Skip to content
99devIndependent app developer
← CraftSpot

Privacy Policy — CraftSpot

Version 2.0, effective from 16 November 2026 · Previous versions

Changes in this version: Document moved to 9dev.pl, new contact addresses (@9dev.pl), the publisher's postal address and working links between documents. First English version (translation of the Polish text).

This Privacy Policy explains how we process personal data when you use the CraftSpot mobile application (the “App”).

1. Controller and contact details

The controller of personal data processed in connection with CraftSpot is:

For privacy matters, use the subject “CraftSpot — privacy request”. Do not send passwords, payment card details, identity documents or other unnecessary sensitive data by email. We may ask for limited additional information where reasonably necessary to check that a request concerns your account.

2. What CraftSpot is

CraftSpot is a visual catalogue where you can discover handmade goods and where makers can publish profiles and listings. Users contact makers by email, and any purchase, delivery, payment or other arrangement takes place outside the App. CraftSpot does not process payments for handmade goods and is not a party to such arrangements.

CraftSpot also offers an optional Pro subscription purchased through the Apple App Store or Google Play and handled technically by RevenueCat.

3. What personal data we process

The data depends on how you use the App.

3.1. Account and authentication

  • a randomly generated Supabase user identifier, also for guest accounts;
  • whether the account is a guest or registered account, and authentication session information;
  • your email address, if you convert a guest account into a registered account or sign in to an existing account;
  • authentication and security data, such as sign-in events and session tokens.

Authentication is provided by Supabase Auth. CraftSpot does not store a readable password in its application database.

3.2. Maker profile data

If you create a maker profile, we process the information you provide, including:

  • display name, bio, avatar, social media link and other external links;
  • contact email address;
  • city, region, country, street address and geographic coordinates, if you provide them;
  • maker verification, moderation, warning and Pro subscription status.

The following may be publicly visible: display name, bio, avatar, city, region, country, social and external links, and an approximate position on the map. The street address and the exact stored coordinates are not part of the public projection of the maker profile. The public map uses coordinates with reduced precision. We reveal the contact email address only when a signed-in user deliberately chooses to contact the maker; such access is logged for security and abuse prevention. Provide only a business or contact address that you are comfortable using for this purpose.

3.3. Listings and other user content

We process the content you upload, including:

  • photos, title, description, category, search terms, price text, currency and shipping information;
  • whether AI assistance was used;
  • publication and moderation status, timestamps, reports and related moderation data;
  • copies of content and moderator notes, where reasonably necessary to investigate safety, fraud, illegality or a breach of the Terms.

Published profiles and listings are meant to be displayed publicly. Do not put private contact, financial, identification, health or other sensitive data in public fields or photos.

3.4. AI generation and content moderation

CraftSpot uses Google Gemini through a Supabase Edge Function on the server:

  • Optional listing assistant: when you choose this feature, the selected photo and the requested response language are sent to Gemini to suggest listing content.
  • Mandatory safety moderation: before publication, the photos and the listing text are sent to Gemini to detect prohibited or dangerous content. The listing may be published, sent for human review or blocked.

Before data is sent for each of these purposes for the first time, the App names Google LLC as the recipient, explains the scope of the data and asks for your explicit consent. Consents for optional generation and mandatory moderation are stored separately on the device. You can refuse; in that case the data is not sent for that action. Publication is not possible without safety moderation.

AI output may be wrong. Content created with AI assistance is marked in the App, and you are responsible for checking it before publication. A moderation decision may be reviewed by a human. To challenge it, write to dsa@9dev.pl with the listing identifier and an explanation. Do not attach the image if it is illegal or particularly sensitive — give only the listing identifier.

Google processes the content it receives under the terms that apply to the Gemini API. Google may store limited data for safety and abuse monitoring as described in its documentation. Do not use the AI assistant for confidential or sensitive data or for personal data of third parties.

3.5. Location data

With the permission you grant in your device’s system settings, the App reads the device’s current location to centre the “Nearby” map and calculate nearby results. The device location serves this feature and is not saved in your CraftSpot profile, unless you separately enter and save a maker location.

If you save a maker address, the App converts it into coordinates and stores the address and coordinates in the profile. Public users receive only the public location fields and the reduced-precision coordinates described above.

