Snapshot of the source text at fetch time, not a live mirror of the policy page.
Plain-English summary
Craft's privacy policy has several notable concerns. Specifically, any content publicly shared through interactive features is not subject to the stated privacy protections and can be used by third parties (risk_flags-1). Furthermore, the company explicitly disclaims liability for unauthorized disclosure of user information and cannot warrant data security (risk_flags-2). Users must also be aware that the privacy policy may change without direct notification, with continued use implying acceptance of new terms (risk_flags-3). Lastly, user information may be transferred and stored globally, potentially in countries with different data protection laws than the user's home country (data_use-1).
90% confidence
Ask Verbaterm
Follow up on findings with grounded answers from this review. Not legal advice.
Risk Flags
Critical issues that represent material, hard-to-reverse harm to the user. These include significant financial risk, severe privacy violations, or substantial limitations on user rights that are difficult to mitigate.
high90% confidence
Public content is not protected by declared privacy safeguards.
Any content provided via the public sections of interactive features will be considered "public" and is not subject to the privacy protections referenced in the policy. Personal information provided through these features may be viewed and used by third parties for their own purposes.
Why it matters: Any personal information shared in public sections of interactive features on the service will not be covered by the privacy protections outlined in this policy and can be viewed and used by third parties for their own purposes.
Any content you provide via the public sections of these features will be considered “public” and is not subject to the privacy protections referenced herein. By using these interactive features, you understand that the personal information provided by you may be viewed and used by third parties for their own purposes.
A. Information You Provide to Us, paragraph 4 · Citation strength: strong
high95% confidence
No guarantee of information security and limited liability for unauthorized disclosure.
The service states that no system is 100% secure and they cannot ensure or warrant the security of any information provided. To the fullest extent permitted by applicable law, they do not accept liability for unauthorized disclosure.
Why it matters: The service explicitly states that it cannot guarantee the security of user information and disclaims liability for unauthorized disclosure to the fullest extent allowed by law. This means users bear the risk of their information being exposed in a data breach.
Unfortunately, no system is 100% secure, and we cannot ensure or warrant the security of any information you provide to us. To the fullest extent permitted by applicable law, we do not accept liability for unauthorized disclosure.
Security of your Information, paragraph 1 · Citation strength: strong
high90% confidence
Privacy policy may change without direct notification.
The policy states that it may be amended as new features, technology, or legal requirements arise, and users are advised to check back from time to time. Using the service signifies acknowledgement, acceptance, and agreement with all provisions of the Privacy Policy.
Why it matters: The privacy policy can be changed without direct notification, requiring users to regularly check for updates. Continued use of the service after changes implies acceptance of the new terms, which could include changes to how personal data is handled.
Although significant changes are rare, this policy may be amended as new features, technology, or legal requirements arise, so please check back from time to time. By using the Service, you acknowledge, accept and agree with all provisions of the Privacy Policy.
Review of how personal data is collected, processed, and shared. Findings in this section highlight potential concerns related to broad data collection, opaque sharing practices, or monetization of user data.
medium90% confidence
Information may be transferred and stored globally, with varying data protection laws.
All information processed by the service may be transferred, processed, and stored anywhere in the world, including the United States or other countries, and these locations may have data protection laws different from where the user lives.
Why it matters: Your personal information may be stored and processed in countries with different data protection laws than your home country, potentially exposing your data to different privacy standards and legal frameworks.
All information processed by us may be transferred, processed, and stored anywhere in the world, including but not limited to, the United States or other countries, which may have data protection laws that are different from the laws where you live.
International Data Transfers, paragraph 1 · Citation strength: strong
Cancellation and Renewal
Terms related to subscription management, account cancellation, and automatic renewals. Concerns often include unclear cancellation processes, automatic re-enrollment, or penalties for early termination.
Not clearly stated: No specific clauses regarding automatic renewal, cancellation procedures, or associated fees and refunds were found.
Gotchas
Surprising or less-obvious clauses that could lead to unexpected outcomes for the user. This includes unfavorable dispute resolution mechanisms, broad indemnification requirements, or limitations on service access.
Not clearly stated: No 'gotchas' or unusual clauses were identified based on the provided text.
Protections
Consumer-friendly clauses that protect users' rights, enhance their privacy, or offer beneficial terms. These may include strong data privacy commitments, clear cancellation policies, or robust data security measures.
Protection95% confidence
Craft states it does not own or sell user data, nor uses it for advertising.
Craft explicitly states that it does not own user data, sell it to third parties, or use it for advertising purposes.
Why it helps: This commitment means your personal data and content are not treated as their property for sale or advertising, enhancing your privacy and control over your information.
TLDR: Craft does not own your data, nor do we sell it to others or use it for advertising.
