Privacy policy

Last updated: 2026-10-13

A translation of the German Datenschutzerklärung, which is the binding version.

1. Controller

Controller within the meaning of the General Data Protection Regulation (GDPR):

Email: yaroslavnashyvan@gmail.com
Phone: +491627491111

2. Overview

Crate is an application for uploading, organizing, and sharing photos and videos. It is in a closed beta and under active development. We process personal data only as far as running Crate and your use of it require. There is no advertising, no tracking, no analytics or marketing cookies, no third-party services embedded in the pages, and your content is not used to train artificial intelligence.

3. Hosting and server

Crate runs on a server of Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany, in its Nuremberg data center (Germany). Hetzner processes the data on our behalf (Art. 28 GDPR).

When you open a page, the server necessarily processes your IP address and the requested address. We keep no access logs with IP addresses. To prevent abuse, IP addresses visiting public shares are counted briefly in memory only (limits on page views, password attempts, and removal requests; one hour at most) and are not stored. The application's error logs contain no IP addresses, passwords, access keys, share link addresses, or location data. The legal basis is our legitimate interest in secure operation (Art. 6(1)(f) GDPR).

4. Your account and sign-in

You sign in to Crate with your account at our own sign-in service, the SSO. It stores your email address, your name (if you give one), your sign-in methods (a passcode only as a secure hash; the ID of a Google account if you link one), your sessions with IP address and browser identification (user agent; 30 days or until you sign out), a log of sign-ins (time, IP address, browser, success), and when you signed in to Crate. One-time sign-in codes are sent by email (see section 9). If you choose "Continue with Google", Google learns that you sign in with us and tells us your email address.

When you sign in, the sign-in service gives Crate your email address, whether it is verified, and your name. For your Crate account we process these, a link to your sign-in account, your time zone, and your settings. A Crate session is a signed cookie on your device; Crate stores no IP address or browser identification for it. Sessions and passwords (as secure hashes) from Crate's earlier sign-in are kept until that data is deleted, at the latest with your account. During the private beta, members can invite people by email: we store the invited address, who invited it, and when it was used, until the invitation is withdrawn or the inviting account is deleted. The legal basis is the performance of the contract of use (Art. 6(1)(b) GDPR); for invitations, our legitimate interest in a closed beta (Art. 6(1)(f) GDPR). Crate keeps your data until you delete your Crate account; the sign-in account until you ask us to delete it.

5. Your photos, videos, and information

We process the files you upload including their metadata (such as the capture time, the camera, and — if present — the location), the previews and web copies made from them, and what you add in Crate: albums, names of people and animals, tags, titles, descriptions, and imports. Crate uses this data only to provide its features to you (display, search, editing, sharing, backups). There is no automatic face recognition. The legal basis is Art. 6(1)(b) GDPR.

The originals and most generated files are kept in the storage you connect in the settings (Hetzner Object Storage or Storage Box). You rent this storage from Hetzner yourself; Crate writes and reads there on your instructions. The database and small thumbnails for the overview are kept on our server.

If your photos show other people or you name people, please make sure you are allowed to — especially before you share content.

Deleted items stay in the Trash for 30 days. When you delete your account, we remove your data and your files, including those in your connected storage. Database backups are kept for 14 days at most. The backup in the settings lets you download all your data as a ZIP file at any time.

6. Shares

When you create a share link, anyone with the link can see the shared content. The capture location can be removed from downloads. Views are only counted; we do not store who views a share. For visitors of shares, the legal basis is our legitimate interest in providing the content you share (Art. 6(1)(f) GDPR).

Removal requests

Anyone viewing a share can ask for a photo or video to be removed (“Request removal”). We store the reason, the details you write, the email address you give (optional, so they can answer you), the file and share concerned, and the time, and pass the request on to the person who shared the link: they see it under “Shared links”, including your email address, get an email about it (without your details) if Crate sends emails (section 9), and decide what happens. A request is deleted one year after it is closed, or with the account of the person who shared the link. The legal basis is the legitimate interest of the people shown, and ours, in having such requests reach whoever can remove the content (Art. 6(1)(f) GDPR). Reports of illegal content to us as the operator: see the legal notice.

7. Optional features

“Also in iCloud Photos”

If you set up the helper on your Mac, it sends Crate the identifier, file name, file size, and capture time of each item in your Photos library — no photos, places, people, or albums. The list is replaced with every report and deleted when you disconnect.

Connected apps

If you allow another app to use your library (“Allow … to use your Crate library?”), Crate gives that app read access through an interface: the list of your photos and videos with their details (such as the file name, capture time, camera, and format — not the location), your albums, and the files themselves, including the originals with the metadata embedded in them (which may include the location). Hidden and deleted items are never included. We store which app you allowed, what it may do, when you connected it, and when it last used the access. The app processes what it reads under its own privacy policy. You can disconnect an app at any time in Settings → Account: its access ends at once, and our record of the connection is deleted. The legal basis is Art. 6(1)(b) GDPR (you ask us to make your content available to the app).

Storage allowance and our other apps

Your sign-in account comes with a storage allowance, which our other apps that you use with the same account share with Crate. For it we store your account identifier, the allowance and any extra storage, and for each of those apps how many bytes of your files it keeps (not the files or their names). Those apps see these figures, never your library. If you save a file from one of them into Crate, that app gives Crate a short-lived link to the file; Crate downloads it into your library like an upload and then forgets the link. If you have no library yet, saving creates one on managed storage (storage we run for you, counted against the allowance); your name and email address are added when you first sign in to Crate. The legal basis is Art. 6(1)(b) GDPR (providing the storage and the saves you ask for). Deleting your Crate account deletes the library; the allowance belongs to your sign-in account and is deleted with it.

Upload speed measurement

To measure before an import, your browser sends random test data to the server; it is discarded at once.

8. Cookies and browser storage

Crate only uses cookies and browser storage that are strictly necessary (§ 25(2) no. 2 TDDDG); no consent is required for them:

• the sign-in session cookie (crate_session), up to 30 days, and while you sign in, for 10 minutes, crate_oauth_state, crate_oauth_pkce and crate_oauth_return;
• crate_grid: your view options for the overview, 1 year;
• crate_share_…: after entering a share's password, 7 days;
• crate_seen: so a view of a share is counted once a day, 24 hours;
• in your browser's local storage: light/dark mode, recently used tags and people, the upload limit, and whether the info panel is open. This stays on your device.

Fonts are served from our server; no connections to Google or other providers are made.

9. Emails

The sign-in service sends one-time sign-in codes through Resend (Resend, Inc., USA), which acts on our behalf (Art. 28 GDPR); it receives your email address and the message. Crate itself currently sends no emails.

10. Recipients and transfers to third countries

Recipients of your data are Hetzner as our host, Resend for sign-in codes, Google if you sign in with Google, and — on your instructions — your own storage provider and the apps you connect (section 7). Beyond that we do not pass your data on unless we are legally obliged to. Resend and Google may process data in the USA; such transfers rely on the EU–U.S. Data Privacy Framework or the EU standard contractual clauses (Art. 45, 46 GDPR). Your photos and videos never leave the European Union.

11. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20), and to object to processing based on legitimate interests (Art. 21). Much of this you can do directly in Crate: change your details, delete content, download everything, and delete your account. You can also lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), in particular in the Member State of your habitual residence, place of work, or of the alleged infringement.

There is no automated decision-making within the meaning of Art. 22 GDPR. The account details are required to use Crate; without them we cannot provide an account.

12. Changes

We update this policy when Crate or the law changes. The version published here applies. See also the terms of use.