You can refuse or withdraw location access in iOS or Android settings. The map remains available with a default location, but nearby results may be less accurate.

3.6. Photos and camera

If you add an avatar or a listing photo, the App accesses only the photos you select with the system picker. If you choose the camera, the App uses it to take the requested photo. Uploaded files are stored in Supabase Storage buckets belonging to CraftSpot. Published avatars and listing photos are meant to be displayed publicly and are served through public media addresses. Permissions to upload, replace and delete files are limited to the account owner and trusted server functions.

3.7. Contact and interactions

When you request a maker’s contact address or use the contact feature, we may record your account identifier, the maker identifier and the time of access. The email is sent through the mail app you choose; you decide its content and it is processed by the relevant mail providers. CraftSpot does not receive the content just because it opened a draft message.

3.8. Usage, diagnostic and security data

We process limited first-party data about usage and technical operation, including:

  • feature events and listing interaction counters;
  • App version, platform/operating system, timestamps and technical context;
  • error messages and stack traces, which may contain the account identifier or limited data present in the error;
  • reports, blocks, AI limits, abuse prevention counters and security logs.

This data is used to operate, protect, diagnose and improve CraftSpot. The App contains no advertising SDKs and does not use this data for advertising or cross-app tracking.

3.9. Subscriptions and purchases

For the Pro subscription, payment data is processed by Apple or Google. CraftSpot and RevenueCat receive purchase and entitlement data, such as:

  • the CraftSpot user identifier used as the RevenueCat App User ID;
  • store, product, transaction, subscription, entitlement, renewal, expiry and cancellation status;
  • the registered email address, when needed to link a purchase to the right account.

CraftSpot does not receive the full payment card number.

3.10. Support correspondence

When you contact us, we process your email address, your message, any attachments you choose and the information needed to investigate and respond.

3.11. Data stored on the device

The App stores session data and preferences locally, including language and theme, the version of accepted documents, separate versions of consents for sending data to Gemini, listing drafts, selected AI languages, a limited cache of the feed and profiles, and rating prompt counters. This data usually stays on the device until it is replaced, until you clear the App data in settings or until you uninstall the App.

Where EU/EEA or UK law applies, we rely on the following legal bases:

Purpose Main data Legal basis
Creating and maintaining a guest or registered account; providing profiles, listings, contact and subscription entitlements Account, profile, content, contact and subscription data Performance of a contract or steps taken at your request before entering into it — Art. 6(1)(b) GDPR
Moderating content, investigating reports, preventing fraud and abuse, securing the service and enforcing the Terms Content, reports, blocks, logs, identifiers and moderation data Legitimate interest in providing a safe and trustworthy service — Art. 6(1)(f) GDPR; legal obligation where applicable — Art. 6(1)(c) GDPR
Providing optional device features and optional AI assistance Selected photo, device location and requested language Performance of the requested service — Art. 6(1)(b) GDPR; device access is additionally controlled by system permissions
Diagnosing faults, measuring feature performance and improving the App Limited usage, diagnostic and statistical data Legitimate interest in product reliability and development — Art. 6(1)(f) GDPR
Handling support, privacy requests, disputes and claims Correspondence, account and relevant service data Performance of the service, legal obligation and legitimate interest — Art. 6(1)(b), (c) and (f) GDPR
Meeting tax, accounting, regulatory or law enforcement obligations Required transaction, account or correspondence data Legal obligation — Art. 6(1)(c) GDPR

Where we ask for consent, you can withdraw it at any time without affecting the lawfulness of earlier processing. You can object to processing based on legitimate interest as described below. Publication cannot be completed if the mandatory safety moderation cannot be carried out.

5. Who we disclose data to

We disclose only the data reasonably necessary for the relevant purpose:

  • Supabase, Inc. — database, authentication, file storage, server functions and infrastructure;
  • Google LLC (Gemini API) — optional listing generation and mandatory listing moderation;
  • RevenueCat, Inc. — managing subscription entitlements and the purchase lifecycle;
  • Apple Inc. / Google LLC — distribution, in-app subscription purchases, billing, refunds and store account management;
  • OpenStreetMap tile infrastructure and its contributors — displaying maps; the service may receive ordinary network data such as IP address, user agent, requested tile and time;
  • Google Fonts infrastructure — delivering fonts when they are not yet cached or bundled with the App; the service may receive ordinary network request data;
  • other users — public profile data and listings and, after a deliberate contact request, the maker’s email address;
  • the email or external link provider you choose — only when you decide to open or use it;
  • professional advisers, courts, regulators or other authorities — where reasonably necessary to establish or defend claims or to comply with the law.

