Privacy notice
Last updated 31 October 2026
CrateSpark is a private service run by its administrator for themselves and a few invited testers. There is no public sign-up: you can only have an account if the administrator invited you. This page explains, in plain language, what is stored about you, why, and how to have it removed.
Who runs it
The administrator who invited you runs CrateSpark and decides how your data is used. Contact: admin@cratespark.uk.
What is stored
- Your account: your username, your password (stored only as a salted one-way hash), your authenticator secret and recovery codes if you turn on MFA (encrypted or hashed), and the dates your account was created and changed.
- Your music data: your Discogs collection as synced, your playlists, exclusions, track-duration corrections and anything else you save in CrateSpark.
- Connected services: the keys and sign-in tokens you enter for services such as Discogs, TIDAL, Spotify, Apple Music, Last.fm or OpenAI, stored encrypted. They are used only for your own requests, never for anyone else's.
- Photos you upload for Add to Collection, until you delete them.
- Security records: sign-in sessions, a log of account and security events (for example sign-ins, password or MFA changes), and short-lived counters used to slow down repeated failed sign-ins.
- Web server logs: each request's time, address (including your IP address), page and response, kept for 14 days.
CrateSpark uses only the cookies needed to sign you in and protect forms. There is no advertising, analytics or tracking.
Other services involved
- Hosting: the server is an IONOS virtual server in a UK data centre. IONOS provides the machine but does not use your data.
- Services you connect: when you sync, search, export or use AI features, CrateSpark sends the needed details (for example artist and track names, or a photo for label analysis) to that service using your own account or key. Their own privacy policies apply. Paid AI requests use your own OpenAI key, only after you confirm them.
- Song previews and track lengths: artist and title searches are sent to Apple's public iTunes search and to MusicBrainz, without your name or account.
Why
Only to provide the test service to you and to keep it secure: signing you in, running the features you use, investigating problems and preventing misuse. Your feedback helps improve CrateSpark; your data is never sold or shared for any other purpose.
Who can see it
Other testers cannot see your data. The administrator, who runs the server, and the hosting provider can technically access stored data; the administrator looks at it only to run and fix the service or when you ask.
How long it is kept
- Your account and music data: until you ask for them to be deleted or the test service ends.
- Encrypted backups: made nightly, kept for about a week on the server and copied to the administrator's own computer, where older copies may be kept longer for recovery.
- Web server logs: 14 days. Security event records are kept with your account.
Your choices
You can disconnect any connected service in Connected services at any time. You can ask for a copy of your data, for corrections, or for your account and data to be deleted by emailing admin@cratespark.uk. Deletion removes your account, music data, connected-service keys and sessions; a minimal record that an account existed and some security events are kept so that the service stays secure, and copies in backups disappear as those backups are replaced.