Privacy Policy

1. Overview

This policy explains what CrateDiggr ("we", "us") collects when you use the CrateDiggr website and browser extension (together, the "Service"), how we use it, who we share it with, and the choices you have. The short version: we collect what we need to run the Service, the extension only works on the sites it supports, and we do not sell your data or use it for advertising.

2. Information we collect

• Account information. Name, email address, username, and a hashed password when you register. If you sign in from the extension, we issue it an access token, which we store only in hashed form.
• Email opens. The emails we send you contain a small image that tells us whether and when the email was opened, and which kind of mail service loaded it. We do not record your IP address or device, and we do not use it for advertising.
• Download activity. When you are signed in, records of tracks you save through the Service (track, artist, source, and time), used to power your download history, mark what you already own, and compute aggregate statistics. When you are not signed in, the extension still reports the download, but attached to a random identifier created when it was installed instead of to an account, along with the track, the download source, and, where SoundCloud provides them, your SoundCloud account id and handle, or the anonymous identifier SoundCloud has assigned to your browser. We use those reports for per-track and overall download totals and, if you later create an account and connect SoundCloud, to match those earlier downloads to it. These identifiers are also used to apply the free plan's daily download limit.
• Website analytics. If you turn analytics cookies on, the website uses Google Analytics to measure visits to cratediggr.com: which pages are opened, roughly where in the world the visit came from, and which site or search sent you. Google sets cookies in your browser so that a returning visit can be told apart from a new one (see "Cookies" below). Until you turn them on, Google Analytics is not loaded at all. We do not send Google your name, email address, or anything else about your account, and our internal admin pages are left out of the measurement entirely.
• Usage statistics. The extension sends Google Analytics events about how it is used (for example, a download started) under a random install identifier, and sends us counts of which features were used, of whether your SoundCloud is in its light or dark theme (at most once a day), and of which sites the buy and download links on SoundCloud tracks point to (with the public track address), with no identifier. Nothing about your account goes to Google. Clicks on those links are also recorded one by one, with your account or install identifier, as described under Buy and download link clicks below.
• Diagnostics. If SoundCloud shows you a bot check, the extension sends us a report linked to your account (or the install identifier when signed out): the type of check, the kind of page, and what the extension did in the ten minutes before, including how many times you pressed SoundCloud's Like, Repost, Follow or Comment buttons. Never page addresses, handles, track names or comment text. We use it only to stop anything of ours that triggers bot checks, and keep it for 90 days. On Firefox you can switch both off in the add-on's permissions.
• Contributions. Tracklist entries, track IDs, suggested corrections, and reports you submit, associated with your account.
• Billing status. Your subscription tier and its status. Payment card details go directly to Stripe, our payment processor, and never touch our servers.
• Problem reports. When a download does not work, the extension sends us the SoundCloud track link, the download-gate link, and an error code, so we can find and fix broken gates. It does this automatically because these failures are usually invisible - the extension simply shows no download button, so you would have nothing to report. You can turn that off in the extension under Settings → Report a Problem, which is also where you can send a report yourself and add a note. These reports never include audio, page contents, or anything else you browse.
• Technical data. Standard server logs (IP address, request path, user agent, timestamps) kept for security, rate limiting, and debugging, plus the extension's version number sent with its API requests. Sign-up and similar forms run an automated bot check that processes technical signals to tell humans from bots.

3. The browser extension

The extension runs only on the sites it supports: SoundCloud and the download-gate services it can complete (such as Hypeddit, ToneDen, PumpYourSound, pl8list, Droploud, GateRush, Download Gater, Laylo, and Influence Planner), plus the CrateDiggr website. On those pages it reads the page content locally in your browser to find free downloads, place its buttons, and complete gate steps you ask it to.

• Stays on your device. Your extension settings and your local download history are stored in your browser's extension storage. Page content the extension reads is processed in your browser and is not sent to us.
• Sent to our servers. Your credentials when you sign in; your contributions (track IDs and related data) when you submit them; requests to check your account and subscription status; problem reports when a download fails (see above - the track link, the gate link, and an error code); download events, including when no account is signed in (see "Download activity" above); the buy and download link clicks described below; and the usage counts and bot-check sightings described above. When you are signed in, the extension also sends your extension settings and the list of optional sites you have allowed it to access, so we can support you if something does not work. Every request carries the extension version, and your access token when you are signed in. The usage events also go to Google Analytics directly from your browser, under the random per-install identifier and never with your account details.
• Buy and download link clicks. When you click a buy or download link on a SoundCloud track while the extension is installed (for example a link to Bandcamp, Beatport or a download gate), the extension tells us. We record the address the link goes to, without its query string (the part after the "?"), the site it points to, the text on the button, the track it was on, and the time you clicked. If you are signed in, the record is tied to your CrateDiggr account; if not, it is tied to the extension's random install identifier instead. When the link is one of CrateDiggr's own price buttons, we record that click separately, together with the price the button showed. We use these records to understand which stores and download sites fans use, and to improve the Service. We keep them for as long as your account exists, and they are deleted with it. Records made while signed out are tied only to the install identifier, not to an account; to have those deleted, email support@cratediggr.com.
• Shared with a gate, at your direction. Some gates ask for your email: Laylo sends the download by email, and Influence Planner asks for it before its SoundCloud step. When you download from one, the extension enters the email address saved in your extension settings on that gate's page, so the gate receives it. On Laylo, that also signs the address up for the artist's Laylo messages. The gate handles your email under its own privacy policy, and it does not pass through our servers.
• Never collected. The extension does not read or collect your general browsing history, does not run on sites it does not support, does not collect page content for us, and does not sell or share data with advertisers or data brokers.

