Privacy.

What stays in your browser, what leaves it and when, and how to take any of it back. This page describes what the site does, read from the code that does it. When the code changes, this page changes with it.

Crate has no accounts and sets no cookies. Your reading mode, your want list, your crate and your preferences live in this browser's storage and nowhere else. Three things can leave, each on its own terms: a connection to a music service you choose to make, a seed you choose to send, and anonymous read-counts you can switch off.

Everything personal is kept in this browser's local storage under keys that start with crate.: the theme you picked, the records you want, the crate you built by connecting a source, and the choices you made while connecting. No copy exists on a Crate server, because there is no Crate server holding readers' data. Clear this browser's site data and it is gone; nothing remains to delete anywhere else.

When you connect Discogs, Spotify or Last.fm, your browser talks to that service directly. Crate's pages never see your password. What comes back, your collection or your saved albums or your loved tracks, is matched against the corpus in this browser and stored here.

• Discogs reads a public collection by username, or a CSV you export yourself.
• Spotify signs you in on Spotify's own page and asks for one permission, reading your saved library. The grant Spotify returns is kept in this browser so a later re-sync can run without asking again. Removing the import removes it.
• Last.fm reads a public profile by username. No sign-in.

Settings has a Remove import button for each source. It deletes what was imported and the grant that fetched it. Your library on the service is untouched either way.

Settings offers a send button that shares a scrubbed copy of your crate with the atlas, so that scenes people own records from can be written next. Nothing is sent until you press it. What leaves is shown to you in full before it goes: record identities and counts, with usernames and anything personal removed, first in your browser and again on arrival. It is stored so the writing queue can read demand; it is never joined to read-counts, and it carries nothing that names you.

The site counts reads: which pages get read, for how long, whether a listen link was followed, whether a search found nothing. The writing queue uses these to know what is read. The counts are anonymous by construction.

• No cookies and no persistent identifiers. Nothing is stored that could recognise you on a later visit.
• One random token lives for the length of a tab and dies with it, so that the pages of one visit can be read in order. It is never written to lasting storage.
• One bit says whether a crate exists in the browser. Never its contents.
• Your address is not stored. The country the request came from is kept, coarsely.
• A search that finds nothing sends the words you typed, folded to plain lowercase, so that a missing scene can be noticed. Nothing else about the search is kept.

If your browser sends Global Privacy Control or Do Not Track, nothing is counted, without you touching anything. Otherwise Settings, under Reading data, switches counting off in this browser.

Like any web page, some parts of Crate come from other hosts, and each of those hosts sees the request that fetches them: the typefaces from Google Fonts, the map library and its tiles on the Explorer, and the Spotify or Bandcamp player on a scene page when you scroll to it. Crate sends none of your data to any of them; they see what a browser shows any site it loads from. The site tells browsers which hosts it may talk to and no others.

The new-scenes feed is a file. Subscribing to it happens in your reader, and Crate learns nothing about who subscribes. The podcast is hosted on Spotify, under Spotify's terms.

• Remove an import: Settings, the source's row, Remove import.
• Stop being counted: Settings, Reading data. Or send Global Privacy Control.
• Everything at once: clear this site's data in your browser. There is nothing left on the other side to ask about.

Dated 2026-09-18 and changed only alongside the code it describes. Corrections to the writing go where all corrections go, the errata on the Review.