We do not sell personal data. We do not disclose it to data brokers or use it for behavioural advertising.

6. International transfers

Service providers may process data outside Poland, the European Economic Area or your country. Where required, transfers are protected by an adequacy decision, the European Commission’s standard contractual clauses, the provider’s data processing agreement or another lawful mechanism. You can ask for information about the safeguards used.

7. Retention

We keep data only as long as reasonably needed for the purposes described:

Data Typical retention
Account, profile, listings, media, preferences and product events While the account is active; deleted with the account, subject to the limited exceptions below
Contact access, limit and listing statistics data As long as needed for operation and abuse prevention; account-linked data is deleted with the account
Central technical error logs Up to 30 days, also capped by the number of the most recent records in the database
Reports and security and moderation data For the time of the investigation and as long as needed to enforce the Terms, protect users, meet legal obligations or establish or defend claims; the direct link to the account is removed when the account is deleted, where the system allows it
Support correspondence and rights requests For the time needed to handle the matter and keep appropriate proof of the reply, then for the relevant limitation or legal compliance period
Apple, Google and RevenueCat transaction and subscription data As required by Apple, Google, RevenueCat and accounting, fraud and retention laws; deleting the account does not cancel a subscription
Local preferences, cache, Gemini consents and drafts Until replaced, until you clear the App data in device settings or until you uninstall the App

Backups and distributed caches may expire for a limited time after deletion; deleted data is not restored to active use. We may keep strictly limited information if required by law, an unresolved dispute or a security investigation, or to prevent repeated serious abuse. Where possible, we delete, anonymise or detach such data from the active account.

8. Security

We use access control, database row-level security (RLS), controlled Storage rules, authenticated server functions, restricted public database projections, encryption in transit and request limits. No system guarantees complete security. Protect your device and account, use a unique password and tell us if you suspect unauthorised access.

9. Your choices and rights

Depending on the applicable law, you may have the right to:

  • access your data and information about its processing;
  • correct inaccurate or incomplete data;
  • delete your data or account;
  • restrict processing;
  • receive the data you provided in a portable format;
  • object to processing based on legitimate interest, including product analytics;
  • withdraw consent where it is the basis for processing;
  • request human review of, and present your view on, a moderation decision that significantly affects you;
  • lodge a complaint with a supervisory authority.

You can edit much of your profile data in the App. You can delete your account through Profile → Delete account. Full instructions are in Account and data deletion. To withdraw a local Gemini consent, clear the App data or contact us; once the record is removed, the App will ask for consent again before sending data. For other matters, write to the address in section 1. Where the GDPR applies, we generally respond within one month, with the possibility of a lawful extension and after verifying your identity.

In Poland, you can lodge a complaint with the President of the Personal Data Protection Office (UODO): uodo.gov.pl.

10. Children

CraftSpot is intended only for people who are at least 18 years old. We do not knowingly offer the App to children or knowingly collect their personal data. If you believe that a person under 18 has provided data, contact us so that we can investigate and, where appropriate, delete it.

11. Automated moderation

Automated tools help classify uploaded content as allowed, requiring review or blocked. The result may affect whether a listing is published. The main factors are the uploaded text and images and their possible conflict with the rules on prohibited content. Because the system can make mistakes, you can request human review at dsa@9dev.pl. CraftSpot does not make decisions about credit, employment, insurance or a similarly significant service.

External websites, social networks, mail apps, Apple, Google and transactions arranged with another user are governed by their own terms and privacy policies. CraftSpot is not responsible for their independent processing. Read their documents before you share information.

Provider information:

13. Changes to this Policy

We may update this Policy when the App, the law or our providers change. We will change the date above and, where required, show a clear notice in the App or ask for renewed acceptance before the change takes effect. Earlier processing is governed by the version in force at the time.

14. Contact

You can send privacy questions, requests and complaints to:

  • Publisher: Mariusz Uziębło
  • Postal address: (postal address being added)
  • Email: privacy@9dev.pl