Privacy Policy
This Privacy Policy explains what information Crave Lists, LLC collects when you use Crave, how we use it, and what choices you have.
1. Information We Collect
Information You Provide
- Email address — used for account authentication and transactional emails
- Password — stored as a one-way hash by our authentication provider; we never store your password in plain text
- Username — your chosen display name (3–30 characters), along with the timestamp of your most recent username change
Information Generated by Your Activity
- Personal rankings — the items you rank and the order you rank them on each list
- Saved lists — the lists you choose to save to your profile
- Session activity — items confirmed as seen during a browsing session
- Ranking event log — an append-only record of every ranking action you take, with timestamps
Information Collected Automatically
- Browser type and device information
- IP address and general location (city/region level)
- Pages visited and interactions within the Service
- Cookie and tracking data (see Section 5)
2. How We Use Your Information
- Create and maintain your account
- Operate the ranking platform and generate public ranking scores
- Send transactional emails such as group invitations (we do not send marketing emails)
- Detect and prevent fraud, abuse, and ranking manipulation
- Analyze usage patterns to improve the Service
- Comply with legal obligations
3. How We Share Your Information
We do not sell your personal information. We share data only with trusted service providers:
| Service | Purpose | Data Shared |
|---|---|---|
| Supabase | Database hosting and authentication | All account and activity data |
| Resend | Transactional email delivery | Your email address, when sending emails |
| Google Fonts | Typography rendering | IP address and browser info when fonts load |
We may also disclose your information if required by law, court order, or to protect our rights or user safety.
4. Cookies and Tracking
Essential Cookies
Supabase authentication cookies are required to keep you logged in. They cannot be disabled without signing you out.
Third-Party Font Requests
When pages load, your browser contacts Google’s servers to download fonts. Your IP address is temporarily logged by Google per their own policies.
5. Data Retention
- Account data — retained while your account is active; deleted when you delete your account
- Ranking event log — retained indefinitely for ranking integrity; personal identifiers anonymized upon account deletion
- Username change timestamp — retained for the life of your account to enforce the change cooldown; removed upon account deletion
6. Your Rights and Choices
- Access — request a copy of the personal data we hold about you
- Correction — update your email or username through account settings
- Deletion — delete your account at any time
California Residents (CCPA)
California residents have the right to know what data we collect, the right to delete their personal information, and the right to non-discrimination for exercising these rights. We do not sell personal information.
7. Children’s Privacy
Crave is not directed to children under 13, and we do not knowingly collect personal information from anyone under 13. If you believe we have inadvertently collected such information, contact us immediately at Legal@Crave.llc.
8. Data Security
We use industry-standard security measures, including password hashing by our authentication provider and HTTPS in transit. However, no method of internet transmission is 100% secure.
9. Changes to This Policy
We may update this Privacy Policy from time to time and will update the date at the top. Your continued use of the Service after any change constitutes your acceptance of the updated policy.
10. Contact
This product includes GeoLite2 Data created by MaxMind, available from https://www.maxmind.com.