You can use the extension without an account; account features are only active once you sign in.

4. How we use information

• Provide, maintain, and improve the Service.
• Authenticate you and keep your account secure, including enforcing rate limits.
• Process subscription payments through Stripe and manage entitlements.
• Send transactional email (verification, password reset, billing notices). No marketing email without your consent.
• Show crowdsourced tracklist data to other users (your contributions are the product).
• Produce aggregate, de-identified statistics.
• Investigate abuse and enforce our Terms of Service.

Where GDPR or similar law applies, we rely on performance of our contract with you (running the Service), our legitimate interests (security, abuse prevention, improving the Service), consent where we ask for it, and legal obligations.

5. Who we share it with

We do not sell personal data, and we do not share it with advertisers or data brokers. We share personal data only with service providers that process it on our behalf and only to the extent they need it: payment processing (handled by Stripe - your card details go to them directly, never to us), website analytics (Google, through Google Analytics - it measures visits to the website and the extension's usage events, and receives nothing about your account), cloud hosting and security infrastructure, error monitoring, and transactional email delivery. These providers are bound by their own contractual and legal obligations to protect your data.

We may also disclose information if required by law, to protect the rights and safety of users or the public, or as part of a business transfer (in which case this policy continues to apply).

Your public contributions (tracklist entries and track IDs, credited to your username) are visible to other users by design.

6. Retention and deletion

We keep your account data while your account is active. When you delete your account, or ask us to, we delete or de-identify your personal data within a reasonable period, except what we must keep for legal, billing, or security reasons. Crowdsourced contributions may remain in de-identified form so tracklists other users rely on stay intact. Server logs are retained for a limited period. Diagnostic reports are kept for 90 days. Buy and download link click records are kept while your account exists and deleted with it. To request deletion, email support@cratediggr.com.

7. Your rights

Depending on where you live (including under GDPR and CCPA/CPRA), you may have the right to access, correct, delete, or receive a copy of your personal data, to object to or restrict processing, and to withdraw consent. You also have the right to complain to your data protection authority. To exercise any of these rights, email support@cratediggr.com; we will respond within the timeframe the law requires. We do not discriminate against you for exercising your rights.

8. Cookies

We keep cookies to a minimum and sort them into two groups. Essential cookies keep you signed in, keep the site secure, and remember your cookie choice. They are always on, because the site cannot work without them, and none of them is used for tracking. Analytics cookies are set by Google Analytics so we can measure website traffic. They are off until you turn them on, and until then Google Analytics is not loaded at all. We set no advertising cookies. We also use Cloudflare Web Analytics, which sets no cookies and identifies nobody, so it is not covered by the toggle.

The first time you visit, a banner asks what you would like. You can change or withdraw your choice at any time with the Cookie settings button in the footer of the site (or in the banner); withdrawing deletes the Google Analytics cookies already in your browser. Your choice is kept for 12 months, after which we ask again. If your browser sends a Global Privacy Control signal, we treat it as a refusal: analytics stays off and we do not ask.

9. Security

All traffic to the Service is encrypted with HTTPS. Passwords and extension access tokens are stored only in hashed form, and we apply technical controls including strict content-security policies and rate limiting. No system is perfectly secure; if a breach affects your personal data we will notify you as the law requires.

10. Children

The Service is not directed at children under 13, and we do not knowingly collect personal data from them. If you believe a child under 13 has an account, contact us and we will delete it.

11. International transfers

The Service runs on a global edge network, so your data may be processed outside your country. Where required, we rely on appropriate safeguards (such as standard contractual clauses implemented by our providers) for those transfers.

12. Changes to this policy

We may update this policy as the Service evolves. If a change is material we will notify registered users by email or an in-product notice before it takes effect. The "Last updated" date above always reflects the current version.

13. Contact

Privacy questions and rights requests: support@cratediggr.com, or see our contact page.