studio) uses some third-party analytics — which means cookies and similar identifiers. Specifically:

• Google Analytics 4 — aggregate traffic measurement (pages visited, referrers, approximate region). GA4 does not log or store IP addresses; we use it for aggregate traffic measurement, not to identify you. See Google's privacy policy.
• Meta (Facebook) Pixel — runs on our public site pages, including the download and thank-you pages (not on this page or the Terms page), to measure whether our ads lead to downloads and purchases. The Pixel sets cookies and shares page-visit events with Meta, which may combine them with your Meta account data. See Meta's privacy policy; you can limit ad tracking in your Meta ad preferences and via browser settings or blockers.
• Regional pricing (server-side geolocation) — to show the right regional price, the page asks our own server for a coarse country code, which our hosting platform derives from your request. No third-party geolocation service receives your IP address. We don't store the country code on our end; your browser keeps it for the current session only.
• Fonts — served from this site, not from Google. Loading a page does not request anything from Google Fonts, so no request carrying your IP address reaches Google for typography.

3a. Emailing yourself the download links

Crate is a desktop app and most people find this site on a phone. So on the download pages, phone visitors are offered one field: give us an email address and we send the download links, to open later at a computer. It is optional — the links are on the page either way — and it is the only place this website asks for an email address.

If you use it, we collect:

• Your email address, as you typed it.
• Whether you ticked the release-news box — a separate box, unchecked by default. We record the answer with the date and the exact wording you were shown, so what you agreed to stays provable.
• The language version of the page you asked from, so a later email can be in that language.
• A coarse country, derived from your connection at our server and then discarded — the IP address itself is never stored.

The email with the links is the thing you asked for, so we send it whether or not you ticked the box. Release news is sent only if you did. Lawful basis (GDPR): your own request (Art. 6(1)(b)) for the links; consent (Art. 6(1)(a)) for the news.

Where it goes: the address is stored in our own database, hosted by Neon in the United States, and the mail is sent through Resend, also in the United States. If you did not tick the box, it is not added to our mailing list at all — we keep the address as the record of what we sent you, send that one email, and nothing else. Ticking the box is what adds you to the Sendy list described in Section 4.

How long, and how to end it: we keep the address until you ask us to delete it, or until mail to it stops being deliverable. Every marketing email carries a one-click unsubscribe, which stops the news but leaves the record; to delete the record itself, email privacy@fluxcode.studio.

Deleting your email address does not switch off a licence you already have. A Crate licence is activated on your machine and keeps working offline — removing your address ends our ability to send you anything again: the download links, a replacement licence key, a transfer notice. If you later want your key re-sent, you would give us the address again.

4. Newsletter

If you voluntarily subscribe to our newsletter, we collect:

• Your name (optional)
• Your email address
• Your consent (date and record of opt-in)

We use Sendy (self-hosted email software) to manage our mailing list. Your data is stored on our own servers — not on a third-party SaaS platform. We never sell, rent, or share your email with anyone.

Every email includes a one-click unsubscribe link. You can also email us at any time to request deletion of your data. Our postal address for CAN-SPAM purposes: Fluxcode Studio LLC, Westerville, Ohio, USA (postal address available on request via legal@fluxcode.studio).

5. Purchases

License purchases are processed by Polar. Polar receives your email address and payment details (card number, billing address) to process the transaction. We do not store your credit card details. See Polar's terms for their data handling practices.

After purchase, your license key is delivered via email through Resend, a transactional email service. Resend receives only your email address for the purpose of delivering the license key. See Resend's privacy policy.

Our license-delivery webhook runs on Fly.io infrastructure. It processes order events (email, product ID) to mint and deliver your license. No payment card data reaches our servers.

Seat activation: when you activate a license on a device, the app contacts our license server once to register that seat. It sends your license identifier and the device's random install UUID — no file names, no audio, no hardware fingerprint. This is core licensing (separate from the optional analytics above) and is what lets you see and manage which devices use your license. Activation needs a brief internet connection; after that, Crate runs offline with a generous grace period.

