CrabStack Privacy Policy

Your privacy matters to us. It is the policy of CrabStack (we, us, or our) to respect your privacy and to comply with any applicable law and regulation regarding the personal information we collect about you, including through the website at https://crabstack.dev (the Site) and its related services. Personal information is any information that can be used to identify you. CrabStack is operated from Sweden and is the data controller for the personal information described here. This policy was last updated on 16 June 2026.

Information We Collect

We collect only what we need to sell and deliver a software license and to run the Site. The information falls into two groups: information you provide to us, and information collected automatically when you use the Site.

Information You Provide

  • Email address, when you buy a license, create an account, or contact us.
  • GitHub username, which you provide at checkout so we can grant repository access. We share this with GitHub to create your collaborator invitation (see GitHub Repository Access below).
  • Name and basic profile details, if you sign in with a third-party provider (GitHub or Google), limited to what that provider returns for sign-in.
  • Messages you send us, such as support or refund requests.

Payment card details are collected and processed directly by our payment provider, Stripe. We do not receive or store your full card number.

Information Collected Automatically

When you access the Site, our servers may automatically log standard technical data sent by your device, such as your IP address, browser type and version, the pages you view, and the date and time of access. When an error occurs, we may collect technical details about the error to diagnose and fix it. This data is used for security, diagnostics, and improving the Site. On its own it may not identify you, but it could be combined with other data to do so.

How We Use Your Information

  • To sell, deliver, and support your license.
  • To process payments and manage your purchase through Stripe.
  • To grant and manage repository access through GitHub.
  • To contact and communicate with you, including about support.
  • For security, fraud prevention, and to keep the Site safe and functioning.
  • To comply with our legal, tax, and accounting obligations and to resolve disputes.
  • For internal record keeping and to operate and improve the Site.

GitHub Repository Access

License delivery happens through GitHub. When you buy, we send the GitHub username you provide to GitHub, Inc. so that a read-only collaborator invitation can be created on the private repository. GitHub processes that information under its own privacy policy. We retain your username and your collaborator status for as long as your license access exists, so that updates remain available to you.

Payment Processing

CrabStack is the seller and merchant of record. We use Stripe as our payment processor. Stripe collects your payment details directly through its checkout flow, and we do not see your raw card number. From Stripe we receive information such as your Stripe customer ID, transaction identifiers and history, billing country, and tax information relevant to your purchase. Stripe handling of your payment data is governed by the Stripe Privacy Policy. Transaction records are retained as required by applicable tax and accounting law, typically for seven years.

Third-Party Services

We rely on a small number of third parties that may process your information on our behalf or as independent controllers:

  • Stripe, for payment processing.
  • GitHub, for repository access and delivery.
  • Sign-in providers (GitHub and Google), if you choose to create an account with them.
  • An email service provider, to send transactional email.
  • Our hosting provider, to run the Site.

Each of these has its own privacy policy governing its use of data.

Cookies

We use a small number of strictly necessary cookies, primarily to keep you signed in to an account if you create one. We do not use advertising cookies. Most browsers let you refuse or delete cookies; doing so may affect account features of the Site.

How Long We Keep Your Information

  • Account information: until you delete your account, plus 30 days.
  • Repository access records (GitHub username and collaborator status): for as long as your license access exists.
  • Payment and transaction records: seven years, to meet tax and accounting obligations.
  • Server logs and usage data: up to 12 months.
  • Support and other communications: up to three years.

We keep personal information only as long as we need it for the purposes described here or as required by law, after which we delete it or make it anonymous.

Security

We protect personal information by commercially acceptable means to prevent loss, theft, and unauthorized access, disclosure, or modification. No method of electronic transmission or storage is completely secure, so we cannot guarantee absolute security. You are responsible for keeping your own sign-in method and accounts secure.

Your Rights

Depending on where you live, you have rights over your personal information, including the right to access it, to correct it, to request deletion, to receive a copy in a portable format, to object to processing, and to request that we restrict processing. If you created an account, you can delete it and the associated personal data from your account settings. To exercise any of these rights, contact us at hello@crabstack.dev. We will respond within 30 days.

Legal Bases for Processing (EU and EEA)

Where the GDPR applies, we rely on the following legal bases: performance of a contract, to sell and deliver your license and provide support; legitimate interests, to secure, operate, and improve the Site and prevent fraud; compliance with a legal obligation, to retain tax and accounting records; and your consent, where we ask for it, which you may withdraw at any time.

International Transfers

Some of our service providers, including Stripe and GitHub, operate outside the European Economic Area. Where personal information is transferred outside the EEA, we rely on appropriate safeguards, such as the Standard Contractual Clauses approved by the European Commission.

Supervisory Authority

If you are in the EU or EEA, you have the right to lodge a complaint with your local data protection authority. Our lead supervisory authority is the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, IMY), at imy.se.

California Privacy

We do not sell your personal information, and we do not share it for cross-context behavioral advertising. In the past twelve months, we have collected identifiers such as email address, GitHub username, and IP address for the business purposes described in this policy. If you are a California resident, you may request to know or delete the personal information we hold about you by contacting us using the details below. We will not discriminate against you for exercising these rights.

Children

CrabStack is a developer tool and is not directed at children. We do not knowingly collect personal information from children under 13.

Business Transfers

If we or our assets are acquired, or in the unlikely event we cease operating, personal information may be among the assets transferred. Any acquirer may continue to use your personal information as set out in this policy.

Changes to This Policy

We may update this policy to reflect changes to our practices or to legal requirements. We will post changes on this page and update the date above. If the changes are significant, we will take reasonable steps to notify you.

Contact

For any question about your privacy, contact us at hello@crabstack.dev.