Privacy Policy

This Privacy Policy explains what information CraftPBR ("we") collects when you use the Service, how we use it, and the choices you have.

1. Information we collect

• Account data — your email address and display name.
• Content you submit — the prompts and reference images you use to generate materials.
• Generated materials — the map sets you create and any titles, tags, or projects you attach.
• Usage data — credit consumption and basic technical logs needed to run and protect the Service.
• IP address — seen on every request. We use it to rate-limit abuse and to determine which country you are in, so we know whether cookie consent must be opt-in where you live. The country lookup runs on our own server against a local table; your IP is not sent to a geolocation service.
• Device identifier — a random id stored in your browser (craftpbr_device_id) so the free-generation limit can be enforced for signed-out visitors. It is not linked to an account and carries nothing about you.
• Error reports — when the app crashes in your browser it sends us the error message and stack trace, capped at a few per session, so we can fix it.
• Analytics & advertising data — only in line with your cookie choice. See section 5.

2. How we use it, and on what legal basis

We use your data to operate the Service: authenticate you, run the generation pipeline, store and display your materials, enforce quotas, and prevent abuse. If you are in the EEA or the UK, the GDPR requires us to name a legal basis for each purpose:

• Performance of a contract — creating and running your account, generating materials, storing them, publishing Free-plan materials to the Community library, and processing payments. Without this data there is no Service to provide.
• Legitimate interests — keeping the Service up and secure: rate limiting, abuse and fraud prevention, quota enforcement, and fixing crashes. Our interest is running a service that works and is not abused; it is balanced against the fact that this data is minimal and never used to profile you.
• Consent — analytics and advertising cookies, and nothing else. You can withdraw it at any time via Cookie settings in the footer, and withdrawing is as easy as giving it. Withdrawal does not affect processing that already happened.
• Legal obligation — keeping the transaction records that tax and accounting rules require us to keep.

3. What becomes public

Your email address and account settings are never shown publicly. Only the material, its title/tags, and the author name you choose are public. See the Terms of Service for full details on Community publishing and licensing. Upgrade to Pro to keep materials private.

4. Who we share it with

We share the minimum data necessary with providers that help us run the Service. They act on our instructions and may not use your data for their own purposes. We do not sell your personal data.

• Google Cloud / Firebase — hosting, database, authentication, and file storage. Effectively everything in section 1 lives here.
• fal.ai — the AI generation provider. Receives the prompts and reference images you submit, in order to produce your maps.
• OpenRouter — powers the "Surprise me" prompt suggestion in the Studio. Receives only the generated suggestion request, no account data.
• Lemon Squeezy — payment processing and merchant of record. Receives your email address, your CraftPBR user id, and, if you accepted advertising cookies, your Google Analytics client id so a purchase can be attributed to the ad that led to it. We never see or store your card details.
• Google (Analytics 4 and Ads) — only if you accept the corresponding cookie category. See section 5.
• Content-delivery network — serves material images and thumbnails.

International transfers. These providers are based in, or process data in, the United States. Where data is transferred out of the EEA or the UK, it relies on the transfer mechanisms those providers have in place — the EU–US Data Privacy Framework and/or the European Commission's Standard Contractual Clauses.

5. Cookies & local storage

Strictly necessary (always on). We store an authentication token so you stay signed in, and an anonymous device identifier (craftpbr_device_id) used to enforce the free-generation limit for signed-out visitors. The Service cannot run without these, so they are not subject to consent.

Analytics (opt-in). Google Analytics 4 sets cookies (_ga, _ga_*) that tell us which pages and guides are used. Only set if you accept the analytics category.

Advertising (opt-in). Google Ads sets cookies (_gcl_*, _gac_*) so we can measure whether an ad someone clicked led to a signup. Only set if you accept the advertising category. We do not sell your data and we do not run ads on CraftPBR itself.

Where the default differs. If you are in the European Economic Area or the United Kingdom, analytics and advertising cookies are blocked until you accept them, and we show a banner asking. Elsewhere those cookies are set by default, because local law works on an opt-out basis rather than requiring prior consent.

Either way, you can change or withdraw your choice at any time via Cookie settings in the site footer, on every page — turning a category off deletes the cookies it had already set. To decide which default applies, our server looks up the country for your IP address locally, on our own machine; your IP is not sent to any third-party geolocation service for this.

6. Data retention & deletion

We keep your account data, projects, and materials for as long as your account exists — there is no automatic expiry, because a material you made two years ago should still be in your library.

You can delete your account at any time from Settings. Deleting your account removes your profile, projects, and materials from CraftPBR. Note that copies of Free-plan materials previously downloaded by other users cannot be recalled, as those were released under a public-domain-style license.

Two things outlive the account by design: transaction records, which tax and accounting rules require us to retain, and aggregate counters that contain no personal data. Cookies expire on their own schedule — the Google ones within two years of your last visit, or immediately if you switch a category off.

7. Your rights

If you are in the EEA or the UK, you have the right to access your data, to correct it, to have it deleted, to restrict or object to how we use it, and to receive it in a portable format. Where we rely on consent — analytics and advertising cookies — you can withdraw it at any time via Cookie settings in the footer, without affecting what was processed before you did.

Many US states, including California, give similar rights to know, delete, correct, and to opt out of "sharing" personal information for cross-context behavioural advertising. The same Cookie settings link is how you opt out.

To exercise any of these, email us at the address below; we will respond within one month. You will not be charged, and we will not treat you differently for asking. If you are in the EEA or the UK and you think we have got it wrong, you also have the right to complain to your national data protection authority.

8. Contact

CraftPBR is operated by Timur Tadjikov, who is the controller of the personal data described in this policy. Questions about privacy, or a request under section 7? Email contact@craftpbr.com.