Commitment not to access private notes without consent or use data for AI model training.
Craft promises to never read or access private notes without written or verbal consent, and will never use user data to train AI models, emphasizing that the data belongs to the user.
Why it helps: This protects the confidentiality of your private notes by requiring explicit consent for access and ensures your data isn't used for AI training, preserving your ownership rights.
We will never read or access your private notes without written or verbal consent, and we will never use your data to train AI models - it's your data, period.
Google user data is not sold, transferred, or disclosed to third parties unless necessary for service provision or legal compliance.
Craft explicitly states they do not sell, transfer, or disclose Google user data to third parties, except as required for providing services via Google's APIs, compliance with law, or protection against security threats.
Why it helps: This minimizes the sharing of your Google user data, restricting its use primarily to service functionality and specific legal or security needs, thereby enhancing your privacy for data connected through Google integrations.
We do not sell, transfer, or disclose your Google user data to third parties, except as necessary to (i) provide the Services by communicating with Google's APIs on your behalf, (ii) comply with applicable law, or (iii) protect against security threats or abuse.
Disclosing your information to third parties, paragraph 7 · Citation strength: strong
Protection95% confidence
Google user data is never used for advertising, shared with data brokers, or transferred for unrelated purposes.
Craft guarantees that Google user data will never be used for advertising, shared with data brokers, or transferred to any third party for purposes unrelated to providing the services.
Why it helps: This strong commitment ensures that your Google user data is not exploited for marketing or shared with data brokers, significantly enhancing your privacy and preventing unsolicited targeting.
Google user data is never used for advertising, shared with data brokers, or transferred to any third party for purposes unrelated to providing the Services.
Disclosing your information to third parties, paragraph 7 · Citation strength: strong
Protection90% confidence
Clear opt-out option for promotional email communications.
Users can opt out of future emails by using the unsubscribe link found at the bottom of unwanted emails, though transactional emails will still be received.
Why it helps: You have a direct and easy way to stop receiving promotional emails, maintaining your control over unwanted communications.
If you receive an unwanted email from us, you can use the unsubscribe link found at the bottom of the email to opt out of receiving future emails.
Your Choices, paragraph 1 · Citation strength: strong
Protection85% confidence
Ability to control cookie usage.
Users can turn off cookies and find more information on how to opt-out via the Cookie Information page.
Why it helps: This gives you control over your online privacy by allowing you to manage and disable cookies, which are often used for tracking and personalization.
Cookies: You may turn off cookies, for more information, including how to opt-out, visit our [Cookie Information page](https://www.craft.do/s/4Jkx0IZL1GHzRx).
Your Choices, paragraph 2 · Citation strength: strong
Protection90% confidence
Users can connect or disconnect third-party integrations at any time.
Users have the option to connect or disconnect third-party integrations (like Google Calendar) from their account settings at any time.
Why it helps: This empowers you to manage which third-party services can access your data through the platform, giving you control over data sharing.
Third-Party Integrations: You can connect or disconnect third-party integrations (such as Google Calendar) at any time from your account settings.
Your Choices, paragraph 3 · Citation strength: strong
Protection90% confidence
Disconnection of integrations stops data access from that service, and associated cached data is removed.
Disconnecting a third-party integration will stop Craft from accessing data from that service, and any associated cached data in the user's workspace is removed promptly.
Why it helps: This ensures that when you revoke access for a third-party service, your data is no longer collected from that service and promptly deleted from your workspace, reinforcing your data control.
When you disconnect a third-party integration (such as Google Calendar), any associated data cached in your workspace is removed promptly.
Data Retention, paragraph 2 · Citation strength: strong
Protection95% confidence
Right to request correction or deletion of personal information.
Users have the right to request the correction of inaccurate or incomplete personal information and the deletion of their personal information.
Why it helps: These rights provide you with mechanisms to ensure the accuracy of your personal data and to have it removed from the service upon request, bolstering your data privacy and control.
Request Correction of your personal information where it is inaccurate or incomplete.
Your Privacy Rights, paragraph 3 · Citation strength: strong
Protection95% confidence
Service not directed at children under 16, and collected child information will be deleted.
The services are not for children under 16, and the company does not knowingly collect personal information from children. If they learn of such collection without consent, they will promptly delete the information and terminate the account.
Why it helps: This protects children's privacy by explicitly stating the service is not for them and committing to delete any unintentionally collected child data, aligning with child protection laws.
The Services are not directed to children under 16 (or other age as required by local law), and we do not knowingly collect personal information from children. If you learn that your child has provided us with personal information without your consent, you may contact us at support@craft.do. If we learn that we have collected a child’s personal information in violation of applicable law, we will promptly take steps to delete such information and terminate the child’s account.