Privacy Policy

Effective November 4, 2026

This policy explains what information Crowd'd collects when you use crowdd.shop, why we collect it, and the choices you have. We collect what we need to run group buys, and we don't sell your personal information.

1. What we collect

Information you give us

Account: your name, email address, and password (stored only as a secure hash, never in plain text).
Activity: the groups you join and leave, how many copies you commit to, your watchlist, product requests and votes, and your notification settings.
Sellers: studio name, website, support email, store bio, seller requests, listings, images you upload, and the product keys you provide for buyers.
Messages: anything you send us, for example by email.

Information collected automatically

Sign-in sessions: your IP address and browser type, stored with each session so you can stay signed in and so we can spot suspicious sign-ins.
Records: when you accepted our Terms of Service, and basic logs of requests to the site, kept for security and to fix problems.
Bot check: on sign-up and password reset, Cloudflare Turnstile looks at signals from your browser and device to tell people from bots.

Payments. Crowd'd doesn't process payments yet. When it does, card details will be handled by our payment provider. We won't store full card numbers.

2. How we use it

To run your account and the groups you join, including counting buyers, closing groups, and delivering keys to your library.
To send emails about your account and groups (see Emails).
To review seller requests and moderate listings and requests.
To keep Crowd'd secure, prevent fraud and abuse, and enforce our terms.
To understand what's working and improve the service.
To meet legal obligations.

If you're in the EU, UK, or a similar region, our legal bases are: performing our contract with you, our legitimate interests in running and securing the service, your consent where we ask for it, and legal obligations.

3. What other people can see

Group activity: when you join a group, its public activity feed shows your first name and last initial (for example "Alex R.").
Sellers see the same short name and how many copies each buyer committed to, so they can plan delivery.
Product requests you post, and their vote counts, are public.
Seller profiles (studio name, website, support email, and bio) are public on listings.

We don't sell or rent your personal information, and we don't share it for advertising. We share it only:

With service providers who run parts of Crowd'd for us under contract. Today that's Cloudflare, which hosts the site, database, image storage, and email, and runs the bot check. A payment provider will be added when payments launch.
With sellers, as described above, for groups you join.
For legal reasons, if we believe it's required by law, or needed to protect the rights, safety, or property of our users, the public, or Crowd'd.
In a business transfer, such as a merger or sale, in which case this policy continues to apply to your information.

5. Cookies

We use one essential cookie to keep you signed in. We don't use advertising or third-party tracking cookies. The bot check may set its own cookies, used only to tell people from bots.

6. Emails

We send emails you need, such as password resets, seller decisions, group updates, and key delivery. You can turn off optional updates, like price drops and the weekly picks email, in your account settings. Security and account emails can't be turned off while you have an account.

7. How long we keep it

Account information is kept while your account is open.
Sign-in sessions expire after 30 days.
When you delete your account (in Settings), your name, email, password, profile, watchlist, votes, seller request, sessions, and emails are deleted right away, your open group spots are given up, and your name is removed from group activity. Requests you posted stay up without your name.
We keep a minimal record of completed purchases (what was bought and when, not who) for accounting, disputes, and fraud prevention, and longer where the law requires it.

8. Your choices and rights

In your account settings you can update your name, password, and notification settings, and delete your account. You can also email us at hello@crowdd.shop to:

get a copy of your personal information,
correct it,
have us delete your account for you, or
object to or restrict how we use it.

Depending on where you live (for example under the GDPR in the EU and UK, or state laws such as the CCPA in California), you may have these and other rights, including the right to complain to your local data protection authority. We won't treat you differently for using them. We'll verify requests by email before acting on them.

9. Security

We use encryption in transit (HTTPS), hash passwords, limit who can access data, and protect sign-up and password reset against bots. No system is perfectly secure, so please use a strong password that you don't reuse elsewhere.

10. Children

Crowd'd isn't meant for children under 13, and we don't knowingly collect their information. If you think a child under 13 has given us information, contact us and we'll delete it.

11. Where your data is processed

Cloudflare runs Crowd'd on servers around the world, so your information may be processed outside the country where you live. Where required, we rely on appropriate safeguards for those transfers, such as standard contractual clauses.

12. Changes to this policy

We may update this policy. If a change is significant, we'll let you know by email or on the site before it takes effect. The date at the top shows when it last changed.

13. Contact

Questions or requests about your privacy? Email hello@crowdd.shop.

Back to Crowd'd