Privacy Policy

Last updated: September 4, 2026

This Privacy Policy explains how CraftyWand ("we," "us" or "our") collects, uses, shares and protects personal information when you use craftywand.com and the CraftyWand Service. It also explains how private projects and uploads are associated with the account that owns them.

1. Information you provide

• Account information: email address, display name, verification data and authentication credentials or tokens needed to create and secure your account.
• Project content: designs, layouts, artwork, text, images, project names, settings and other files you choose to create, upload or save.
• Billing information: plan, subscription and transaction status. Stripe processes payment-card details; CraftyWand does not store full payment-card numbers.
• Communications: messages, support requests, feedback and information you provide when contacting us.

2. Information collected through use

We may collect browser and device type, operating system, page and feature interactions, request timing, referring pages, campaign parameters, approximate country, region and city, error information, session activity and security events. Product events may be associated with an account after sign-in so we can understand feature use, identify inactive accounts and troubleshoot reported problems. Advertising click identifiers are reduced to a one-way hash for campaign attribution; the product analytics store does not retain raw IP addresses. We do not use this measurement system to record keystrokes or replay the contents of private designs. We also use cookies and similar browser storage for verified sessions, preferences and essential Service operation.

3. How we use information

We use information to create and authenticate accounts; keep sessions secure; show the correct plan and entitlement; save, reopen and render owner-scoped projects; process uploads and exports; operate billing; send verification and service messages; answer support requests; diagnose failures; understand adoption and account activity; prevent abuse; enforce account boundaries and content policies; and improve the Service.

4. Account-specific project and upload isolation

Private cloud projects and uploads are stored under identifiers associated with the verified account owner. Ownership is determined on the server from the authenticated session, not from a user ID supplied by the browser. When an account requests a private resource, the Service checks that the authenticated account owns it before returning data.

If a user attempts to access another user's private resource, the Service is designed to deny the request, avoid loading the resource, return a warning or access error, and record the event for security review. Public templates and public model assets are separate from private customer content.

Authorized personnel may use a separate internal operations system to locate an account or project and inspect private project content only when reasonably necessary for support, security, policy enforcement, legal compliance or protection of the Service. Cross-account project access requires a stated reason and is recorded in an access audit. Internal access does not allow other customers to access your content.

5. Uploaded images and metadata

When supported images are uploaded for cloud storage, the Service processes them to remove embedded metadata before storing the sanitized result. This reduces unintended disclosure of location, camera and author information. The visible image content remains part of Your Content and is available only through the project and account rules that apply to it.

6. Cookies and session tokens

Essential cookies and session tokens keep you signed in, associate requests with the verified account and help prevent unauthorized access. Session identifiers should not be shared. Blocking or clearing essential cookies may sign you out or prevent account features from working. We may also use optional advertising-measurement tags to understand campaign results. Those optional tags remain off unless you allow measurement, and you may change that choice by clearing or updating the stored preference.

7. How we share information

We do not sell personal information or private project content. We disclose information only as needed to operate the Service, including to cloud hosting and content-delivery providers, Stripe for billing, email providers for verification and service messages, professional advisers, and security or analytics providers acting under appropriate restrictions. We may also disclose information where required by law, to protect rights or safety, or as part of a legitimate business transaction subject to appropriate confidentiality and notice requirements.

8. Legal bases and choices

Depending on where you live, we process information to perform our contract with you, pursue legitimate interests such as security and Service improvement, comply with legal obligations, or act with your consent. Where processing depends on consent, you may withdraw it for future processing. Some account data remains necessary to provide the Service.

9. Data retention

We retain account and project data while the account is active and as reasonably necessary to provide the Service, meet legal and accounting obligations, resolve disputes and protect the Service. Verification codes and temporary security data expire on shorter schedules. Security logs, product events and internal access-audit records may be retained for a reasonable business, support or investigation period. Deleted data may remain in restricted backups until the backup cycle completes.

10. Security

We use reasonable technical and organizational safeguards, including encrypted transport, session verification, server-side ownership checks, restricted storage paths, access logging and credential protections. No internet service can guarantee absolute security. If you believe your account or content has been exposed, contact [email protected] immediately.

11. Your privacy rights

Depending on applicable law, you may request access, correction, deletion, portability or a copy of personal information, and may object to or restrict certain processing. You may also withdraw consent or complain to a data-protection authority. Send a request from the email associated with your account to [email protected]. We may verify identity before acting and will respond within the time required by law.

12. International processing

Service providers may process information in countries different from yours. Where required, we use contractual and other safeguards intended to protect personal information during international transfers.

13. Children

The Service is not directed to children under 18 or under the age of legal majority where they live. We do not knowingly collect personal information from children. Contact us if you believe a child has provided information so we can investigate and delete it where required.

14. AI-assisted features

The CraftyWand AI assistant is not fully released. If an AI feature later processes prompts, reference images or generated layouts, the interface and this Policy will describe the data used, its purpose and any relevant choices. Private customer content is not presented as public gallery content merely because it was used in a project.

15. Changes and contact

We may update this Policy when the Service, providers or legal requirements change. We will change the date above and provide additional notice for material changes where required.

For privacy questions or requests, contact [email protected].