Privacy & cookies
Last updated 27 October 2026
What we keep
Your account (name, email, a salted hash of your password, never the password itself), your projects and chats, the data your published apps save in their built-in database, and your payments (plan, amount, UPI reference). Keys you connect through integrations are stored encrypted and are never shown back in full, not even to the admin.
Cookies
When you first visit, Craftable asks before saving anything optional. You can change your choice any time with Cookie settings at the bottom of the home page or in Account.
| Name | Type | What it does | How long |
|---|---|---|---|
cr_sess | Essential | Keeps you logged in. HttpOnly (page scripts can't read it), Secure, SameSite. | Until the browser closes, or 30 days if you tick Remember me. Logging out ends it at once. |
cr_admin | Essential (admin only) | The owner's admin sign-in. | 12 hours |
cr_consent | Essential | Remembers your cookie choice. No tracking. | 1 year |
| Preferences (on this device) | Optional | Light/dark theme, last used model and mode. | Until you clear them |
| Analytics | Optional | None are used today. If we ever add analytics they will only run when you allow them. | — |
Staying safe on shared devices
Leave Remember me off on a shared or family device: you'll be logged out when the browser closes. In Account → Signed-in devices you can see every device logged in to your account and tap Log out of all devices.
The Craftable app and offline files
The Android app (dev.craftable.app, from our website) opens this same website full-screen in your phone's browser engine, so the same account, cookies and choices apply. At launch it reads /app/version.json to tell you when an update is available; that request carries no personal data.
To load faster and show a page when you're offline, your browser keeps a copy of public files (styles, scripts, icons, fonts, images and the public home, pricing and templates pages). Your account, projects, chats, payments and anything from our API are never stored by it. Clearing your browser's site data removes these copies.
Password-reset emails are sent by an email delivery service only when you ask for one; the link works once and expires.
Your choices
You can delete projects any time, disconnect integrations in Integrations, and ask the owner to delete your account.
Contact
Questions about your data: reach the Craftable team through the app.