6. Your rights (GDPR / CCPA)

You have the right to:

• Access — request a copy of any data we hold about you
• Rectify — correct inaccurate data
• Delete — request deletion of your data ("right to be forgotten")
• Portability — receive your data in a machine-readable format
• Withdraw consent — turn website analytics back off at any time (button below), and unsubscribe from emails at any time
• Object — opt out of any processing
• Restrict — request restriction of processing of your data (GDPR Art. 18)
• Complain — lodge a complaint with your local supervisory authority

To exercise any of these rights, email privacy@fluxcode.studio.

One honest limit on deletion. If you bought Crate, the purchase record itself sits with Polar, our merchant of record, who is required to keep it for tax and accounting reasons. We can delete what we hold and stop contacting you, and we will; the underlying sales record is Polar's to keep for as long as the law says. Deleting your address also does not switch off a licence already activated on your machine — see Section 3a.

Website analytics: if you previously accepted optional analytics, you can withdraw that consent right here — it takes effect immediately and re-shows the choice banner. Withdraw analytics consent

California residents: we believe Crate is below the CCPA's applicability thresholds; we extend these rights to you anyway — contact privacy@fluxcode.studio.

7. Data retention

Newsletter subscriber data is retained until you unsubscribe or request deletion. Purchase records are retained as required for accounting and tax compliance. Send transfers are deleted on the retention schedule for your transfer or plan (see Section 2); associated transfer metadata is kept only as long as needed for billing, abuse prevention, and legal compliance. App usage analytics are pseudonymous — keyed to a random install ID, with no name, email, or precise location — and are retained in aggregate; events tied to your install ID are deletable on request. Google Analytics 4 website data is retained for 14 months. Beta crash & error reports are deleted after 90 days. An address you gave us for the download links is kept until you ask us to delete it or mail to it stops being deliverable; a testimonial is kept until you ask us to remove it.

8. Where your data is processed (international transfers)

Wherever in the world you are, everything described in this policy is processed in the United States, because we and our processors are there: Neon (our database — analytics events, contacts, testimonials), Fly.io (our own services), Cloudflare (Send storage and delivery), Resend (email), Polar (payments), Google (website analytics) and Meta (advertising measurement). Our Sendy mailing list runs on our own server rather than a third-party platform.

Two things carry every one of those transfers: it is necessary to give you what you asked for — deliver your transfer, send your licence key, email you the download links — or you consented to it; and each processor is bound by a written data-processing agreement with standard contractual clauses and security commitments. We do not sell personal data, and we do not transfer it onward for anyone else's marketing.

If your country sets its own conditions for sending data abroad, these are the ones we rely on:

• EU / UK — the EU-US Data Privacy Framework where the processor is certified (Google, Meta, Cloudflare), and standard contractual clauses (with the UK addendum) otherwise.
• Kenya — Section 48 of the Data Protection Act 2019: the safeguards above, together with necessity for a contract or for steps you asked us to take, or your consent. You can complain to the Office of the Data Protection Commissioner.
• Nigeria — the NDPA 2023: the same contractual safeguards, plus necessity or consent. You can complain to the Nigeria Data Protection Commission.
• Brazil — the LGPD (Art. 33): contractual clauses, or your consent, or necessity to perform a contract. You can complain to the ANPD.
• India — the DPDP Act 2023: we process on your consent or for the purpose you gave the data for, and the transfer safeguards above apply.
• Anywhere else — the same safeguards apply. If you want to know exactly which mechanism covers you, email privacy@fluxcode.studio and we will tell you.

9. Legal disclosures

We may preserve or disclose content and metadata where we believe in good faith it is necessary to comply with law, a court order, or other legal process, and we report suspected child sexual abuse material to the National Center for Missing & Exploited Children (NCMEC) as required by law. To report abuse, contact abuse@fluxcode.studio.

10. Children

Crate is not directed at children, and we do not knowingly collect data from them. The age that makes someone a child differs by country — 16 in much of Europe, and 18 in India under the DPDP Act 2023, among others — so we apply whichever age your country sets. We do not run advertising or behavioural tracking aimed at children.

If you believe a child has given us data — an email address for the download links, a testimonial, anything else — email privacy@fluxcode.studio and we will delete it.

11. Changes

We may update this policy. Material changes will be noted on this page with an updated date. Continued use of the website after changes constitutes acceptance.

12. Contact

For privacy questions: privacy@fluxcode.studio. For legal notices: legal@fluxcode.studio.

Fluxcode Studio LLC, Westerville, Ohio, USA (postal address available on request via legal@fluxcode.studio).