CRAFTCOST

Privacy Policy.

Effective: August 30, 2026

The short version. What you type into CraftCost - your materials, products, recipes, costs, and sales - is stored on your device and is never sent to us. There is no CraftCost account and no ads. Two things can leave your device: anonymous usage and crash statistics, which you switch on or off in Settings and which start off entirely in Europe and the UK, and, only if you choose to connect an Etsy shop, that shop's listings and open orders, which travel through our server on the way from Etsy to your phone.

1. Who we are

CraftCost is a mobile application published by CodeEnsis Ltd. ("we", "our", "us"), Χριστόδουλου Σώζου 2, EIFFEL TOWER, Floor 3, Flat/Office 301, 1096 Λευκωσία, Κύπρος. CraftCost is a pricing calculator for handmade sellers. This policy explains what data the app handles and your rights under the EU General Data Protection Regulation ("GDPR").

2. Data stored on your device

Everything you enter - materials, products, recipes, costs, stock, sales, pricing settings, and preferences - is stored only on your device. It is not transmitted to us, and we have no ability to access it. There is no CraftCost account, and no copy of your workbook exists anywhere but on your phone. If you connect an Etsy shop, the listings and order quantities we fetch are also stored on your device and nowhere else - see section 4.

3. Usage and crash statistics

CraftCost includes Google Analytics for Firebase and Firebase Crashlytics. They record how the app is used and what breaks in it, so we can tell which features earn their place and fix crashes we would otherwise never hear about.

What is recorded: which screens you open and which actions you take (for example "a product was saved", "the paywall was shown"), counts and settings such as how many materials you have saved or which plan you are on, and, for crashes, the technical state of the app at the moment it failed. Events are tied to a random identifier generated on your device at install, not to your name, email, or any account.

What is never recorded: the content of your work. Material names, product names, prices, costs, recipes, and anything read from a connected Etsy shop never appear in an analytics or crash report. We do not build an advertising profile, we run no ad SDK, and we do not sell data to anyone.

Your choice. Settings has a single switch, Usage and crash reports, that turns all of this on and off. If your device's region is in the European Economic Area, the United Kingdom, or Switzerland, the switch starts off and nothing is collected unless you turn it on. Everywhere else it starts on and you may turn it off at any time. Turning it off stops collection immediately, not at the next launch.

These statistics are held in our Google Analytics property and copied into our own Google BigQuery project for analysis. Statistics are switched off entirely in development builds of the app.

4. Connecting an Etsy shop

Connecting Etsy is optional and off until you start it yourself. Its only purpose is to warn you before you sell something you no longer have the materials to make. If you never connect a shop, nothing in this section applies to you.

What you authorise. Etsy's own screen asks you to grant CraftCost read access to your shop. We request read scopes only: CraftCost cannot edit your listings, change your prices, alter your orders, or message your buyers. You can withdraw access at any time from Settings in the app, or from your Etsy account's connected-apps page.

What we read. Your shop's name and active listings (title, quantity, price, thumbnail), and orders from the last 90 days that you have not yet marked as shipped. Etsy returns an order as a full receipt, which includes your buyer's name and shipping address. CraftCost takes only the quantity of each item ordered from it; the rest is discarded and never written to storage or to a log.

How it travels. Requests to Etsy are relayed through our server at codeensis.com/api/etsy, because Etsy's API requires a secret that must not be shipped inside a mobile app. Your shop data therefore passes through our infrastructure on its way to your phone. It is relayed, not collected: we do not store your listings or orders on that server, and receipt contents are never written to its logs. Your Etsy access token is held in your device's encrypted keystore and is never sent to us.

Your buyers. Because CraftCost reads orders on your behalf, you remain the controller of your buyers' personal data under GDPR and we act as your processor for the moment it is in transit. We use it for no purpose other than delivering it to your app.

Etsy's own terms. Etsy processes this data under the Etsy Privacy Policy. Listing information older than six hours is not displayed in the app, in line with Etsy's API terms.

5. Third-party services

To provide certain features, the app relies on the following services, each governed by its own privacy policy:

6. Sharing and exports

When you export a price sheet (PDF or image), the file is generated on your device. If you share it, your device's standard share sheet sends it to the app or contact you select. We are not involved in that transfer.

7. Permissions

CraftCost requests no sensitive device permissions. Exporting and sharing use your operating system's built-in share dialog, at your request.

8. Data retention and deletion

Because your workbook lives on your device, you control it. Deleting an item removes it immediately; uninstalling the app removes all CraftCost data from the device, including any Etsy listings it had stored and the access token for your shop. Disconnecting Etsy in Settings does the same for the Etsy data without touching anything else.

Usage and crash statistics are retained by Google under the retention period set on our Analytics property, and in our BigQuery project for as long as they are useful for product analysis. Because they carry a random install identifier rather than your identity, we usually need that identifier from you to find and remove a specific install's events - contact us and we will assist. Purchase records held by Google Play, the App Store, and RevenueCat are governed by their own policies.

9. Children

CraftCost is intended for business use by adults and is not directed to children under 13 (or under 16 in the EEA). We do not knowingly collect data from children.

10. Legal basis (GDPR) and your rights

Your workbook never reaches our servers, so the rights of access, rectification, and erasure over it are satisfied directly on your device, where you can view, edit, and delete everything.

For the remainder: purchase data processed via Google Play, the App Store, and RevenueCat is handled on the legal basis of performance of a contract, Art. 6(1)(b) GDPR. Usage and crash statistics are handled on the basis of your consent, Art. 6(1)(a) GDPR, wherever consent is required - the switch in Settings starts off in the EEA, the UK, and Switzerland, and nothing is collected until you turn it on. Where consent is not required they rest on our legitimate interest in maintaining and improving the app, Art. 6(1)(f) GDPR, and the same switch turns them off. Reading your Etsy shop is handled on the basis of your consent, Art. 6(1)(a) GDPR, given when you authorise the connection and withdrawn when you disconnect it.

You may contact us to exercise rights of access, rectification, erasure, restriction, portability, or objection, and you may lodge a complaint with your local data protection authority.

11. Security

Your workbook is protected by your device's own security (lock screen, encryption); we recommend keeping your device secured and backed up. Your Etsy access token is held in the device's encrypted keystore - the Android Keystore or the iOS Keychain - rather than in ordinary app storage. Traffic to our relay and to Etsy is encrypted in transit.

12. Changes to this policy

We may update this policy as CraftCost evolves. Material changes will be reflected here with a new "Effective" date above.

13. Contact

Privacy questions or requests: privacy@codeensis.com. General support: support@codeensis.com. A human reads every message.