Privacy Policy

Last updated: 19 September 2026

This policy explains what personal data Craft.cool collects, why, how long we keep it and what you can do about it. Craft.cool is run by Kanhaiya, Uttar Pradesh, India ("we", "us"). If anything here is unclear, write to privacy@craft.cool.

The short version

We collect what we need to run your account, the marketplace and server listings, and to keep the site safe.
We do not sell your personal data, and we do not show ads.
Our own statistics do not use tracking cookies. Visitors are counted with a code that changes every day.
Accounts for people aged 13 to 17 need a parent or guardian's agreement, and never get a personalised feed.
You can see, correct, download or delete your data. Write to privacy@craft.cool.

What we collect

When you create an account

Username, display name, email address and a hashed password (we never store your password itself).
Your age group (under 18 or 18 and over) and, if you are under 18, the confirmation that a parent or guardian agreed.
If you sign in with Google or Discord: the account ID, name, email and avatar those services share with us. We never receive your Google or Discord password.
Optional profile details you add yourself: bio, avatar, banner, links, country, timezone and currency.

When you use the site

What you publish: items, descriptions, images, files, releases, server listings, reviews, replies and support messages.
What you do with other people's work: hearts, diamonds, follows, downloads and purchases.
Visit statistics: page, time, referring site, country, device type and browser, linked to a visitor code that is rebuilt every day. If you are signed in, the visit is also linked to your account so you can see your own activity.
Security data: sign-in times, a hashed form of your IP address in our audit log, and your session (IP address and browser) while you are signed in.

When you buy or sell

Order details: what you bought, price, currency, time and the order number.
Payment details you give us: for UPI, the transaction reference (UTR) and the screenshot you upload as proof; for PayPal, the transaction ID and payer email PayPal sends us. We never see or store card numbers or your UPI PIN.
For creators who get paid: the payout details you enter (for example UPI ID or PayPal email), earnings and withdrawals.

Why we use it

To provide the service you asked for: your account, publishing, downloads, purchases, payouts and support. (Legal basis in India: your consent and the use needed to provide what you asked for.)
To keep the platform safe: preventing spam, fraud and abuse, reviewing reports and enforcing our rules.
To show relevant content to members aged 18 and over (the "For you" feed uses what you hearted, followed and viewed). Members under 18 get the same feed as everyone else, never a personalised one.
To meet legal duties: tax and accounting records for sales, responding to lawful requests, and handling copyright notices.
To tell you what matters: account and security emails, order and sale emails, and notifications you can switch off in Settings.

Children and teenagers

You must be at least 13 to create an account. Anyone can browse without one.
If you are 13 to 17, a parent or guardian must agree to you creating an account and to this policy. We ask for this when you sign up.
For members under 18 we do not build a personalised feed, do not use behavioural tracking and do not allow any advertising aimed at them.
If we learn that someone under 13 has an account, or that a parent did not agree, we will delete the account. Parents can write to privacy@craft.cool to see or delete their child's data.

Who we share data with

Only with the services needed to run Craft.cool, and only what each one needs:

Hosting and email: our web host stores the site and database; our email provider sends account and order emails.
Payments: PayPal processes PayPal payments under its own privacy policy. UPI payments go directly from you to the payee; we only receive the reference and proof you give us.
Sign-in: Google or Discord, only if you choose to sign in with them.
Server status: server addresses (not personal data) are checked through public status services.
Creators you buy from see your username, the item and the amount of each sale. They do not see your email or payment details.
Authorities, when Indian law requires it, and people with a valid court order.

Some of these services are outside India. We only use providers that protect data to a comparable standard.

How long we keep it

Account data: while your account exists. When you delete your account we remove your profile and personal details within 30 days.
Orders, payments and payouts: kept for as long as tax and accounting law requires (in India generally up to 8 years), even after an account is deleted, but without any more personal detail than needed.
Visit statistics: up to 400 days, then deleted.
Security logs: at least one year, as required by the DPDP Rules.
Copyright notices and moderation decisions: as long as needed to handle disputes and repeat infringement.

Your rights

Under India's Digital Personal Data Protection Act, 2023 and wherever else the law gives you these rights, you can:

ask what personal data we hold about you and how we use it;
correct or complete it (most of it you can change yourself in Settings);
ask us to delete it, or delete your account yourself;
withdraw consent you gave, which stops future use (it does not undo what was already done lawfully);
nominate someone to act for you if you die or cannot act;
complain to us, and if you are not satisfied, to the Data Protection Board of India.

Write to privacy@craft.cool. We reply within 30 days. Our Grievance Officer is Kanhaiya.

Security

Passwords are hashed, the site runs over HTTPS, two-factor sign-in is available (and required for staff), paid files are only served through links that expire, and access to personal data inside Craft.cool is limited to staff who need it. If a breach affects your personal data we will tell you and the Data Protection Board of India as the law requires.

Changes

If we change this policy in a way that matters, we will tell you by email or on the site before the change applies. The date at the top always shows the current version.