Privacy & Data

Privacy Policy

Last updated: September 2026 · Committed to zero tracking bloat

1. Overview

At Crazy Websites, we respect your privacy. We do not sell your personal data to advertisers, we do not use predatory tracking networks, and we collect only the minimal information necessary to deliver products, process payments, and verify creator transactions securely.

2. Your Files & Data Ownership

Your purchases are yours. Files you buy or upload — whether you're a buyer or a creator — belong to you and are never shared, sold, or handed to anyone outside the transaction they belong to. We store them only to deliver them to their rightful owner, and access to a creator's uploaded files is limited to what's needed for automated malware scanning and moderation review. Crazy Websites is a marketplace and payment facilitator — a middleman, not an owner of anything bought or sold here.

3. Information We Collect

  • Account Information: Name, email address, password hash (bcrypt), and account role.
  • Creator Profile Data: Bio, portfolio URLs, payout destination information (bank details or crypto wallet address).
  • Transaction Records: Order IDs, products purchased, amounts paid, and license timestamps. We do NOT store full credit card numbers — payment data is tokenized securely via Lemon Squeezy.
  • Communication: Support ticket threads and hiring inquiries submitted to creators.

4. Cookies & Local Storage

We use secure, httpOnly cookies exclusively for user authentication and session management. We also utilize lightweight local browser storage to cache your theme preferences (dark/light) and temporary wishlist items.

5. Third-Party Infrastructure

We partner with trusted enterprise infrastructure providers:

  • Cloudflare R2: Encrypted, geo-distributed storage for public preview assets and private downloadable zip packages.
  • Lemon Squeezy: Merchant of Record for global payment processing, sales tax handling, and VAT compliance.
  • MongoDB Atlas: Encrypted database cluster, run on infrastructure with SOC 2-certified security controls.

None of these providers are given access to your data beyond what's strictly required to perform their function — storage, payments, or hosting. No provider is permitted to use your data for their own purposes.

6. Security

Every connection to the platform is encrypted. Passwords are hashed (bcrypt, never stored in plain text), authentication sessions use short-lived, revocable tokens, and every file a creator uploads is automatically scanned for malware before it can be purchased. Sensitive actions — login, checkout, payout requests — are rate limited to prevent abuse. Admin access to your account is scoped, logged, and restricted to what a given task actually needs.

7. Your Data Rights

Under GDPR, CCPA, and global privacy standards, you have the right to access, export, or request deletion of your personal data at any time. To request a complete data export or account erasure, please contact support or open a ticket from your account.