Privacy Policy

The short version

We store what you put in your kit and what we need to bill you. Your published kit is a public page; your private uploads stay private. We run light, first-party analytics on kit visits that respect Do Not Track and never identify who visited. No ad networks, no cross-site tracking, no selling data. If you want your data exported or deleted, you can do both.

What we collect from you

If you’re a creator with an account, we store: your email and display name; everything you put in your kit (photos, video links, follower counts, rates, brand names, and any contact details you choose to display); documents you upload to your private storage area, like old rate cards — these are never shown publicly; and a Stripe customer reference so billing works. Card numbers never touch our servers — Stripe handles all payment data.

Remember that a published kit is a public web page. Whatever you choose to put on it is visible to anyone with the link, by design.

What your kit's visitors share

When someone visits a published kit, a first-party beacon records: approximate location (city, region, and country derived from the request — not precise location), device class (phone or laptop), the referring site, how far down the page they read, video play counts, and time on page. The beacon honors Do Not Track.

A random identifier is kept in the visitor’s browser localStorage so we can recognize a return visit on that device. It isn’t a fingerprint and isn’t shared across sites. If the creator made a named link (?to=brandname), that label — written by the creator, not the visitor — is attached to the visit.

We never claim to identify which person or company visited a kit, because we can’t and we don’t try.

What we never do

• No ad networks.
• No cross-site tracking.
• No third-party analytics cookies.
• No selling or renting your data, or your visitors’ data, to anyone.
• No identifying kit visitors as specific people or companies.

Services we rely on

We’re a small studio, so we build on a few well-known providers: Cloudflare hosts the site, Supabase provides our database, authentication, and file storage, Stripe handles payments, and Google powers the optional Google sign-in. Your data passes through these services as needed to run Creda, under their own security practices.

Your choices

You can export your data and delete individual kits from Settings. Unpublishing a kit removes it from public view immediately. To delete your account entirely, email whoisanmolsubediii@gmail.com and we’ll take care of it.

The weekly email digest is opt-in and off by default — you’ll only get it if you turn it on, and you can turn it off anytime.

Children

Creda is not directed at children under 13, and we don’t knowingly collect data from them. If you believe a child under 13 has created an account, email us and we’ll remove it.

Changes to this policy

If this policy changes, we’ll update the date at the top of this page. We’ll aim to make meaningful changes obvious, not buried.

Contact

Privacy questions or requests: whoisanmolsubediii@gmail.com, or @creda.studio on Instagram.