Privacy
Last updated 5 October 2026.
Crato is operated by SonetCraft LLC. "We" below means SonetCraft LLC.
Crato lets creators sell things and lets buyers keep what they bought. That needs some information about both. This page says what we hold, why we hold it, and what we do not do with it. If anything here is unclear, ask us and we will answer plainly.
What we hold about creators
Your email address, the name and photo and description you put on your store, and the things you list for sale. If you connect Stripe, we keep the identifier of your Stripe account so we can send buyers to it, we never see or store your bank details, and money from a sale never passes through us. It goes directly to your own Stripe account.
What we hold about buyers
The email address used at checkout, what was bought, and progress through a course if the thing bought was one. Card details are handled entirely by Stripe and never reach us.
Connecting a Google account
Connecting Google is optional and only exists so people can book calls with you. We ask for exactly two permissions:
- See your availability. This tells us the times you are already busy. It does not tell us what those appointments are, who they are with, or anything written in them. We use it for one thing: not offering a time you are unavailable.
- Make a calendar and manage events on it. We create one calendar inside your Google account, named after your store, and write bookings there. We cannot read or change anything on your other calendars.
Crato's use of information received from Google APIs follows the Google API Services User Data Policy, including its Limited Use requirements. We do not use Google data for advertising, we do not sell it, we do not let humans read it except where you have asked us to fix something or the law requires it, and we do not use it to train any model.
Disconnecting is one tap in your dashboard. It revokes our access at Google and deletes the tokens we held. The access tokens themselves are encrypted before they are stored.
We send receipts, delivery links, sign-in codes and sale notifications, because each one answers something you or a buyer just did. Creators can also email people who have bought from them. Nobody can be added to a list by hand, buying is the only way onto one, and every announcement carries a one-tap unsubscribe that applies across every creator on Crato, permanently.
Notifications on your phone
A creator can add Crato to their home screen and ask to be told when something happens, a sale, a question, a booking. Turning that on registers the device with whoever made the browser: Google for Chrome and most Android phones, Apple for Safari, Mozilla for Firefox. We cannot avoid that; it is how notifications work on the web, and there is no version of this that does not involve them.
What we keep is what is needed to reach that one device: the address the push service gave us, two keys the message is encrypted with, and the browser it was set up in so two devices can be told apart. The message itself is encrypted before it leaves us and can only be read by the device it was addressed to, the push service passes it along without being able to read a word of it, and neither can we once it has gone.
We deliberately keep notifications thin for the same reason: they appear on a locked screen, in front of whoever is in the room. No amounts, no buyer names.
Switch it off on the Notifications screen and the registration is deleted. It is also deleted if the push service tells us the device is gone, or if the account is closed. Nothing else about the phone is stored, and none of this happens unless it is switched on.
What your browser keeps
Installed on a home screen, Crato stores a copy of its own code so it opens quickly and can say something useful with no connection. It stores no pages: not a dashboard, not a store, not a checkout, because a stored page is one person’s information waiting for the next person on a shared phone.
A few small conveniences live in the browser and never reach us: a half-written item so it survives leaving the screen, and whether an offer to install was dismissed. Clearing your browser data removes them.
Counting visits
So creators can see how their store is doing, we count visits to it. We count visits to our own pages the same way, so we can tell whether anybody is finding Crato.
For this counting we do not use cookies and we do not store IP addresses. A visitor is identified by a code derived from their network and browser combined with a secret that changes daily, which means the same person cannot be recognised tomorrow and the code cannot be turned back into who they are. Nothing is kept on your device, nothing is shared with anybody else, and the two counts are kept apart, a creator never sees ours and we never add ours to theirs.
Measuring our own marketing
On our own pages, which means this site rather than any creator’s store, we also want to know whether the people who find us end up with a store. Counting visits cannot answer that, because the code above deliberately forgets you overnight.
So on our own pages we store one cookie containing a random number that your browser generates about itself, and, if you arrived from a link we shared, the name of where that link was posted. That is the whole of it: no name, no email address, no IP address, and nothing that identifies you. We use it to count how many people who arrived from a particular post went on to create a store. Clearing your cookies ends it, and adding ?notrack=1 to any address on this site stops it entirely for your browser.
None of this runs on a creator’s store, and none of it runs once you are signed in to a dashboard.
Session recording on our own pages
We use Microsoft Clarity on our own marketing pages to see where people get stuck, for example a button nobody presses or a form people give up on. It records how a page was used rather than who used it, and anything typed into a form is hidden from the recording.
It is not loaded at all for visitors in the EU, the EEA, the UK or Switzerland. We chose to leave those visitors out rather than put a consent banner in front of everybody. It never runs on a creator’s store and never on a signed-in dashboard.
Who else is involved
We use Supabase for the database and sign-in, Vercel for hosting, Cloudflare for file storage, Stripe for payments, Postmark for email, Microsoft Clarity for the session recording described above, and Google for calendars where a creator has connected one.
Stripe decides which currency to show you. Prices are set in US dollars and Stripe's checkout may present and charge them in your local currency instead. To work out which, Stripe uses where your payment appears to be coming from. We neither make that decision nor receive your location from it: what reaches us is the sale in US dollars, with the local figure attached to it for your receipt.
Printful prints and posts anything physical, and they receive the name and delivery address of whoever bought it, because a parcel cannot be sent without them. This happens only for merch and only once an order is paid for.
Google, Apple and Mozilla carry notifications to a device that has asked for them, as described above. They receive the address of that device and a message they cannot read.
Each holds only what its job needs. We name them because you are entitled to know where your information actually sits, and because a vague answer here is usually hiding something.
Deleting things
If you are a creator: deleting an item nobody has removes it completely, the files from storage, and the lessons, quizzes, add-ons, questions and bookings from our database. None of it can be recovered by anyone, including us. Once somebody has bought or taken it, it cannot be deleted from your dashboard at all: it is removed from your store instead, and everyone who has it keeps it. We tell you how many before you confirm.
If you are a buyer: what you bought stays in your Library, with no expiry from us. A creator can stop selling it, and it then disappears from their store while staying in yours. They can also change what is in it, and you see the current version. Download anything you would be sorry to lose.
You can close your account yourself, without asking us, creators under Profile, buyers under Settings. It takes a code to the address on the account, then it removes your sign-in, your name and your profile, and takes your store down.
Two things stay, and it is worth being exact about them. Records of completed sales are kept without your name on them, because they are financial records with tax consequences for the creator and proof of purchase for the buyer — the law that gives you the right to be forgotten is the same law that makes this the exception. And a creator’s items stay, because they are other people’s purchases; if you want them gone, delete them before you close the account and each one will tell you how many people lose access first.
Closing is blocked while money is still moving — a refund being decided, a parcel not yet delivered, instalments still being paid, or somebody still subscribed. Each of those has a second person on the other side of it, and the screen names which one is holding it up.
Asking us
Write to privacy@crato.store to see what we hold about you, correct it, or have it deleted. Anything else reaches us at support@crato.store. Crato is operated by SonetCraft LLC.